hxxps://steamcommunijty[.]com/get/giveaway/gift50

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcommunijty.com/get/giveaway/gift50

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4092	msedge.exe
4092	msedge.exe
1936	msedge.exe
1936	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1936 wrote to memory of 4616	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 4616	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 2452	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 4092	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 4092	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe
PID 1936 wrote to memory of 1664	1936	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunijty.com/get/giveaway/gift50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7ea846f8,0x7ffc7ea84708,0x7ffc7ea84718
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
2⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
2⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7300000134611581103,6063685729889141811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
b8e8694f2725f12265c0cc1d701c0c35

SHA1
35d9cf48c2bd45c7bfc9b06d3fb5c971d25301a5

SHA256
f93c2f49bd2b7f41d3aea98de0d6618693b266fd49f29136ddaa388e3a157d0e

SHA512
d062f4f87932c1582ada9bbd1ca91a7fe0618978f1da0c378563997db2fd860463b2a9cf1b3b816b7d5e9c9772c3598747db658a40a3994586342ad13fbcc029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
d24a0c2baeee5a39e48975cea6bbe752

SHA1
527746b066fc9b4ec9b833622898515ca255b6cb

SHA256
058877755ae15e8d08bbf5384794fe3965756269422ec05cd5402add1b4422da

SHA512
cdabf4232d2271d5613e8ad84ac5e81cddd8b43726f18cc91c8f02f12f23715c7526919108d72a4dcde4b85bf1d664a5c28cef63efba619953062b4d1343caac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
95e6ef1b0253571190215e53299c23c8

SHA1
315bd095c398c2ed118bfbd851d79f77a854ddbb

SHA256
52cc6af81a1751a3308251c86db29a386e81643ea6632d35f135abab0d1de9ec

SHA512
4d82d4b1c1e6cdcdb14d89c90e099fbb1be6503fd0886692aa1407588541d53df7c3ac01e58a78760c8410db0985465904d6a20310f53cb200911efe14dda2b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b4dd67b5e3f6d0999f690377de44f013

SHA1
a1a16c19ed766ccbfbbd5312e4c41bc7efc18e6d

SHA256
67cee119e4c384203ac8e8cd521e7e93f147eabf2ae178417b903fd3cd924832

SHA512
f4995fd176cca80eb92f50ba1edbb39453ebf9159a0aed228adc3aa9a6890528fdff00e76c137d4d51aa60808cc2db69d2722469a8cef8a1ab9e005978ee125a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9085fdfe691ec948c18b7a7834845dac

SHA1
79123bd1dca280af1e91d0cafad4e3e945e46fb5

SHA256
9a95ad752c570f166e31ab690d8be4d144345fe1bf55cf92f61d26ff8f5a84dd

SHA512
f03f7ea94321e3922ee0d7592bb68548858ba6672ebc553342d94b33631a7366036fac4847e977f5a567b31b69bfe682103ac5e9fb67ca8b60a122ec602bca3f

Download Submit
\??\pipe\LOCAL\crashpad_1936_TNWHNWTRHBYDHQCG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit