hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba1

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1600	msedge.exe
1600	msedge.exe
1588	msedge.exe
1588	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1588 msedge.exe
1588 msedge.exe
1588 msedge.exe
1588 msedge.exe
1588 msedge.exe
1588 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1588 wrote to memory of 4068	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 4068	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2148	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 1600	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 1600	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe
PID 1588 wrote to memory of 2688	1588	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc93e46f8,0x7ffcc93e4708,0x7ffcc93e4718
2⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
2⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4792 /prefetch:8
2⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4162773427908534837,5266708138114453712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
60d317b67d9fb65831d1d97f8ce2328e

SHA1
bbe44e348d616202175b0df868bcbdd271318339

SHA256
4b15f5a2e0f61d5fa8335a8a8ded18103471687f6773f21655f21d6b714cecdb

SHA512
5f9ab8a20cb485097d15da4bf9b0e27eb06f705371db663c8f631f3c8426863a00cd66aa5a826aad36731992dee2381e1a811fb7b26b673f0159e6260c7f973a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
543B

MD5
f689f5dd09198ead013f9e7577cd2afc

SHA1
53e3a40f7eedea350ab47334a58bd4ee7536798b

SHA256
9cb5b0f89b6d0019c64a216d98c1315f6839cc6c2f3cc4de170548602e00ce85

SHA512
ce8b533c46bf96cbbf93a6bc4449756fa7f905fb28a02303cfadee773588255e49968af34bbe9240e0277ca63aa4fa0a28011b88712fd464786f3f539f4dbf23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
facdc28c666cf7d08efba214d1c006c3

SHA1
11989c55235ded048494a465f21eb593cf5c88ff

SHA256
f508ee2ab962f69a1246481e19a9a379164724987abb03158ecbc48ecf139f97

SHA512
3ed6600ec40c92014af9b808865400685865d189503f47607e7fddd58e22104da5632701e29ae7b4e35df5c9b2b365066e6133d5181d9d59d17fd0ea5dfeed49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2aa35281353cd1a10f097bdaefd2812a

SHA1
0a1c0f81c37300f08e3d749cf2a7a46a68936132

SHA256
8c0b37180f7d2264783b3704d01dfc1843c722a061ab427f46998c1a96ac1b24

SHA512
49bdf8914c9ac608cc407dbf800f89a168e2c37b588ed2d86524c05376cbda00dc2e02815b40815db78075cd4463251a2596907b0e122e3fbdd79a358ba315ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5b742af93c30fe359b0b3cc9920d724c

SHA1
440ad1d6825b097d7963c14ea956f7e0725d744e

SHA256
ff14f4ea826fd99b087af4fa6ce7ec94cd0a5376f8bf3998e20b54953bac8726

SHA512
b6f369de90f50ab981543c44a0cb449454ee932120c18ad5104793e3950c91807fbae13d5c4585533335233992820709d41295a5891e02e5ac87a4362168ee0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0707caefac06ee99a32804b06fc6dc34

SHA1
31ee3153fac834e84805bc0047bd29b3dcdb5261

SHA256
4ffab85b1d4964a52665dc10f3fe5bdf40adf30a2d1c83ed66c8328873ab135b

SHA512
ece169933acd82aae1935b85c5bf27b7d8cad02bb5741fd68ea3b73cdc103d9315011dd3d05b5c2d69fff865a6bb7892a5bada5daec4fd8371278123eb0ba663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b7b1acd5cebc215077a745450c6ed1b0

SHA1
9fd75ed8d2c66208e07ae0f67320a2b1446cf212

SHA256
1d9d6bd40c39349e305d3ca02f95b9af14b3b89592080f00afb692617bea3838

SHA512
a9ead165ae625f90e2a3eb1dc0c5243dcc5a71b1ed618b37922cb7f6345e07a09585917b11cc6b62aec98f171c7eba59fb6949899c6588031c645ebec967316a

Download Submit
\??\pipe\LOCAL\crashpad_1588_ADYYADTDDOZETUBC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit