hxxps://steamticket50[.]com/activation/id=15615238526

Analysis

max time kernel
112s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamticket50.com/activation/id=15615238526

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
41	3164	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
32	msedge.exe
32	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 2360	32	msedge.exe	82
PID 32 wrote to memory of 2360	32	msedge.exe	82
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 4464	32	msedge.exe	83
PID 32 wrote to memory of 3164	32	msedge.exe	84
PID 32 wrote to memory of 3164	32	msedge.exe	84
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85
PID 32 wrote to memory of 4376	32	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamticket50.com/activation/id=15615238526
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc46f246f8,0x7ffc46f24708,0x7ffc46f24718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1859438666353470944,4490072919763594281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
6f90d60f41a87f595c923e00706c80b7

SHA1
07c6cde879902ab4bddf48eab094155749d02d13

SHA256
2ad24ceb0478832503569c2362995dfa26c37c57feb41315d002d317b56c89fd

SHA512
21ab768b740f6f36880459c50f924481ad68b6cca1b64438d6835ccca5cb0e866a6b57a433e75a699e5261647dc2dfed78eb150f202f499779d199fc9b9c6f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
909B

MD5
049812583a0496212c9fc66cd0e8f2c5

SHA1
34203c151bc1e82b422e9fcf6d8575b08ca6a552

SHA256
3fa98061b7c1e49a689b97759d19ac78cab3cd51cf449b8b35d4e5bc27ba938d

SHA512
56c9d8f678298537ea8bfd77895b73f878e4cd519403409e5b3dec3b1b4f3c3f16345f71a500788be9839e3ffb6a188b79510761abc49d2d38c701f2c0d58800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
654cbea6f65cb06b41c5e13ed1ef16fd

SHA1
02a6ca96b4d1cced81376c2fc4f9536ed32d3ae9

SHA256
23b60b9ce92c6434316b1b3fe1c00be1d171a7efc8cce3b5d34ed97c00cec8b9

SHA512
faef471d2d14b43531a8072deb7f84d3eee40426bd417b2b6088439025d03317632b7f8dcbf88fa18bd7a83bc379d3a0eb47f7f9a1d77cedfeb5f4f8b6927209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51be867cedb5bb41791a1b943debbf88

SHA1
5e62650cb48a70e6f496606f2006f9cb2cc4af5f

SHA256
869ac2008719b66926649093c4f2ed00196f0560e332e22d665ac6b9cc3d9bce

SHA512
8fbc1d4d61736e7ddded2c7087a9c8d1da67b7ca10cb6969af7a67d2ff9a0058e650606cd76f50c50e4bc7072b3408e0e24b49805aa4d8e29f5bb7be8dbc6742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9edd23c1c8f3457e0548fd779e878cac

SHA1
69fff7081910f2286d9d76a95bed58cd3b54ea72

SHA256
d697228a0e83e62ab120d766195cc633e740fe4924807e3f0a644bad59db4841

SHA512
fc678e1e2990693be7083c494bf72e491d881119d4642e231fa83752ea1cce479849cde8d41c8f6de6e3e9af20df35212a2713ebf778c169ae572028cd745c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bce570f88c0db378a42010db837d0f84

SHA1
5f1a491703aa065ca0e3c792e5625b1fd4c8d53d

SHA256
ce754b4800f60a97cbdf5ebe45aaca4d635a06dad0086e0f0dc007e7777877bc

SHA512
cb3da242773b8329df964958f362a1ce974a752d39fbbc5a9685385b2e128d2ef8a1a10285cfd8828f0044b847e5d9a566bfe0f0b6cad4cd34374950a7803613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d2865010c78eac7d06a4317695398de

SHA1
7dc9879c6c7f722673326a1df615062fbfd7f564

SHA256
e59ca168c0a854a8e668be8f24dd7ba1b78e0397b419a047cf8d9ffabf0f2d44

SHA512
2154d460735e945685454050ea68bacac009424f2040ef58eda0655d08089693fcc42c5b0245278572d17e324b8b57ac7ce25709592b6a1bb86f5b7c8bd83f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d698901f2a7feffdeab21fda29ebd167

SHA1
8b823cb1a63866c326ace04877c92b8e52fcbc7e

SHA256
56d89afeafedf14199542ce151a2a6976679f8485f24b016a28c551207efd62c

SHA512
735b1668589b89099262e30468461831eb4450cc28b8796e65c2eaeb08f6945d99a2875ab132fc7011320834708a8daf8683d04b4ca34793892184eaee58f248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f930.TMP

Filesize
1KB

MD5
392d1000344e68b0092c0ee6e97c222b

SHA1
009b9ab94f0843bbfb097016ce7b50af87722100

SHA256
b4904db8be1168f0135f47db16afaf3cbe1e0161f44c65ad74892a2f17f9a30b

SHA512
27c322126a79ebde17b42fe9df52fe61c0f466b35cb2bc52c6e610b9f07786e360859af2e8c6eef4775b80c4d809a43d8dd0f2484f550fb339be1f7ad457a885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac042159-4559-4ce5-8c1d-76d928ae317c.tmp

Filesize
6KB

MD5
b20d26ae9b933aae6fa284f3f045c3f4

SHA1
71b4a0023f3a2c0ac6daa0f7091b58ae3b3cfb4b

SHA256
36198bca832d5d43880d3bfcaed9c2612cb0d36cede042c340a527f2696749e7

SHA512
56e6e74e1719683f9fe9c7682d53215e9afdaf3577765533a3d466da0c656482a873a01bd602ad03c6c26690cbf2105e23248682734b21644184263f6eb746f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
4278d65b7759e04fc6ce3924cf03ec31

SHA1
ce159a8ad95648b624fb8b31e19c5441b76173fd

SHA256
6b9e77a8ef16bda7ef09949ce60221024bc4342132002a8676ada89c2bf4b2bf

SHA512
95442f9a973a6ca88d8b2b92c146673ed1cb19fd191f79223e10237ccc15d7cb32a1e96c5fc928131bce5732833899f1bc4c8329c9d1ca4b541443a9112e00da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
68d8558dfb8f4e970391fa3aee24540b

SHA1
ce2d483c7ec2309aa89be56d934488451169737a

SHA256
8114c9ff6675df1ec972b83d15436cf95ec0d270f50029a9a77eb4427cbf301d

SHA512
3e9cc0f9d8ad4168e729739c56ce4cc00576542bccb1aac9805c98fb77ccf1db89b835020930d118b1d4f728516b6c7e9931aae8c0c2017cd0dbf56beb80901f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ca1fec648b7389922fccf8079fd87d75

SHA1
3f8a290790d36e3ad96e081acae23401d1f23594

SHA256
c8fcd714c9f74d35f8e8c6f654d025fc376257fecdebef64d3d1c8004279dc02

SHA512
20ec40da5d80ce7dd502463775e6c9354e06bc7280451dc10b30b6c315b16f59a3ef6d06a4f6f11d259d009e955c8708205bbbf4cf88f4aa368d6aac9e760a53

Download Submit