hxxps://styeamconmunity[.]com/refitr/bopit/truki

Analysis

max time kernel
107s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://styeamconmunity.com/refitr/bopit/truki

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
4976	msedge.exe
4976	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4832	4976	msedge.exe	83
PID 4976 wrote to memory of 4832	4976	msedge.exe	83
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 4676	4976	msedge.exe	84
PID 4976 wrote to memory of 3096	4976	msedge.exe	85
PID 4976 wrote to memory of 3096	4976	msedge.exe	85
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86
PID 4976 wrote to memory of 3820	4976	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://styeamconmunity.com/refitr/bopit/truki
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff054246f8,0x7fff05424708,0x7fff05424718
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1204 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,14560890662968498335,9879333141712362420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
503c231fdb6402ae5f5da076ff9e4ad5

SHA1
faac1e71997649fa886483b52385049ec0c73148

SHA256
06db035c2d433201426f219f7460ad71be58d7c515e1a7a48a91eda3216f0739

SHA512
f00c30b9107ab9930d4ac93cf57d9c6cdb3ded7a430fd6fb116bba57df507205aff538ccba355b2ff628c8066b9f0839d3da9f59cf0846d01b7e1c0826049f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
120B

MD5
639e9b53c93b48f66c1457e753423e10

SHA1
df073cf35d67bf1381c6cf1ac823d680d7a7ea7e

SHA256
f9b9fcac1c9e086798598e5985f14e4a696568c811e58ada6a442bfe7094b16c

SHA512
444bac7836959d3390b48c9fbf78236cef02ae24a4f14324aafb65a9f23a72bb1b6e57e15aed6c543dcf162da3c29edb91d4dbb5eca55187f0b8dbfd26775f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
105b37d75e508d51048227677b7d58e0

SHA1
cd153e120428be0bfbcf71d010ca7c59272a184b

SHA256
112a12f43e7e2bc053069fa074c09eda6710904f2e2f7703b8eb2d833b415cad

SHA512
c76df5b7165e8561b3f72b5624ff66ebcf172af7693b6ab998b0d9fa1ac5fba627c5995d2313443089c3cd3c096e887fe7f575f7758caca3af7ba6658cb798c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83e34fffcc28265453a00762bc5ddc19

SHA1
ee211ad1172c015aacfa15be7ff818ccb31e3b90

SHA256
9722409b494d57573cc3cb2393b1dfbd1b63ceb6fdbc60a636babebad54cdfd4

SHA512
72d3eab4a32556f919d14211e844f9843099c10770aa9954380bfd5d61aa69e975433d1813674cddc65566691e843f0386db42cb41d8d2a2a1f98c07fe4cb30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c3d8f096493f04d9424e4ced279dd98

SHA1
c01e33dea27d21bc06fa71f67c11477b250b3687

SHA256
61306908fc02313496edab66091565471d6a9e0d46821538ef5ba222329eb6d9

SHA512
0ee8d5794a6ae98c7af0f66431604152ea005d6c4e1843e277c7ccbe1f7c8ee02cc029fd9ee62a05a8c0bb0de99930a05e1e33719c2e22cfd0695d7a63c8925b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7a82dbf1e3a7977a9cab3d76a2268f12

SHA1
905ca9da4165f344bb6bb84d3d8f84f9fe56851f

SHA256
7620763176da2c5d233cb7e6102284cf1a8681f74c371b842016f7228e377d05

SHA512
6c9f58576b1a9774e62add0c742cd619748ffbdb862a22f35e3b8f8c4b06f1aa6511e579095c7b0fc0d2de7bcbc0a111a254e8f8b572f4f3aead238ba4939419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f77622fde638602fbfe5391bf903f769

SHA1
69e01884592e2ed881e68c4849bb1edf161a464a

SHA256
9144ec7827326b7fc9944d2d5478ecbc6b31150b1e06a6dd490139f10a8cfd85

SHA512
ec2651db196bd086436c7eca3ba883a3edb06209b7d836881c55fec0bbea0fe94d41af43ef8decc6813d7bff3b094040f1da1463e5f90e31326900608d17e337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88ecc0e67892b4afdbd53009ba288df5

SHA1
60ebbd746ae95e74f59e49ca3fe38e4007fb08f8

SHA256
6c6e10add613773139cb9074f57667960478d509375ca59e87272644c0a6cc83

SHA512
f1a497514a57188e79ba92a5c131a34035504ce7dc3e0de7f4311690e71a22d25e9bfd30a329c2a72c541a2367c3d1686c860ec8398e0b38f38ce9aa45cbf34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3868c291e373add8c54be6ac973e7562

SHA1
6fb9d7c9a869157b0afd59dec3917dbe2b608d80

SHA256
d7a07dab313727cb918c415a87704eb7d11a433ed7b5e6d2d978ca22fe246060

SHA512
72cef66f4f3df5c108087bab9e77cd65e8467aec338a6a268a7bd6368d440854a39cf0da0ebea9a8a838626a39058b3a4ae50ebf18ab59327f88f9d9c489e0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d74bfafc5de1a714b0c7c492c7194ab

SHA1
5618547a9b42e2b1c94c98609a581d4dcc935860

SHA256
92f28a68196c5b6f87f80f1e4a6319d598c3c78a3594e3df323df0a4cbbb55af

SHA512
34802e6ef3c80d76f14c2b3a02ab69999ffdd418c6e034ba20a70908e05254bc1b2e07a6a5238652d3fd8fe1864d3da4397508627e311d2c41c59d5c053b1f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7198358f4a181264139098e35a9e0e3d

SHA1
769576db354a8cbe3822ec0def53aa9d1653ef9b

SHA256
8e522d079a24faf34878f807a8893e59a90a65f82d44c6509b9f5a70917746aa

SHA512
9a7146e2e7cc730588809c24ca7ace72c5e02d0ea09d0a4b6ba566f6a5469577344abb286eeba8658578ddec1dee78778d17686731f084471e4464aa686f2b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb1923e97769ea5187052a45a0604b38

SHA1
73a692d2349f1c2ef4ab7e5f97b846a479ede2d8

SHA256
93665bd1ef3a0af2b4751465ada784f0fa461de85aace780b348d5970591be42

SHA512
d504f4cf5c8832924c563f6ac749daf6c87687d0156404e6f84464370c363953f307a87c4f899eaaebc3fa42491d27a48bfff73885e795679a2aaec6de9e000c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580887.TMP

Filesize
1KB

MD5
be8144bfba36d7d6a6b2fe04c06c6796

SHA1
82105805437b74171ced3b4332755533900080d4

SHA256
47513432d0844b443652c4a1f930592d115e91de81ab5d940622f55531d4ed1b

SHA512
975d19c301051512d0ee3ef88c5f5fcb3e12b80e1d1a6265119d1d81c0a27006069a85440129e5185f11c208766f0693c1dfdaa870ebbf8666a91cfeb6b64274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
531b399c3391a4a9b0bc2e06025d071a

SHA1
c6a9590319d961d4383480601e8b5c98d2e4952f

SHA256
6bbb327562e7c04fd70c44478cb6dc6096d111f7b7bb04889105f364f71139a0

SHA512
7a17ea28af8f27428432d2bba7dd3cd63f1524b85d1e219a2eacdc3694ffffa16ea015f0bb2b96bc7a82cb4cb151ef3ee482f1c29467fb919fcf37dcc8b13da4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
edc97506687317432ccf3fd391252356

SHA1
34a81d17b6c202eebadee7388d4a0cc464065b74

SHA256
59f4babc88fadce20affb0fbc76c6882a5ef667e84be6756c5c57f37ebb9f6be

SHA512
32c9afe6b8c60946960414f64c09abec20da22c260a04e0915c2e2a26bcbdbebcc295d9396eb83b5db773eb842590dcf2489c3f0b9f2666e050c3bd4483a03cf

Download Submit