hxxp://www[.]mediafire[.]com/view/kcemtuzpqgncdpo/IMG_20160918_010917_HDRsteg[.]jpg

Analysis

max time kernel
840s
max time network
845s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-01-2025 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.mediafire.com/view/kcemtuzpqgncdpo/IMG_20160918_010917_HDRsteg.jpg

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
127	1204	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1980	msedge.exe
1980	msedge.exe
976	identity_helper.exe
976	identity_helper.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4852	1980	msedge.exe	82
PID 1980 wrote to memory of 4852	1980	msedge.exe	82
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 2368	1980	msedge.exe	83
PID 1980 wrote to memory of 1204	1980	msedge.exe	84
PID 1980 wrote to memory of 1204	1980	msedge.exe	84
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85
PID 1980 wrote to memory of 4604	1980	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://www.mediafire.com/view/kcemtuzpqgncdpo/IMG_20160918_010917_HDRsteg.jpg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8067d46f8,0x7ff8067d4708,0x7ff8067d4718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12525257646415872203,7868462684021645361,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b159648-9c9c-4e52-ac4b-d04b864d2390.tmp

Filesize
10KB

MD5
50fd4abd1fb0a0fbd82c76b529d394e9

SHA1
3cd980f0bc738b44579e0b2af71437c306a17cd7

SHA256
2e977be2ff32a0be794d93fdd8ba01f8dba9134f839b6c7d96b20943da116dbe

SHA512
3cd41d38adf724887775b66c43af11dc26b88a1c792c9075cebeca57a0e1bc30f515b79ddd3eb9c6f3c97c5f60dd06cbeb6d9189bc415af044eebf3ef497f607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e97a507db8325bbdef7b1fcadf06f86

SHA1
7782c07045983db5ad0e43939b0c47b5f8e68736

SHA256
6f1f11f1f73b9c7c2e6866ea6759c409515884f382e22135c9ffde466accacb1

SHA512
47f8687649252eaa47447c56d53377577cfaad1d1a329f26d90d4b6a2f60110e022f262e98f77c409990909ed442e95a3a144971bda607fbbf8c5c52ca9f3f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b4534287afd1ecf08798c0db53f8e244

SHA1
d353748195de27c797535b4cefd9dbc257f914bc

SHA256
949811b4812f1df2baac349299f9bfccd33b9f59deb4e842721c0e8cf81d64b0

SHA512
5ab2fc3ec1a07cf5033a3e1cb9bdd9900938f25367a710f1e0e54bb0481a2fc89276bd68c1059811c945eb2482b9c107df7193f4e13c7051b5af5507827c8bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
386718403eeda4c1499d0a2a8aab822c

SHA1
cbed287532b4f9f33651ed4ac29e98a0888864e4

SHA256
565c931d7671047cf0de96433999a882ebcb0293185352345a3afe1570545fcf

SHA512
4063876cd9713964076e49c99ebf5e8e9b14c058cd6c3da1399ad3cad6cfef5d0c27573c440516fee1d0cea4e41309f4bd48048788de1deb09666591edce6c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
017af1abd80cccf031792a8e4974965b

SHA1
bb448b5b7fb274418ce8373bbfe6750a01e605ca

SHA256
b2bfdd7bb40e538c74a9f59c8b77529a6106d24a7a66cb9096f452dfbb28a946

SHA512
6be3cc1edc1ef43d914939b26850b3b44fdd03bea274eb29410f042710335e1ad5a1e75bc148451ccac169bbe040641f9df6c145d1a693ad3713715b4966a4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a1544274ea40b4a3cc61cd04b3889f9

SHA1
80f7833076a5bcbd17a936cda5e2d0eb364e1ba8

SHA256
5385ea5cc8b8b2124aced81c4f83f59e399e03df5bca741b854f93d887772f59

SHA512
8f1fa7800b59b042b8e6052cf43044c99d6e73e4e2adb99569ec027a19754a961675b226c375a74bb399a3ebb942e7bc479e140095e50bed9bb4b4dee75889cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8623b7269eb96e442bb95d9f701f32b

SHA1
36f49d360a040c015e136825b33c0e9eab346ac6

SHA256
c2aff381959d607d2fc71aa41bba69dc484d0430d360246ea66519c2c83c2759

SHA512
3d55f4d90b3da8f95b428de0eedaed4002ce15565aab20323db409fbc99de6520585fa4b00dd328b5d462dfce7b346993b14233aeaa441b5ac52537977d90388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9554d5eea73bbbe3c39b3773946dd73

SHA1
0e1082587610e0fa12bf2cf2b33adbbf9a8ee4a0

SHA256
1ac7f8cb21352795be0da89677c14293c8503c193e14f81935342cdadc079649

SHA512
04ddedf1969fb03aa9f9c506b2fecb6d0a09b672ae49c4c5494c0c628b51fe7aaa13c9c8f0300acd4ba21465b240f989e08d1f7eb5fcff4ba97b85fc094b13aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
580f41a17061a1d849f7e9d60ff18aa6

SHA1
762fd39e2b9eb3e21d51f4ebd7c55e0557420800

SHA256
83637c94ec37e78e34bf1cda227eed230a7424e39f0dec45bc07cf3f4f22d139

SHA512
3ea6bae95cdf95e30429bd39dc5c8d0cd18337d63916972d21d0b86ae21b472fa1da6ff0f57f03268b447b47efd17b6ebd435df3737a3da562772b5f69038802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c68f8a9c2c99ab7ec9505b665f380148

SHA1
38ed7269c9c57ae21703e6a94d4e535b2d300087

SHA256
a52102b487bf4d9c54e4a0a50151d5acc173822317d949a7524056c8d48335cc

SHA512
b9ba497d3968a33bfcb40513e7142965561f1b0ca44098aadb19103f33d509d7c9b0643c2158f63eadf1af351191fb3c4d6cc77bec55be1fcc8e27b134e6553e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9a8b63c342cc268d172d33f24782772

SHA1
71896a73a1b7452c3d7301a4bb56fd31afd0e20d

SHA256
9bf9581a88bf6e4b9acbb10aeb334e865752b025c0cbdb4c745776fd26bab120

SHA512
278eb79aedb1634229a661d7b61ec20ff7de020c8f225ca4846c7b05c6325de035f43839e4d7a0faa0faff542ed76972c487c09df48169ed1eed4242a5d64178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
780d43b4886c9fbec4c8eb92d32a6af3

SHA1
70e0a5b21c433f8d6a6772135180a6d8b82902af

SHA256
80a57539e2376431a195d28f44186d09e0890b9f06838c4cb7c5b6815d4c7bc6

SHA512
c44a8964543fcdb82f4be08685f7d66f170d3cdffa441722c130594a3e78b3806c01731809d5752698cad167f05a4f8c3f11347b5793597d115688aae8ba17d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581623.TMP

Filesize
706B

MD5
23bf073ec67dbe65833f8a79a104f053

SHA1
ff9a914aac41bfd455fa41bc0b60bc7e199498b3

SHA256
71cd9e672cb99dd4915523d2baf821d6bd129647a50c1d356a492b824374137e

SHA512
7810738f2c5e0de975a29c1d46bd2ac78aa964d5d1516c84cfdd354acf746177a8c010ba8f789db4f3cf4ef6bb743175f136f1a5e608260acdd6f28cc47079b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit