hxxp://steamcommynutiy[.]com

Analysis

max time kernel
75s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommynutiy.com

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3604 msedge.exe
3604 msedge.exe
32 msedge.exe
32 msedge.exe
3780 identity_helper.exe
3780 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe
32 msedge.exe

pid	process
3604	msedge.exe
3604	msedge.exe
32	msedge.exe
32	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 32 wrote to memory of 4428	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 4428	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 876	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 3604	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 3604	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe
PID 32 wrote to memory of 5072	32	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steamcommynutiy.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba1446f8,0x7ffeba144708,0x7ffeba144718
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
2⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14600310785646400270,5197611058208072431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1356 /prefetch:1
2⤵
PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
43KB

MD5
7f2c172ca810d85c0596390b4ab21df3

SHA1
d4acb412e626e744609aa326247bd7eeec469bec

SHA256
4ccac6b00b8d6b7bec9886d8a23d84131bed955d995a37b5017196b03d1edab6

SHA512
961fd847cdc7b7c54dcb5ec19e3446701de454e9d06e1e2025360a1d0b426d204fb8aec90b854c7b2dbe3153aa66b5d90ba56f8ac6a8bc996177642d6f55c263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
28d5d648ba30d75f8b900f235f3f70f4

SHA1
6ceadb64c594d19ee90f85e878fcefecbd9a9f70

SHA256
8b490bbde5ba4b56d8c31212c87a4bfa556232ad989b4a32813f1bb2ec7c3b1c

SHA512
3ce4b00cc5782fbabfbe9202c0fd80ce0a39e37fd72e644190a422d32629dde41ab57d8b139fc840b8f91dd4ebe6a4eb6123c62a31456ddf32b88f6924c2db09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
841B

MD5
bc509c0690f41a8f28261139285df9fc

SHA1
9a3de7e41701afd2dd4d4e5a6fc3116b9ca4bd90

SHA256
a1ddfdf6216369a75672bf0e16ee2de42f68d584065ed1d479a08d3178972dc5

SHA512
c025433a5ce57de1cf8657781c9c2823944365dfebac080d84c62a04b5d798053c16f62762950b765b13fc4fccd198f65704be95023fbe14a1720353eee84bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a5bda4a2a7524317e03560aed0b43ea

SHA1
1327967c0930ff879d687e8d7caeb4b297a39857

SHA256
10fc44ebaaf11ac96c937045432783fdbdda95cc93ba9d82faaa38fbeff4046e

SHA512
d1cde49d0d9cd90b89b615f077500cada5d49cfe7138428c12b427113f6b862c13766bf88087d175ee3eb37b4639c6d2d41b873321e156fe3427fd105885ea6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62d7e02df388466ec881f80cf34b6683

SHA1
a6fcb07dd051cafb6797e01f520b194ceb78858c

SHA256
62a955a3d00e11292eca244b68a595f6005505bf1be7af17698e48c5fa129122

SHA512
2411581f1fd13ca66ff2dd67991c1756c6d3d8a1465578daaa351374bbbfde8edbbe22852ea453fba3b9793f9df00b3efe3dd1a2a41604669d9ad98367bbdeda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3a402dc600ce0ef5b16d32b666b865a

SHA1
d8ec37bf231f29cec941dc62025ff53539a8f323

SHA256
ddb58d59ae55a76d14507724f41d1a318a057ba3d26790a35b082b2d709d625f

SHA512
c3bc681522563f16d22d913602c12106fc7a0d02f1608ef6cce9d915fa1510779b9c685bb8fbe63325b5839fd203e23c43b3e1c6531a2f045ee0e67297ceb70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
215e63137bc186244af7da0cdbbe9f05

SHA1
7c9e8cc937da22cb48d7698bc2e87afcfce56198

SHA256
6e34784333e3a228ca7f3eadb0065e9096300acbfae66a51fcb6f8b7dd83e2f8

SHA512
f1955ac833d24cb6e575281193f6c50ccac90fb4cccae0317de774933893ba2ad3d493491fa0962a0e54cf240caebb225d77200a19573111be0041b379d42cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
fd769275b172b36767830c42fc219ff1

SHA1
94bf7d365c4abe05d2de499c3c8a32386933407c

SHA256
9e3303052116013a798eb91e12006a879c3c1c8ed7b7163379b91f76331453e8

SHA512
a03f1449d64893db7651d17d2cfaf836c8231fdf2a4850aaaf62b3fc94cb6c62edc7d26fb336aab933a4e0c454a7c0877da6cca535121e4b2b48374171811bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
d93156f3c3a2974a0dabd020cb56ccb3

SHA1
08dcc8bf01550ff69468e959763f80b4a9b7b0b5

SHA256
457279bec2b2c988c534a2318f7557b9338a3cb5d0eb05705c99f73a7492c9ff

SHA512
b5887987fd1d3f7dfcaf7f4edf329e3be31e7ed342d789ba7637a423517e96e9b6107dcff53a7f00c91d18404a11050e776101aba7726c72f13d87ba7643b7a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa1f.TMP

Filesize
370B

MD5
2e21728e32da066da7b3cd3e2defb1ba

SHA1
e518abce26e6c04a47990bef66d729056690e532

SHA256
58a0d688f59e9e4c1ef6974acab8e736df06ebb1d89f1ff226cb1e8101fbfcf6

SHA512
adb209f9c3eded7207556fe845b73b2184a96f55d0419110b1b4bf15953fe41e64fd574438e22e138dd003cfb77d6c557fc067ca43794bc1778de26d4c96e404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ef20884b8951175eb86d11a3db8934c

SHA1
64ea366d8fa2b18c8443374e8ff2edc2ca29508f

SHA256
77cdb8e570259314ffa40733ace5c4dc3f6529dec45d1cfad786dfe7e3388ed7

SHA512
71858462564654c5d09ecaaee318c0bc6215a4fb8f73d5554d85a961bdc43d7288bd2a3e27b2a4052da61fee3ebcddaef54b8d4214afc27dfd7bfbd5ef8f95b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_32_DHXTSXYWYBJHWPJN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit