78db21303bd00ce0612a8167851ac973c1dde62d72ea111e80fa865cdfb5e910

Analysis

max time kernel
93s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-01-2025 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

43KB
MD5

d019fe695c7906138cdfbe06da302906
SHA1

a3e0acc6da3116e53fe14e3ecd45d6ea64aef23b
SHA256

78db21303bd00ce0612a8167851ac973c1dde62d72ea111e80fa865cdfb5e910
SHA512

65a211dda1b33240badd351c790fb6688b7857939633a63fad01dd14c5790d3741458325b097edd1fd6cab1e559e6dd325337ac30d6ca5a5ccf8f0c3ae765140
SSDEEP

768:2IBpqhYGMpevT3x8gAts0B7B9TFXWt7aXfsW9l+X9hJYFnzOMD5QBdxaXfsW9l+p:jB8hYGMpevT3x8gAts0B7B9RC7aXfsWC

Score

8^/10

steam discovery phishing

Malware Config

Signatures

Downloads MZ/PE file
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 376181.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
868	msedge.exe
868	msedge.exe
1568	msedge.exe
1568	msedge.exe
2736	identity_helper.exe
2736	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2476	868	msedge.exe	79
PID 868 wrote to memory of 2476	868	msedge.exe	79
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 1452	868	msedge.exe	80
PID 868 wrote to memory of 3656	868	msedge.exe	81
PID 868 wrote to memory of 3656	868	msedge.exe	81
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82
PID 868 wrote to memory of 1384	868	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffea0433cb8,0x7ffea0433cc8,0x7ffea0433cd8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15633757249151406940,7722220956058968019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\465f74ab-b3b3-4578-bacc-c99be276f43b.tmp

Filesize
539B

MD5
7b992a7528b10299697b37fbe1596caa

SHA1
252b6dece8245d74bdcec44ce5e95a29ed17c9a9

SHA256
0d692301ea9c966db72feeb12478af91f8099912de739514a471c22bbc965711

SHA512
0437f5ac20a9bbe65243ea14b530a0467ffb8b4cfce337bec48cb6c09404a7004fb412bdce8a0dcb244080a0beeb93a1f8d316ba7ae288f13aa349beeb32ea4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
b2a797032de693646e08666dfc672b52

SHA1
f60b71d51c4470367c64a35fc0bcb35f55981367

SHA256
6555f6ab80e01ed4db9241a63a99295adb05da90f21f5dca1229b3a6fa5d3d46

SHA512
03ef4a2dd4edbc89e1575d721f03ad54fe29f97d20c17882f06d7c4ceeb4c93e0ef3a817bdd03d4b707db2899906a8eb1bfb62acd92c7fa40798b872df4d0675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
981423f2f88539138ed3d319587e8651

SHA1
7c51017ec7b3efae47bde0fdd16936834a54c2c6

SHA256
58fa31605cff97a4743de5f3c38d1923ccf42b746be863bbe7cdfd060ca5bfb6

SHA512
b4f046b57e86f1520c168c294bbfc19576cd544d9644979a0f3814c02f75310ee034d7198e66faa45ef33a19b16e4800b619594dda59f2da36e02df85fd5e7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13333be51d487e1744bf990bfac7dec8

SHA1
a38db778f9bd963debff30403d815a699d5c743e

SHA256
d0a1fe658146617021da44480c5bd6cf2787655ff400cfd72bd951aa7f8c47b0

SHA512
e972000d01c54bf25d47d408d0b4d7149ea7a2cac8ab77f316f7d8298bbbe45bf6ea175cad9c37fb86d1d0790351e61ed5308ae1605adeecedb745f86161cfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6c0bc12034b689d5e287f347e6b0e79

SHA1
a374ba77931134a0b29dd8a48978fe80f04b7dd0

SHA256
fb14dc6f153f00149174a7bdb7a7e5998dba04e296659ba7bc0d4a3923ac957c

SHA512
c4e8d75ef32804eaf40c33b1c97f81cf8574352013f237a8f38c0de6e8bbd7a4c448fc914128e6446c912b9e4169320e17cebd2703f06630c5c2a25fa494fd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52502b534a31ef5c9dc5c55215b4c6b4

SHA1
89653b66c9f54152717af7d2a8c11db7c63d0fb0

SHA256
41ec9052ab6e221f11135788e7c21d1e43549a7538b39b50e328c180b33223ac

SHA512
f851b6d1785428decd6ce82842d27ef6a5b08f3f81d791cbd4af5957f7c3d8ae8eb28ee71569694ced00ea65a1407404305f79e3abfc8fdc90ffff302d4beeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ed161f2136c43a1f83f4a5356b1effc

SHA1
cbc919eed342e2dbe2cf37b40a4649c20d77d426

SHA256
1e7d7ca050255dcbcfd95f5f82a6fd1b47b8faae3c27bb80bcf98bf60a104e2c

SHA512
0231aeeed0c46ede4b230656538a245d1285e5c7f064686b40ec1e42b79ee6cfd553ad368b366c93370b12561046b8025d43d4ad6d27a75ec0690a2c4b66c9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db4c.TMP

Filesize
372B

MD5
3e14e31a9e0169a2942e9d786543e789

SHA1
b49ae8134c3edf4a5aeac9530e6a20a89d46e456

SHA256
45566a2ba26892c8014b600e8efdefd4c9e700119c2de9a472d421b21bdc93f9

SHA512
92b171558aa01d7d5c271d57902249fd09efe011de194af7c7dcdbfc1f8889e4fb7b96a9790f20c7355c8387b5b5fe1ff0253fe5abedfd0fe486cc9bbcccfada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fef5007ef8f3fbae4ab673fb6a50a440

SHA1
be514d09434385e044368ee667d29f88bd5de08a

SHA256
0879487bcd81b5fb380e57869685e8a6bf431211eac5f9ebed8c285d62bb00d6

SHA512
f11444a84c0f3126019b2579ad3699cc11616a2c31367e47afd3378f331c34b31107e6b5dc1cccde5e2c2ad084aa57fd6dbc438de8c55b9284e17db1f1821e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29cbfe79e0497a69b8cdd69177d46e77

SHA1
10a1148ba1bc1f8a1ca28e87e1ef28bc236aa210

SHA256
04599db67ec6918b089711964a093330e06d69d20f76ae80c2c2f80f9fca4f19

SHA512
413ced46cbecab101305f9901b37442f0c66346d6d8c8ac2fbbb3e77bf8822d0d5959ca3adc78d418aea2f1c193703a954d0cacbe476dc7d2a8fd871d759dc92

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 376181.crdownload

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit