hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3120706017&searchtext=

Analysis

max time kernel
600s
max time network
689s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-01-2025 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommunity.com/sharedfiles/filedetails/?id=3120706017&searchtext=

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
3252	msedge.exe
3252	msedge.exe
2988	msedge.exe
2988	msedge.exe
1460	identity_helper.exe
1460	identity_helper.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2656	3252	msedge.exe	77
PID 3252 wrote to memory of 2656	3252	msedge.exe	77
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 3716	3252	msedge.exe	78
PID 3252 wrote to memory of 2676	3252	msedge.exe	79
PID 3252 wrote to memory of 2676	3252	msedge.exe	79
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80
PID 3252 wrote to memory of 3360	3252	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamcommunity.com/sharedfiles/filedetails/?id=3120706017&searchtext=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98123cb8,0x7ffe98123cc8,0x7ffe98123cd8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4857247956102168230,4442966953848338770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
99KB

MD5
ef62240926f5cbe91a8ea8e36717bafa

SHA1
b6e52ae2aaef47217c045d4b6b88ee254410b359

SHA256
5e2793dca8c0205dfc6cb59f60568b778520bbddaa450bcbf3d69f03b07b19e1

SHA512
51cbff75d05326ba6816a5de43c3db4f6dd5e236d89d683afd503798a7a8903cbd4098d5bd6f3b57c0b3418c00f4c3f9a47951e119d6d98a14309328444afc60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
317KB

MD5
6c1e5a50c5c0cb9ec818f707f74d9c2d

SHA1
d46568368419f1d2dcdb33a27be86c231576d60a

SHA256
b88cdfd74245365c3c5c8676511a62cd83872e14428cb0a5321d1bf05598b4a7

SHA512
5d379a78711b91490082d3c206eb0441d84d3d71b921fc17d23c3efae81a10d281be4e98242c958d0fd3f915e421a7008c3767348ad61d0a963b289d30af4600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
32KB

MD5
e7eb40a17f017e7b0651dec263c01ffc

SHA1
26fea5c5c688b2ecf33bb6892c9905159b6d48d9

SHA256
afb8e284cacb33c4d52af3a501a871cf560e4ec94358761743c02f3a21cb1810

SHA512
d7af8ff7adb71dd5ed1620efd913673e108846e02a7775d012825357fa81ab28dde7bce06592256e9f9c2e91ede6a249a7e6bce91a392f6f7ac0b53ac3ca0123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ec9c3af6d60ed5e9_0

Filesize
311B

MD5
d9bc9e852b18b32dd44463d52c4640a7

SHA1
cec3cc852061bd999f78f213610a7335153316b6

SHA256
bd7dbba5547bf0f4b3c69ef8bf3de6e15b57aabdcd8d9c3eec65f34fdae3c346

SHA512
006c0343e1af5840ed2dbf9e40a7aadcbe4a16f9889a4550423f5a301a6e8058229f11ec075f4acea94f32d9059d3f8dc5e5cbb364194f41f192e62d051eed7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f3a4307182b637b1_0

Filesize
689KB

MD5
1fcc8b570063c3ed4490d2e203a0f991

SHA1
07aea815cb1651713a39eba89d115027d4f6d75e

SHA256
346616bb375bb6f5e12ea801818347091013a0868396d3d6bd421b008d1365e0

SHA512
01190d45f3cba43d479efc9b4eed05f3f92463bd2ddb721da447c0d8b6b2b1283229f98e4ad721913d5e5458344bb81acf8f521b09f8e4f4ca4ce9e60dae7611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d9019e2fa0049a919e918c3952a8b7b8

SHA1
69876b554e684ecffc76ef6df5873de6a3cedb20

SHA256
26cb80ef4f6d3ad8eded2bc0141480d9634697431a183e56a18420a32d76eecb

SHA512
374e26603c55684ec54589133a4ad922106990b4eb11049b7335118b2f1ac1b8a8dabeb782f67130129fec3fd48e6ba1162a30fdbdf29d1352484e846e30f2cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
05521a85cfb395044095c7030e6220f8

SHA1
19508845c1175f87fea905de7fb5b802eea3fbe5

SHA256
2096c20ff5bd61874ea81a350dfc3a2ca3424b5412a9cf71e7c8488d03a23934

SHA512
1b183ac1d02ab0e93772d567873b43d1990a01143dad190b0d8cf6c5b09f200019b91eeb6b2aedb93ab13fda0f369b769cdbb6f6d6afa6f2b1d80c105e093c6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f12f1ea21bc4ba51f89efef66f4eb451

SHA1
4615dcf375c1f980bfcefe7b6fd2dfec6afb088c

SHA256
4294247572b303910e65606583c81e6d1790a527c55ae27b350cc0ce09620ffc

SHA512
735e9458506ad7ca3b52ac021bbc57f730c7ae4f46e7b137369dc99a08126ccd7434fb7b6030bee37729832e624419dd80e6e04d1dc0cdbb214f7bd44f067081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
618bdc18ded03c9ba4b98ddc20540bd8

SHA1
e10f3f9e397e82fa3f9c99c747d367359194dd47

SHA256
0c09daa88e810da586e85c3281af080da5d1d6a4e2d6660d52d576f446eae607

SHA512
c746678cd1297094f76e526c029e9478149f3febfcfad1094c6200610541d4de49ca753c58d8421d9b730dcc3842f1e30e2efc58c79663332ca79a52216dac24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
977B

MD5
ebb608ceb821b7f4abca7b854ba0c39a

SHA1
bf9b268a794f4c3944565a49076b156652161619

SHA256
f0ea52cf703ac491b67de8a0acfddde8a13cc78f6901073d88af09b5d9dd8b80

SHA512
e2abf9c259d031deef497d1897952e07a08eefcf9d0112c7eef84d2f3a9445fdc5181ba570ac8a480b0bd7488ff058709030b985a4208babf88fab6b8400642e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b3b4c939d30705937467a1f3bf234d2

SHA1
f45409c87dbe932837cef26088221835890afe7b

SHA256
746fd3e8bf0535b2badc6b408f08a6acb565d84ae5e51d7f97e94345b98b0463

SHA512
5c2a9c81554fa096c2a059f46e3b5ce1baa0c879085bc8b18b9c318dac04df1d88d29ad618af8b76b4e8d9583e26046cf7c18402443efdf3bdfac3afe4a3c4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ee8b0f526f40bf5236ed360bb9a82bb

SHA1
e7956b269eeca8365ff3ad75fe9526c20e7b7acd

SHA256
706d745ae4ea1d21fff694d93d1dee7ba2bc5d9665d37d553ce04e9a3470c956

SHA512
786b2d557cbb0e2183610d36ea8f431db4b355a0ead705d22ed66d26c45f0148b16dd4641d250778e36f19ac86424679141788477cf7c6efba446048d2ba7714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a40f319eb11fff9e8dbfeef2b90cdae9

SHA1
3134b3d55178b539cfa4187040ef104b8786fbe5

SHA256
33c8c5e00039e311325d904f9ced504afd987858be8f1ee930c0498fe87aa0be

SHA512
53c5b231548b1ad27e090fcd3a4d9ca238c3c8d714d9929028592c268131d53003df28931d6051a4319f5db160c984c37447e19d947f6751d2acdd820af49aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0ec4a68f7f642a0ccb69178358160f7

SHA1
cf8a5104b955d1431449a59fd1eb717533268275

SHA256
fb0a4996a578e60856f7a7709452b89aaf7f0d3efd1ae8ce8fe9353c737cf6c3

SHA512
009a55a010bb022a3db2ab0c394e432f59dc71bb2d3388819d23bf43beca392460827e756d6cd3df2450dc705cb9943f93dbc47335c440374b626f9c085d7be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74ec5d26107c12f482c8e6b5dc624470

SHA1
5b2db67e333be900932c694b16c710c6bbb90a2c

SHA256
fc03d2aa15941e5090aa8fca3f78db615334259ffed142e1be1a1f01423413cd

SHA512
b6a4a878be977f46052f9fba69ad738339b553df3f02ab7c6310c3b9b484fe61bff5e869b65ba3f5ade530a33bdba987d2b41af7fc87aa0ccf8a731fe04870c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4675f41b828efb1a0d0f471db282be7c

SHA1
2670a669bf65ac354abbde6d1a2bb03aa129ff9b

SHA256
518b1dc419ff31d084fe3340abf2596709c3dc31a3aca1d5410be0068c8b4629

SHA512
b485c3a7f31002e1724db9c9cf18e18a5b8533b62bd62a14e0b0ce5b45eafe78cdcc392c1ea41452284c6f03108ba3ce934b6c02f582e5b6d35ddeea294be66a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d2e79aac60fc113c09ed10759e09ad5

SHA1
1c024da1e50aa4cc8a099b2ee207838a0bd0779c

SHA256
8ffb17f0f995c48f82d8eabb1d1552a8e3e5282e3d646d8918317a4c02ddde34

SHA512
8201cd8c2478707bcf2a044804688e69254a83c17d82038f4049f2498cd0196ba13da9127742663fd54215df1c878edab48114fdcb9f7d205683a4a64e82811c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24e4c6f8322d2d822d9bc66687883ce6

SHA1
d984093f49ae3c54f3ded4b4d388ee390dec4670

SHA256
04f96e0a117aa76f637a16afd7708889d47802accbef40b3c6e118bc30f0ec3e

SHA512
ffb3fd44da97d9bdab3467831edd293852ebc76f4e192bf1681082be157e0f07964dcebe23b890cd3c90838a5472fd320db3ad9f0def3159d1fe9e691cec13e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
458d1e5ca901861b5c6b67ec5c2bcb34

SHA1
3e937c4aae5e95be7b101c6d9f8242049fa166db

SHA256
42a59be8ee43cfebd4f65a6d1cb55508aeb22e32e0582f9dfbfe0d736ca4d15c

SHA512
0af77c5b94fab3840f4a547859fea09d68d5af4349ffdc4441ec06be896cdca032911f03bbc2f1bf3bccb2eb48f4006bab2efb4cbaf824ea99107ec0948d7d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2ef70092fabfb8374e78e452fbfd3333

SHA1
bfa028e4d23b1aa4d500ce611eef0f8c1cb3fdad

SHA256
1de40afdc4f4465bfd4e12a6b98396730c510d0789d45453165ab777fb83e2d5

SHA512
61e15e393527a976813a32b3caeb2bc6491d30e7aa4a5056921aecdd5355787ce13130a64008bbb0277216e454e83de519fa2e05abf4146e7b7132a9d9e83c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2efcaa1b26a400d8a0c97ce109f275a7

SHA1
52af022d2c61d6fa6c307017bc85c87883ece637

SHA256
d13e04c80060b7091077c8c551cc2df79e3cd3537a7917ef2154265cdcf34553

SHA512
7e818db676e9e0532c1de60f49b42934cea29470ebf9c746c70f63a639ba43908b16fd6ec3eaf1bc8b58b363699119d22c4c797062328b3ff3b97ccdcdd57810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aee2e1107007d7779b037b46b456a555

SHA1
001bce4169095f29759d89ecedff93b0e3b6ce91

SHA256
ffbbda2cbe400899a1e8a3ecb0d9fb1ad50e2667daceb11073f713f1034253c4

SHA512
6381014afd939a58b5c1ad341c85238624fd5bf116afccb9dbbdf7a2fcbdc99465fcfd638de8fed7a650376c76358a90e1b2b7d81e71f9414ae8ef6861523b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586dd8.TMP

Filesize
1KB

MD5
63a82901ec2e2d668f477160a75ce349

SHA1
47e798ff3569f20be8173ecfd56dc48c910a7e45

SHA256
de3fb35bcf9e6494cb708fbd04fe6a4359d31644f7838fb6637a99f499fa0ee4

SHA512
d4734577c78bac8ee42f0cecee97a2d648b0e62689d8c0c3ea7e161782ae91d768c6179b33dbaac5e92e664da8284ce22a29ef14f0e37c6cac47cf8d19fd1617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a9df6857371e1852e4502e6d37f946c9

SHA1
523bc3ef2ce844705c31d9c10ef0722446be6836

SHA256
eb6e48bf510d53d35f3ce68f1e9f22104c742a0eadbf71341ef2ed3f002e372c

SHA512
8c4d8fbafeab9ccc3f0f62d5a651cd55a66e0b035e673e446b2bb735e6797a1026d08cc0e1c1ee97f7b3d1bc5e1797f34ce3d099b4dbcdaaa8f38bce348f5aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit