hxxp://teamcommunmutty[.]com/gift/activation=Dor5Fhnm2w

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://teamcommunmutty.com/gift/activation=Dor5Fhnm2w

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
4244	msedge.exe
4244	msedge.exe
2836	identity_helper.exe
2836	identity_helper.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3276	4244	msedge.exe	84
PID 4244 wrote to memory of 3276	4244	msedge.exe	84
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 4080	4244	msedge.exe	85
PID 4244 wrote to memory of 2008	4244	msedge.exe	86
PID 4244 wrote to memory of 2008	4244	msedge.exe	86
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87
PID 4244 wrote to memory of 2324	4244	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://teamcommunmutty.com/gift/activation=Dor5Fhnm2w
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa333046f8,0x7ffa33304708,0x7ffa33304718
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15553062584245273254,3833901304951670353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
43KB

MD5
7f2c172ca810d85c0596390b4ab21df3

SHA1
d4acb412e626e744609aa326247bd7eeec469bec

SHA256
4ccac6b00b8d6b7bec9886d8a23d84131bed955d995a37b5017196b03d1edab6

SHA512
961fd847cdc7b7c54dcb5ec19e3446701de454e9d06e1e2025360a1d0b426d204fb8aec90b854c7b2dbe3153aa66b5d90ba56f8ac6a8bc996177642d6f55c263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
d717e7c27d73a11d659dd9458ac96943

SHA1
f97be567d42132ca2ac836daff4250a01785ad94

SHA256
6a19d7d137b035f6555902299749d6fd084ee476d73db96db2f753b053122937

SHA512
f7493d88b7a93d17652a43c7a1910fa89072a07649b06fd2d221fe593af3b65235e0c8dcfdb1ae1b1d55e1dc8738e6b0468a5e00ae97e2105884eebb212306b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
eb16740a7d1204819fa9665cf1b2335e

SHA1
3d954cbac9ba06a1691851d67206fa90ddc41c2d

SHA256
e6b83fcf6f1d2b252d8cee6371c4b5f772ef118ed291c5f9326359f9e91b792b

SHA512
a0e849b6ef3dadb755e9f7383346a1b560ce9b4d2a58bf76e913c714c0f2ca29711eb3371350aac03cfdfbc76d7626ff1445bb5208f3dd9cbdbb31b7f2bfe8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
759B

MD5
68946a49f1f8246c15c9d6960049adf6

SHA1
8293e03d6bb3da5273a8f6f900f11df568b014d4

SHA256
139b1e0047fe138557bf5080da67c17dc23b09e0e8eee2a8ad03f109c2fbfe94

SHA512
4ca895e13629858dc01949ae3d4c4b046e9869e02f6f38d19fd6c3e08c311ff50343ac53d446bde84b97b8f28e491df48f8685429a4b87e37aa977c37cc0a8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8addcf7f02128710b2f7c83bed632d00

SHA1
b77a3dc6c0094771e04c8d3d188a5dbd2c43f6f5

SHA256
8d3eed19a3494ecd5759b4afe786378eb991733679b14925dbba3913456a3c41

SHA512
0a7d205966da9a72d7b76f738980bc865490cb1d5a0ff112fd707194329c9ec788f1529edf87f4eaa0faf0c896040e1d68a11795248955e064ed63402c6c8d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e3e42270e129f2187e2fe02995e2fc1

SHA1
b9f8451cd7c47c19474ce8a2ba62264ab6b16a3a

SHA256
98cf30a6c68879b0c652cae4addd272ed77c61120ad60cbc918ffdae253daa90

SHA512
24fc29efadd8791e196705f1e6aa6cf0f8c62210c191b21863c131a5cdbeeb59a3248a1180cdea54d88dd64dca962729b92effbbd5e8f5d438d1726a3d8051b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55778df6d71583027973513242a4a982

SHA1
95f54d7782be55b941e586b30efb7452bb2c6beb

SHA256
39ae72dda9597c88d663825807f5389bc58bc90c47a6cf2a30829a49a5d9ac18

SHA512
534a0e762568291c0deb685604fa2a07a953aa3626b18eb6a7f9d21b4927892348a05b998260d8e1df3103cf12db2154341979079acbbe8e7f17c7eb7c71e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81f2b4a9566d95123b37118f75bc5adf

SHA1
bda0abcc239a63b68f4ed564e11b9113773d0bca

SHA256
ea16b4e37189f33889a5a723cebe49249ba404fb71293425889628e56135c5c7

SHA512
dfaf1d0c042e27e3c60c5e826aff44c96d48131e9906b7ba2f53d28221e549306eaadfabf1bbaf96cf0e7a41a576d87449450d37ac19604de03470ab79920037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3831e96cf923d829b93bbb73f6e0d1ea

SHA1
8f6333d29f26ef5a464b3fd538cb5d78a5f1b06e

SHA256
f2c5071b3bfda770c6fa6032ec532e13bfde250a3a24d77282e9e09fe0f13b53

SHA512
35547a86375a719a3878b4a4762692171a6bb530b1f9a62a65ba9b30528c37eeeb6f23ff1ede1ad8f0498eb0b2bf84b17aff09a67dbf61d499674f79ca906dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583c39.TMP

Filesize
876B

MD5
38ecd0fa717126a5b8e91c1707746343

SHA1
28e91bb501c48ad52c202b61ecd01bcefba12994

SHA256
53e6b200699aa69ed906cbb662893ffc698f43dd6c2ada41e767982ff7ee0966

SHA512
dfc91156018c4d9975f5b8b95ac9557bc35a30e831922fd842117e433cd094a84496de59029ebfbb6884d546960248496c2612df00696f8f755381c9774bb3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fa76414906a63df1dd544492416d2fa

SHA1
c44fb818bed69be81a5742b5b9b308c63e6c96a5

SHA256
36a67bc216733ef60386c86c1aadae96395bd18ac65ac8b7d241976ef88ff207

SHA512
666a86089a6e97b5fe78acc7fe4669878b8aae1e60aba6402ee038ee97f850ce5739ee3a011d2e6489a1dc5675837f8fa4c17989a76a43dfe48c71ef420d5e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ecd013adedc2dbf1d31d438ab0eb653e

SHA1
55a4f33a8b232145f745b48012d5e346e700f381

SHA256
21d30ad2ecdd8c71796c6e228a020b3d5cde13e049184600bec73be42089ed25

SHA512
e26eb72174789dc921f9fffd52eb5ed1d25edc5f18f435d15013fedc3964335c4d03720568be8d047e2fb6d0f194707e4089a11ce0fc766c0c7d3e13cc94e301

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit