hxxps://is[.]gd/YrRUch

Analysis

max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/YrRUch

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3944 msedge.exe
3944 msedge.exe
5020 msedge.exe
5020 msedge.exe
4632 identity_helper.exe
4632 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe

pid	process
3944	msedge.exe
3944	msedge.exe
5020	msedge.exe
5020	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5020 wrote to memory of 4080	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 4080	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3960	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3944	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 3944	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1916	5020	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/YrRUch
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a8f46f8,0x7ffe1a8f4708,0x7ffe1a8f4718
2⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
2⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
2⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,9531966763758030739,5924505358079384249,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:5376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
59978cf29c97a65cfac870b2237a8a1e

SHA1
67c44e048f737f0590b1d9f9e52df2e202cfe7a9

SHA256
2adab7bf5696ab3fc64f0cc4ee635f4e43ad80667475cd6a70bd8331bcd82d7d

SHA512
22e7a3943c6325e0ee070f0416aa1e057f8f074d24c22c18fdad58999cf2fdc6fb1377091aba9833bfcbc2f069abf5ea14b40c46fd4815f8050d67acd3ddfb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
3a8c6fb4d2a751f31a7f3f33d56b2d1d

SHA1
610f4199efd7e32c09cbe0eb9c8d8fe4c77e4e89

SHA256
6aa6f3134cbac24695ba9e810af1028685f10301013e0904d30ca7b1100fa661

SHA512
e1b7545f99ba16dee59e5d9af62213a32f5d22de3411b0fd2f975a4982db8df589f964e1b1760e0857d460ddd8c3656c83b755eeb447e7a267aeeeeb2d70df81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
04fb2647d2a639819c3a4dbb8a9552d8

SHA1
7a1e702b15e7b3694a6fa770ad1aca25e342d90b

SHA256
4b0460df246aa6fe690b36172d53c5c65f04e5ae9596d4b0a55a22202b8a0449

SHA512
8a7613290d38ec811e437db913ed66e024d657b241009822ccc372b7e07b32126f64cb18c091c4aed04ecbc78329ebec0bb29125b8f924bfb885f3a34d147952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8b7ca2756ed3681efff1d6a115cfd50

SHA1
f39f9d13e6fc753c59c22c9fe5cdd202cbaa368b

SHA256
eb69f995ec3a3ce7e8ee970c3856831f44a56d8be1a910e55a0b933684892b1b

SHA512
ece1f02357fdca2ce3e33f20dc41ece085358651b89439ae19e1d86e31948cd1b1f040f9c02add4bb1746a64ed83a063a60148c240d01de238ea48038118c3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea3dd6e059cd251a30071a1b3e6f5704

SHA1
5ed005335c495e206ace63d6974ae365dd360cee

SHA256
4858dbccb9407a1a19c148cb6640ed0c95e8e40d4a73192675f5e7e1e148cb33

SHA512
0c69ec246e79ba956ea1b3e3fde3de57626083d7311dfc663b8907daee3653c9d3af53e8fd422812340c66aa11fe1bfc954b3b502ca6364b68180887679676b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e96cfb0f1000cad821a4441cd66b85a

SHA1
d5f274751b3362f105d6015ee845f9271625b413

SHA256
9e8ff826293791775fad46cbf01f274fe9fa07e3d6241a0b835eae1696052856

SHA512
15aa7f19f379cd8ab85035a5b8ebe8e8c5b01552c2f114fca68f6c891b668b025b28a15b65ff57098ab5d89afaaee5735190d68704199948f7059d2c9e2197e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fe9721dd79bfff596fa41bc3cf99e73

SHA1
216c5ba0cdea75c596c6668c686a72a50aa61584

SHA256
1a859db1627bda0e1d28fdd9af0040001fb2ad97f1da74ad434f5c46849fb66c

SHA512
717d2ab08dc3027b5de505f3fbc1f4c166c4ca77b1f3fea86787fd2cc12864c4102dde665add46900e86bc30afce43f2a82cc37dc65499f4d1f7795e9b60e423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
2f57ac77bcaf233292c5964c8f7a48bb

SHA1
0cc9c0a69682ce00bdb033fd5b635194c2ade88c

SHA256
c031dbd1d0c1dac3bd1329e701ce71c965879cfb2b46e342d900ca30fcf935c5

SHA512
1f7b53762c1d9ea8b817a789e7df4f1b776a381689cd9f5d56ce629df465ce0f802920184625ce705691b0c1c2ebf052beac3016c9923c147133076616c3aac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
204883c2873683c8e4349cb04470c514

SHA1
ace2dea8471d004c867d3b85e0257727a66d4a42

SHA256
47e6110cd85b7c1c0b51bee20468e7149f72714e1dee18c596dbfff58e4851ca

SHA512
06ee98cf70eb2f336af05b606dbfd80c6436229c2b7e6c8157eb89d1c789fa3daf910e58ad4b1079e264eb584791fab9076cbda03d1d3c2d344fdada24af45ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583b8d.TMP

Filesize
705B

MD5
d849877301fb71e2fcee28d7515b8e96

SHA1
c8409d8cacacc73a9e0510b30abbecc3c06b1a20

SHA256
2b6b1be55abcdf068f9e84ee770c89d465140755b97fdca35031256fb488f94d

SHA512
fae69cade9743a87dd8e961d4abcaa3b7c36f027acd64600362b807df7d7317f4f7697e8905a59260b7563790b40eded0ea40c07ffb9c1a9caae70faeb49857a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1eb1eef57f3be24521f46e4a8165f3f

SHA1
d0b30c80ddc4d9c69e3347c5e3dbcda00bba35e1

SHA256
c4d216a678e6c5e2d5f5ecb09152ee0cc39d596e9914abcf53be414db8842f6b

SHA512
71f843ad0cf9b192db3b0c249c07702521bb85140134d078aaa85cea97380b1375ae311a4a2db2502c12947281590e2df9ee7cd93caab033268c24a141876cf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_5020_VBIFLJLIEGPZCDMJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit