hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba3

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5044 WINWORD.EXE
5044 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3752 msedge.exe
3752 msedge.exe
2524 msedge.exe
2524 msedge.exe
2596 identity_helper.exe
2596 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2524 msedge.exe
2524 msedge.exe
2524 msedge.exe
2524 msedge.exe
2524 msedge.exe
2524 msedge.exe

pid	process
3752	msedge.exe
3752	msedge.exe
2524	msedge.exe
2524	msedge.exe
2596	identity_helper.exe
2596	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXE

pid	process
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE
5044	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2524 wrote to memory of 1712	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 1712	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 4972	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3752	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3752	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe
PID 2524 wrote to memory of 3580	2524	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc82f246f8,0x7ffc82f24708,0x7ffc82f24718
2⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2776792345737433624,3814458796064505762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UnblockOptimize.odt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
b359c63eab4282276517ac30effbbbfc

SHA1
8506472e4da0a64e6e7b75b5703b901cd4240b94

SHA256
473bfc7e05b1197f48a1c8326f3cffa39d5960e3c622c2a48b2222877812f90a

SHA512
7fa4994eb0d7a7d3715dd217728dc27a15d6ff74c73b794f84bb62a7e261dfd9beffb270e8a50d11d063ad67746d85496c014e391075a8b8a816ac39d7e2cfad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
543B

MD5
fba9bc7d3ba34109df47959cebce509d

SHA1
9e722c6f8ab412d2af5f9c88d69eae3626830048

SHA256
ce27851cd70657953f9b60632851e5c6280a8c9ec7100f444585281591aced31

SHA512
4acb0a220d5941891d5265682ff1abdddcde6c910045ab2c1e9ad8e872efb8f3da6cdc5853f739d838b9e712ad34fdd4246a46b0257e15c0fe78c7d0d85556b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8614f557c0c0d8196219ffdbd5166071

SHA1
24105b9c0b1b8d0e9ec4bf78d1b36c909391eff6

SHA256
f83e28a58a486a38e77e109f498bd481ca844e05b7c47552e54eb8dea3645958

SHA512
903f91d97a4a05898576cd203aa75b220138b69e3d1f13417016e82973265ae7cb99225426453ddcf75cd29c43efe657702f98129cb48b8368373bef5ed03e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d3881ad66bbe3430973d25a4f05e6e3f

SHA1
1a081ba6da5185d0170f62706b7a4cedfc2cd023

SHA256
82ed2c27f1b95f4af7f71e4d5e99561d6b0e3c24bc4c0b3d3aae56355866073c

SHA512
d6fe70923fe8436c44ecb8cd6f8b0340a07ca7a45dad33296da13a34390a90fc2aadd2ab5d75b7932fbc1597d2c217f83befa507da404bb14cf60e1cd9380979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
eac7fa57a58433189c617448223c33f1

SHA1
2d3a607f3f6033f426913d57c90217643b760ae5

SHA256
10c3b37b2441b841cae555fa0696cdb7b780770687ccdc5d705e969e3f5b5652

SHA512
37f13b327c4bf94ca526dd9997323f324a105cc294fffbddf4b4fea1f44a245389492c956928e817fe47751ad3f04a34f9c3a098d9a1404472c4eadc73c980b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
862c6339931c6977f33324c4fedd84a1

SHA1
166cfaf85b6148759ecdb1f639ea9dc6da1b5fe5

SHA256
243b8366aa73e102377fc4aefcb7ca7c9a41baafb80e3a074d760737a459f325

SHA512
76862fc7d6444c45773eefeb29db85fe52349b3614b0f037563efb13ddcb0eedfaab9dc9bfbc8908aceb9c3aaa091c666e5200be61997ff63c11c102a512fd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
670458d8b58e82646ee4a08c9c8f7d90

SHA1
69a1714e949371f685858806d8d28f94e2c6f175

SHA256
489465575212205b957ce0cb954b189eb8420a4ec44a401184e60760bda8ca09

SHA512
35aa9ce95cab7255b38e5e5673b296daedf6f99f8bfdf23d526ea42049952b96565032845e693b956bb1608c01dc1ff455250bb5e5bb5e188b529e5146033ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize
4KB

MD5
2bd94e5dfe72ecbba3c95e4de57bd416

SHA1
9acb83c7613f88608f23be40e3af5062f903de83

SHA256
8ee92e4b1a5d8ad715da46923db5fdeb2f654f8821ace0d02b450f8e946e985f

SHA512
ba4a78d4e3ee3abf9abfa0ef711a4450fab5da697524c01c125ebe44d7acc9b210198dd3200b6d26911ab88ab23fac5d4f56c4dd94f4c0b2f24f97b54bc13e82

Download Submit
\??\pipe\LOCAL\crashpad_2524_ODBDHIXAUNJOKLJI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5044-272-0x00007FFC51670000-0x00007FFC51680000-memory.dmp

Filesize
64KB

Download
memory/5044-276-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-269-0x00007FFC51670000-0x00007FFC51680000-memory.dmp

Filesize
64KB

Download
memory/5044-266-0x00007FFC51670000-0x00007FFC51680000-memory.dmp

Filesize
64KB

Download
memory/5044-270-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-271-0x00007FFC51670000-0x00007FFC51680000-memory.dmp

Filesize
64KB

Download
memory/5044-265-0x00007FFC51670000-0x00007FFC51680000-memory.dmp

Filesize
64KB

Download
memory/5044-274-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-275-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-273-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-277-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-278-0x00007FFC4F3D0000-0x00007FFC4F3E0000-memory.dmp

Filesize
64KB

Download
memory/5044-279-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-268-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-281-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-280-0x00007FFC4F3D0000-0x00007FFC4F3E0000-memory.dmp

Filesize
64KB

Download
memory/5044-282-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-283-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-284-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-285-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-286-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-287-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-288-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-267-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download
memory/5044-298-0x00007FFC915F0000-0x00007FFC917E5000-memory.dmp

Filesize
2.0MB

Download