hxxps://steamcommunity[.]com/linkfilter/e[.]vg/gift-952185

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2025, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommunity.com/linkfilter/e.vg/gift-952185

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
104	5348	msedge.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1409786394\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1409786394\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1409786394\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1409786394\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1409786394\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133892031693493779"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3630502724-2561614198-3854231964-1000\{6A9C0F15-F6F0-483D-9B98-8CE7F6A03B56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5772	msedge.exe
5772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3972	2032	msedge.exe	85
PID 2032 wrote to memory of 3972	2032	msedge.exe	85
PID 2032 wrote to memory of 5348	2032	msedge.exe	86
PID 2032 wrote to memory of 5348	2032	msedge.exe	86
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 3596	2032	msedge.exe	87
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88
PID 2032 wrote to memory of 4504	2032	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/linkfilter/e.vg/gift-952185
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7fff3130f208,0x7fff3130f214,0x7fff3130f220
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2580,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5092,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6176,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=120,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5348,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5396,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4308,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4316,i,688881395635823137,10227114441730731524,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1614398433\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0ab27b557c982a0966e0e873ec0af684

SHA1
91cad3834539c09bbdaaa04843abc5540e7b9215

SHA256
0520ac04b1bd66dcdebc58825ac17be618be85ddd4e16ede2f0fa4bcbe46fc40

SHA512
3a492cd3500644fbdee6a1595add1e1bfbe64ce606a461361be8d7d65f91ff74dd4b3c1e5fbf22dc9531c9da66452545d0bdb2b9b464f0802f0964e2cf6bf0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c999a9df40db911f19b6fd0369cfd326

SHA1
2462098528fa57c0f9d1b4b47169aa3da9ce27d6

SHA256
0aee0bc1aaee20e11d23286ed4ce7bfdc3eb4ce85e8aa7de6d31227952d4e3df

SHA512
c8c8274ec4cefcf3e8ff621fa456710b2381cd07b13c4d6fede0d9fa23782d473d17d47dce248c598961967b1ddbfaffa219e3e2018285cf664a087e35246204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5822f4.TMP

Filesize
3KB

MD5
2fef54c83f04c9d6c194450b2e4fa7a9

SHA1
d07895c38bb65624ce1ccd1f984e63d4b1d7080d

SHA256
1ecf5212895933c539db4f64daac3871e71da1a2a479fa27b4cef57f03b79590

SHA512
25132a13ab3f1e8b5dec53cf706c963ecc6b1579a1eda501ec14b30342d5d6903891f48b6fb7f48fea67cfd2386234ce419eb735099c59b4cd59117c22552f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
fa8de94e970bb843b412c564c39d65b5

SHA1
e6497fa9ff57d4b1a33d7275c284e2f7c0e3b16a

SHA256
09a62942231771e4bc7b8102237bfa99c21f547319526d816beeb411e9902088

SHA512
154e78e10006cb3355fe5acd2425e26280d4e40c8e0d88843debca6cf10aaa9d4a81d610acee2681daedada8700209a05d0c61eef8ec683cf17ad527f3a9a9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d0bed11ee699c7a194a2a3175df41a66

SHA1
8f326fca7550aebd18a10a87b664a543da4e26ee

SHA256
b0a919a968d9df49de26bd2944a4cbc4accc50fd1166e58ef520241ff1f24a3d

SHA512
c89cf78bd495e4850b0ae2ca32be1998a38f849b47c5f539d09b1a4c8de067af2cd617dff80a0258e871b38499f9d906f866bbfe780851d1a77a4f42a44ae3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
23ef5512f3cb354a431ad72ab3918ff9

SHA1
545395046afc99a3ec83b6cbff4832aa32123fcf

SHA256
f6c3016de8dd2247e24eee2d728c600cba725d30657a31c7476c3baef5d44168

SHA512
29cddc75f2d8a8ab6aa631a0de508a173acdd68a141410345c2d7199c6706ae9fb76ddfbe41b120053b77f2ee3005cb8448c80e85cc9950b5168b5eb549395b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
4c8539fa8a7e4655c21041c9f87d56ca

SHA1
a1a298235825e68ba167af31a2e7eea9abfd287e

SHA256
643488dc27a7733abc41a56376f2a0a4879b5f029ecf51b8b2b8221b73173dea

SHA512
b8a6580b8164cf9786ca91e5f32d8e666bdacde6993d7c31630f06d72cc3df09649e0203ff0d4f42221453d25b8da37110476d34d59a1f5d463bd52868c4a498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
2207dfe9415e37dca4d3378bf53981a4

SHA1
18874c9c1f5a93a8caa50934bb75d4b0abe9531e

SHA256
9ccfa0f6c98c9f0249f0f3e35fa718cafc21d6cdc9920ca4e51a372cdf2b7025

SHA512
6aaf3655936b973290b9ce84d28b6ba23ccb0c1237a058048240deffcb3ac3f5829244b4779881354a5137ce8fdc2553db606fb26b6f49cd0714828645b28f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
bf3514d96b33810ee61a7f0d131fb3f5

SHA1
bf066290a51370f46a2fe6acea1b5e6836a15759

SHA256
e0fa9d2b48d3c41ba7b2a0c3c36be2734c854c0e362e987016d646bfa80a8ae1

SHA512
d6a0b84830cb264ae849e60edb221fbb46639c3b93574b3b9117cbae5f769dde653f92c6e6f6414a2a9da900327f0ec56c8325f300e1880bf24c0f53546fd8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
21KB

MD5
43fe24054ef60445407d60e8ab0dc30d

SHA1
3abc83902fd0eb9a553e45627ef9157c45349b49

SHA256
686e5ba0e6dad15475e1ea0aeb11adaf0c622a834df129559e5fcd1c80afb8a6

SHA512
371ba35ae2e2f0d40951c42076158aff7d4474ebaa6cb59d91c68e72c7e6a8560fecb42241ad252c8ae2c3740b4717eb0e4f4ad7cbf640e70bb4f5fde74b6297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
463B

MD5
343f6fd9c7f5b9f7137d68fbffe7515a

SHA1
3ab237d2ba0edc7f9c9996eea63e29354116d4af

SHA256
92f55525b92b18434ccdae1f72fb234e72ab496304ea8f33fee5a976f0c7771e

SHA512
82830ba55b9032510623a33b57fa0b5bf13b8b51d4c8da1d045b576a7d614dfb65e566ff0d6e45ba89dcd86ebda166b01a0825b00e43dc3f7c6313b7bb5567ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
894B

MD5
07b3f7c2ae5bb8d85638fcaf200e2d17

SHA1
8abd9bb938ea73f595c3c136598b1aec62349ebb

SHA256
57e5273fe7b3c88d80ba1d87559a557678e514241fac9c2bb2035be6a50235b6

SHA512
f525802fefb70753b71c9425d88ebf50750325e71268a1ccaa164776abca40dcc05a06adb7a92816bae6a5b30574e0e0d1bf696d7be214c88a7d8b6156e5f580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
5aa81990b24bbc8280b55d1fdfcfc724

SHA1
d6c9a383a2776d5e977f0060db149548003c79fe

SHA256
c2db4096f849780c7724b30b6ce450b2566e6e3f00b5f2bb4c6f83b7e667d10f

SHA512
a3f4438887921b3fa569f04e905303d696a461fa882d07881e435dc3fe5391a5ca148b3c66be0d82772423a4949cbe19051f07ff599a1526be9e69222086b4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
ea462d8bc24464cbeac0085aae8a7f00

SHA1
a5862606e85ad03f1fa3cf787d91a33799925664

SHA256
cd6ab7e31a3fb66e30f1bd552a90618aadd6aadbd0c22196a56b2d09df58e992

SHA512
d0bcade54ca30a4eb3999a9a62f190fae26a33978b38ba46a20834a1e5976fa9f33176c3f428f1da5838bc00ab8686faa606c2ee7d7d06b555a12731b7597714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
391a558fb28701b90e402e1bd9477b91

SHA1
0f072b81422ed627c27601287b2b0504f9adaa3c

SHA256
d3d4cd326d7d75178c4639968c441d46fcf9fec1755604259008afa16008f4e0

SHA512
2895cddd53209d77536de2e57a7526cd5b6c5825e64846b20ab1d4154568fc308de4e2184b6c38dcb6afa530de220560e144b5c86264ef21f92a78bce68f2204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
2d40f9cf5ab50fffd25f16c59bf3ae50

SHA1
a76137f7db7d1157692555a0c3e358ba8c5dfdfd

SHA256
23fe7064a32cbd528addb9e06ba248d527dc82845993ad3e05818f65d3278b1f

SHA512
a0d48f84554cddc44baed27ea3159eac51b88d596d0c27a5cb7d85c8fee0f5ae7a4e064f295c8c9832eb0bb2da19310b92eeea4f6d366476f1625a568a6af747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
5b0bf35a61f015e653907eb4371b773f

SHA1
71c51b777e5b710e4a1ebea1155def4bab316ffd

SHA256
191037a71c9302a68180e4cb8f1221a41a1443a4669c9f47c30572dea74e8d65

SHA512
bd8ca937efe0d779c1cfe5cdc63fe3d2ff965f8f691a2f24c8774c50d837bd3e0a2ed61ad451c593e38612146c42f6bad2047d849e03195818bfe5949d3ad6f6

Download Submit