hxxp://steamcommunity[.]com/gift/activation/id=15611433055

Analysis

max time kernel
84s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity.com/gift/activation/id=15611433055

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
1164	msedge.exe
1164	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3044	1164	msedge.exe	83
PID 1164 wrote to memory of 3044	1164	msedge.exe	83
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 2800	1164	msedge.exe	84
PID 1164 wrote to memory of 3748	1164	msedge.exe	85
PID 1164 wrote to memory of 3748	1164	msedge.exe	85
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86
PID 1164 wrote to memory of 2896	1164	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcommunity.com/gift/activation/id=15611433055
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffded8446f8,0x7ffded844708,0x7ffded844718
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10101130095265170370,3159700522333547938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
9082197ecb3846f6d89cd0793586f138

SHA1
f31c61ff7c27a3424dda7dbe82027cdb24c42464

SHA256
c4355a082ac6b41b0844a342ed1cbcd6bb2a075b767a706fd7b8623e26112d80

SHA512
d17d9245c0e39f651af6b8fdd4cb966abf8734ac82339c9b7d22d8b52e031415bd49c2e4c907a64e01f5c58fbd171ccc48579355d6f531fd06f2e58d4d82d4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
007ff936895ec776086a384c51b1b8fc

SHA1
16f25fe97d0d4b5c62b4b60be63d9dd44e548329

SHA256
d8f8f33206071d5f37f4ff23e2485b77fa606db5b8f4deb26f37dd388cd14c15

SHA512
b9cbe7c2c0997a9746accbeaf39fa7c3a3c5f891fc430a5df37b9191dc92771b5af0307b5235ae0dbf655475953a7e17aee11559b23c3b1d1c70e726e9e760b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
535aaf3699fd11596dc6b25208670c50

SHA1
c336b81a1eb68590cc2c2d98ad0891997b455076

SHA256
96f1a80fe5f392870b24683af16c2624e79a7df990d8b1a9eff05999de5002eb

SHA512
f4822598d8a754c64e9febc89cac1fdacf0e916d7a65d6f8b82f0ce6fda4ca3b1325ad24ad102167800e932868bd36c879ce8c8334cedf3a6887f36e9ad9e885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
25153d63dbe48d3ee3ae8fb8a83efa47

SHA1
92ef8a00d65e2dd5f81d9ae4aa53ecbda9a1fcbd

SHA256
07a811bbd38fad40d847e4ba4525830446e7ad6daf3fd8a4b38a5d4611ae8e3b

SHA512
b37472988a266b9824dc71abac004567d5c75a22bb46aa79ae1733334e04be7f099f29b7de94765793ee2a13639a6874c0f8c4985b378a99ec0fb41462fe3769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
b1f9c36b214f5f1186aef4bf2f41ee28

SHA1
3629c225fd4561934949ba7d3aae71a2c62df6ce

SHA256
d254abf7a1f57fdbb8a1465bef9803fcc3fcdaf1dc19d9ac5a22017f004da42e

SHA512
e4808b53abc4965bf4c3d5caf0f48228f9a242deadae544370d449d1e7f0a50e74af27a401878754fdc824d163e1e953983c86c0589cd1363df56e8dd8e1716b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f29378f16db7b7c6d3704ecddf4eccbc

SHA1
6bfdace0e5c2bc772778a6776ad54904d5e877bc

SHA256
b08996d5eed56c77146d865660d39b73372cdf26120bf5dc9806690967d9366f

SHA512
b30135632a20948aca864f62a3946d679a8ef54eca07584d694a06289a835c33356161f6a1b52fa324cdd7416fc3b9eb574204bda9b84bf472cf4239b806500c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd759777fe934ba281c72f8e5c34b9e2

SHA1
d3f249f0fe1c4d54810e258c73f36ce06da200e1

SHA256
19d65513a97c79c2c25efeb43f6dd3d183d7e9f8630ec9af1f8e6be368848c60

SHA512
c3cd132733a14f784a834bc7e9bc6e6c1a7bc7474c628c2af7848fb25128d5f6f03543191f42575678b4f76fb8c5a8ab30e71464c77ba9afd8eaca869a9ec8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89642acecb173333a70cfd6dbd1191e2

SHA1
4ff948615a59f2e60e42496b0efa348089b907b6

SHA256
683c3ca1a15158960775e4835015fe3c2dfc5808570359c7713c3010b98d77f5

SHA512
d044cdeaa8dbceb27ac3fd040dae85b3ee01240314df7946ed2a1229504143d51ad4eedbe0974f7675693caa0aefb4e6363b981abb5d19eb3375da0c949d8858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17ef2aada295c9d9502f4590862b2698

SHA1
a0aafdce3d9aa47236495bb1a0e44b2636a211fb

SHA256
5079074d7e4e4c9d8d62f5d63a06f9ba1f4b9db259b5a505226dcade5eb9244e

SHA512
8f2a533e229c023ca1ba11814ab2327f288b218430f72960fd3e4af0a9b6b76e0bf41f6dbf720144de3720345816a3a3530e33ab91a8c9c1fddb200b08e16183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0967aff1b65f6e5b4421d40ad47258f

SHA1
5018d1d638eaac347cbc2fa17b6a66cb8ee2b3b0

SHA256
c7a78cdb30c30e71334681ef90296e78c425e09af5e8f46aaa27ec1e152b3f66

SHA512
9571ed8424730756ececcf4a32608433791a34e35ae453681d2da6fd009a8d7f3f1657a12e787e3e92c6acdb2d7cd64ee6f3ea7e3c460df87f71f06593e63610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
6fed5707cc4f68ad83af5693085ba3da

SHA1
a6aa643d757a992ec8e8af43f87f54a42df20d65

SHA256
b351da3bb88d785955a79fbbaaf4942ea39c3095e704144fbb5dd69fff7c6a2c

SHA512
5703a969245fe4ef4d2fee857fea9fb496a12985ddf82352a4b6452c2e456672d3eb56f158abc6e70c05b79e119dd0530964fa7edeb8edc8dbbfffc9a800d780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d1c2.TMP

Filesize
538B

MD5
1269d41c5716d133fa026f16f76f7be9

SHA1
218d54713156a0bb6bcf62a5200dff7540af1f02

SHA256
94276c266bab4840204d97f22b613fdcac9c39e5fdb3bf8806b79e7b4979c27d

SHA512
77846068ef49ddc8151d7059217f4f0392f32616b55cda58b351914c7d3c3bf5b0ef14910c37d80a071a38a1b63818febf6102fd23215e4a8c2d7d5d4a8c8e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
942b859fd9812c9e38315c5c0235dacc

SHA1
3df3d99729ffc46651075f402a6d22bf08ebe784

SHA256
122f4d838dda8f0956786eb9c24a0cf85aff28334877d28c297747366dd7ff6e

SHA512
c0c58c5b06fdd6d432692f008c68e6bdb4a0fd04bba9c7db884e11a4632856b241a17eff8a13609c86f96101515f5ab44d0a04274e6917bfae68a1edc73386fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb995560ca6e0ca4b95cb93239c71384

SHA1
9f04f5d97082ecaaf808d1441bbbccc5e46525ed

SHA256
6cc8377c881b53b1843286f29171611bcad4d49f4bbb4ab8bc2f8fdce71c222c

SHA512
f2d62e59272a95104cf647963dff3b20fd3e17fb7a7e772f4e8c6254b04da9d30b1f3036e71614512e74fab30abd2502125df2d971b520ae3263101334364bf2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit