hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrb1ga

Resubmissions

20-02-2024 08:19

240220-j74d3aed32 10

20-02-2024 08:18

240220-j7clcadf5w 10

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrb1ga

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4340	msedge.exe
4340	msedge.exe
1332	msedge.exe
1332	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1332 wrote to memory of 3168	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 3168	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4764	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4340	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 4340	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 972	1332	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrb1ga
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cc6846f8,0x7ff8cc684708,0x7ff8cc684718
2⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15890552777817557006,16047918200539657463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
552B

MD5
e68723cc79214753047f023049746ada

SHA1
4a41e4666d1e95a454d43cdc7d97127b21c96321

SHA256
d7cd3a8525643d224c9e4d997eb2a4f6029e42db471b3136ac21581edf79f78b

SHA512
b4d289016fd3f49f4eebb8d2007b634e096056f561da1044ce257f43ed084ac4722ccb8fb032c3a41d989c893a719fe3c5fc72b366565256bacac277f479fafe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
984B

MD5
e8e69410f031227f7a0857e238c9412a

SHA1
c15d233f33e60d19ddef0e51b96f89a6178af93e

SHA256
6fb2184004723edef9e32c24601423980df733b3c9be4e59f6f81eb2e6df77f4

SHA512
23c697957b2fcdd07dd502a08b223c52737c47e918668c95d424d0320222b92ab0532a0a2b647bc6b0d2406cd7358bafc6f230aa23888fbe103b83739165ca99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d88af5e22ea9ad7c199ae1cffc6ca58b

SHA1
77ad0c9db97a0f9fd59ebf407f7c9157ab6b95ca

SHA256
fc5e35614489e7af2878cb4e6580fd46bbfcea7e30b2f5d4773405228981760d

SHA512
a500771183fddf92b8aeee9aa9711dc9040fea14a9b38426d80c3eb0fdcae8d8b63b76556120c6cd6426ccafccf891efa56933d38e0e6ff18b59fc8167b9d2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
344fe734d48437431a9e16e257a23a95

SHA1
1c291270b4cf8d6b7f126865000e4e449bb9c663

SHA256
96aef84aa07ebbeb437a16adc7866320640de1c2e25584cc79a9ed52d6e37c6c

SHA512
c90fdd8648af55a9a2adb4fe0afb75e514bfe481ce5afa0f706e97036a3bfe7b3be8abd7c332b773824fa345c38074102c9535695bb9ce35017056f2c7b59533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8c828c9e3b8ea4c325f167c2f259e8e0

SHA1
ebaed6a3590616b389c8aa7752f85ad5c2c71012

SHA256
0ccbc9ef4b9879549348c868006156a1f281607f3723026dab0608eb7bf889c6

SHA512
829adc4564130cdd333c34e5b8823f2831be6f683286c542e8a272509034dab847b42d8f5f6c4184ee53bfb015e680818a0f0737bd0d93ef394a9d9978959504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b80ff8b61e6c6828b84275655cf89e3d

SHA1
eb996a1413f206ee144c61b29d78cc5245024dce

SHA256
e2d7304af3a53c52269746c824ec08fa15490296a5e3e4cda42a5db724660ad5

SHA512
ebeddc969e3d0b0e01eb1e7512a9794af40394d5b8de0e46b41ba352850486910819e3650697f7337860ddabd45285eee8b8cb48436fbb481d34568be664a543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
d33bc61ff1da1ee9a8548f05ca8819e3

SHA1
5b32a1edc453cbbf3642aa56fe6df33bb84c2303

SHA256
93704e19b506b7f06a76c0352a0e1d3e657e89345b46de79fc9f8306940b385f

SHA512
88173db2822148b64f3d8a08063babd4f2944256d700d707f2ba864019b0b5c0b58ff384814d2181bc153af1040e80c35fab96b2abea5c9f080d49654939e61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
13b4e1831e4820e471ae884298899de8

SHA1
d272ec78622f10ab8653ede55aadad5bbd415352

SHA256
24856bbf1d9e30f1d90c7b3ef128ce802b04ccbd4fd435f844f7d0deb16db10f

SHA512
a12f8463538b874b0a0f82d9c44e241272307839064272c3bab64552046c7546c05b1128ee6888799c2c24eb7c4bd5e2b88a3944bb74eae3128e89fbb3fd9276

Download Submit
\??\pipe\LOCAL\crashpad_1332_TQADYWWSSGPCMXJD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit