hxxps://is[.]gd/3xxpGp

Analysis

max time kernel
107s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/3xxpGp

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
1356	msedge.exe
1356	msedge.exe
1768	identity_helper.exe
1768	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 4912	1356	msedge.exe	83
PID 1356 wrote to memory of 4912	1356	msedge.exe	83
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 1892	1356	msedge.exe	84
PID 1356 wrote to memory of 2252	1356	msedge.exe	85
PID 1356 wrote to memory of 2252	1356	msedge.exe	85
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86
PID 1356 wrote to memory of 3768	1356	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/3xxpGp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb517b46f8,0x7ffb517b4708,0x7ffb517b4718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1188 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,16174236201705775339,17139887448412418152,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
120KB

MD5
6168553bef8c73ba623d6fe16b25e3e9

SHA1
4a31273b6f37f1f39b855edd0b764ec1b7b051e0

SHA256
d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66

SHA512
0246cee85a88068ca348694d38e63d46c753b03afadf8be76eca18d21e3de77b495215ed2384d62658a391104f9e00df8605edb77339366df332c75691928efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
119KB

MD5
d45f521dba72b19a4096691a165b1990

SHA1
2a08728fbb9229acccbf907efdf4091f9b9a232f

SHA256
6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc

SHA512
9262847972a50f0cf8fc4225c6e9a72dbf2c55ccbcc2a098b7f1a5bd9ea87502f3c495a0431373a3c20961439d2dae4af1b1da5b9fade670d7fcaed486831d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
53098456eff3897dce84b92b82e27934

SHA1
fc7b4c814e5c99414f6b3a9aa5e17dbe8a487f51

SHA256
c65374f9b35dd64615341f4d4f13ba05c7abc89c28d948ecac2fec07cd269295

SHA512
40889c7971c1b9a36c92dad10d85cf1f4c880f6026b3d1ce83ace2044b00808960e8940daee4674047b4c23ec08ddea152f41d268b8b1ef3985ebf96ff54548b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
893fb347c390d024d22171281d55c127

SHA1
621f2e26f154b0cb7bb262f6189f532ddceaa095

SHA256
959e15b8b26d8542ecfc8a3e697f5d5b88225cbea96a010fd85a6dc4eebe45aa

SHA512
663e659c7934152f3f2d5ff3655664a5afb21ad9209f85849878c47a669bdecbd16e4a994d624312201f78c1a4a610df4d3560226a3b194b6fe8211aad63aa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
647bc018b9c15b2718adcabe04e9a41d

SHA1
4f92cbddc3c9aa80101716b0753219b80e050860

SHA256
40ba642a09415e403c3addf3ba8eea092c003f4b0266fe49490268050947a783

SHA512
5a311a33b50436d76a41a347110372455ac13225bed0980f3122b3ea84c32ac171bf2ecff00805083e893524776612684157264c8daff21a6dfc4cc23fc2c2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d2deaabd99f8fcdb8c0a4c9b9239d54a

SHA1
7854f6c7532aa88b3d5a2acf32829f81e3f16fb8

SHA256
acf6fcf2183ab852f65791707a5e8429f070dd40ee9d5d0097ceb895a8c78769

SHA512
70bf8ca4e5cf43f02af9abdc2a5b3a26ca48c6faddfc7881ae0c1a7efffa98ef982871cfd051a7a50d5da4ba0c26f439376f109583a5b72bc0b99f9c4d5f9762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05bd92b4fc8a755dad8ece3e9a3d98a6

SHA1
4e21be4a3a39683b78983b77cdfb94ef116267a1

SHA256
18264d9125144a1a53ec73841f03abc146737c3a0ece4feade92e698007ef03a

SHA512
886c7213b8d51e8738097ed0fc9fd2c9e74ce7dcf6f88c6f82c151417141629a7f3e02edde5714cf21b38c16a972335812bf652d43aaffd9507586dd26064423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
367fe4047ef17f46e825667b47827952

SHA1
7b00432d0ac3f503cc9bcefffaff6ac9a5400936

SHA256
b0854782735338469a9313fa634c77e225af65a56e29347f48d7069dc6c78d61

SHA512
466cec1b90627a32471fae2b6b638ca2b6bb4b9f7761acddbdd23f420d4a2c6f77746bfd5d68fb94440e25e097b9fa1ac8887bd4988f6d3af71f6e82f083ff66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dfe561543e3a1e9936d330c4e388f845

SHA1
576ab3df6d9cc368d64e4d5b441e09dd8d80bc68

SHA256
f89bccbd4af7494ff50cd1dea1feb0fb5b7f3c94aecc8a8ed0463a6116446984

SHA512
9da1802530470168419e404b8e520f77a2738014c9b77818414222f298e9cde86b2facd533855557e389c917b93b9e3f0665bdad99675d4ad6a7215996a11ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c16cc5c81eb3a17a803c8a8727711b52

SHA1
b778130ab764c497d2da6db6f3b6b80b721353b7

SHA256
fd8439a95beff456f24cde8ac1c891cb05399de6f25fa8f94e4fc6b413d43890

SHA512
a3dac2c5932812455e0a34d400d48db3e91238412762aae70bd7336f37e981a0a0c729c86c99fc13953f1a8c715c488ee76b054d96f04be56e28e7c69f1ad8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a6effd5e39d52de0a584e5cd23fa945

SHA1
8124460efd0be7380ed73921a29b4cff0155381d

SHA256
c657bf67c95e8eb62b672d7ef91d239cc1237e859f46d13ad007900ecb222b44

SHA512
d80c55a93d91933b326467766f3dca8e98871746a0883c4c3a97cd2e6f9e49096a879eb3616cde8b05a9a1539c8f62d61d305144b03889c0a24e7df0e5fa6b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6429a06c89ae1889ccd07b825e0b30c1

SHA1
35e692b2d2019dc094a8874c6c2824416bf5de1e

SHA256
24c4e48e50946a716847c03d436d758acb0cc2ad81cd754b6f61b067aaf9a90a

SHA512
77c1a1a382b7bdf04913998293dd2763517bd48ef03a8b15c4667fca24a1c4d7a62e6d0a0decacd4bce93d5bd81b9815fd7d19c1a482540741cf19534624b379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
221354526ac10c502ab7522a73e2fc82

SHA1
c3564183fb5422a8e2ded0cd1c991a1e72fb979c

SHA256
a6f9a28ce51aa3f14653a459d93f9b9fbcdfc669f7f0eda8546848f81deed263

SHA512
abe8b874b27c31c9b67cb642150ec0018690ced5c336162bfceb93fa396087db6e7e2769fd8014c14660d32201254acd01d47dc314150940cf9750a947f31dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a8bcabc7fe1952106c0139475dccfaa

SHA1
c9d30b89ef913f502a202670be9e4db20f42de11

SHA256
645a2dcbfb71c65ca092b129e963267586122c3bd8442c8e072abb0fc544edb4

SHA512
5e34c4bac747a6add2ac0cfe1a30513b47b89471ed1bc57e29e7ed046026147965dd90b541d231b3e5857dad89db37cfc2528925ae4192b6caf2bf7e212a6142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
765185fa55e83c54bebda0e4e83369d2

SHA1
a6ad6d24fc71a67caad7bb5863b671c6f7a59e87

SHA256
0ca297dc5383360c687e35e65f5a4e1bdd189737c3c5ca6311fa2cabdb32a052

SHA512
c626526d0cc841e53b55901f57d7e0a0ed7b6b58f438edfdaf528ac0ff473f1555733a8d2f79b182a0964954e86a7085319c46c3d76745950e67d748201de817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e781.TMP

Filesize
1KB

MD5
54821a21e3cc918f15d166da882a6d53

SHA1
0d1589aa6014297885c92d3d52a4d03f7c7f03a5

SHA256
7341dc36a4ac26a0a44bc8586163575f1ac624d3ac68bab5558ce8571fa3d28c

SHA512
9981165b7ef0a917907edde006d10976e10a074946ac9fb9618abc10a752d156d1925b5dd3ef315138d8b594dd69383c970a0580767b28bb5c756382fa50a078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e238aba7cf2d13f2bc6b6a0f0872a9b

SHA1
3a8f9d394af355934647964270fd83d4873f1732

SHA256
2e70a899a920e2ed6f34e924155bf08913955cfaf316b4238103537cb040dcba

SHA512
c9845af949a2642f67c2292e19fff8d37998303c1e3f961bf22b3609a78f9d7ca41377c032ae595cd76e3fa4c2b7e729715b47d94e5994ffcb0c33556bd0bfcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1d79db165da1138831e86fe849cff7e

SHA1
292d3cc4d57bfd9f6dc3d5f6704c2cf491d4256f

SHA256
c202c6b68134ca86358e02a0e9a1f3ca0293ff178d0a1899b911875a4bdcfac9

SHA512
8988154cb74e17a4abdf76a277ab73dcd282a2a3d0613e4ee0873d7347fedc9fd56e45370a034a077104874e77139d59acd614617ab3bbc5dd07c7c358bd6e95

Download Submit