hxxps://steancommnunity[.]com/gift/activation/id=8254128695

Analysis

max time kernel
74s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steancommnunity.com/gift/activation/id=8254128695

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 5008	3612	msedge.exe	85
PID 3612 wrote to memory of 5008	3612	msedge.exe	85
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1388	3612	msedge.exe	86
PID 3612 wrote to memory of 1440	3612	msedge.exe	87
PID 3612 wrote to memory of 1440	3612	msedge.exe	87
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88
PID 3612 wrote to memory of 520	3612	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steancommnunity.com/gift/activation/id=8254128695
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe58a446f8,0x7ffe58a44708,0x7ffe58a44718
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,5518985112910823487,7080754715271799643,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x3f4
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
9825f72f9a733bd8538a77d65f7b1b61

SHA1
cb641334949c7aa6a6648489716c21a101ed12a6

SHA256
22da1488b39e41a6fa3ad31e31291f11ee9ef8c97212a2ca0ef5dbc7e0e5e079

SHA512
38664fc6828d0d6583f8b258957145273b92ab32918a1e0b999afe9867848a4606ba9c04b34955080fac1f9d7f9dc7798b4aded05be4841b9d73689ccd62edf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
3320fce494c904f9a50fe346e7265e11

SHA1
0a9911afa96e2a02a484ba974d27610f4ea9d592

SHA256
e68f00f647b66a0f479ac2c8c97d851f42bdbb7686d3e944ca74d7ce06cf6f3f

SHA512
72688eb1e4bd8289cc9c23af650d4a7ecb27e4aaf76da5b8634de355dce34e9b45ea55befb3ce27f95119256f70425c1c5a8960362172a84d1d982dd89a07047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
4688eeb0c4249c58aaf8c63f4103ec37

SHA1
1941edee23094e68bf9519c38144b75b99a18cad

SHA256
a74c42e62aaeef4d02d324652930e53104208e02dc5f4f6638061bb9d1d3b40a

SHA512
19c3fb0dec6f947b4c7414772ceb264e00a30d22e35423544ef4ff24d860e2c35d374db7195efaf8868d00ec45772d47ee27ecbb32da7df383159d6dc3bef795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
10a8d6e35251df5ab6d7b0967db24a3d

SHA1
24d6858873314605f624771a7215e8824d93de4c

SHA256
bc1873fba0640b297c87053bc288ad712acca59efcc73b9bc2deab011348dd7f

SHA512
1a7d7dd179af2d2787f57daac8d97c2fdc9178b255c53ff29488cb76bbf046de2cb543e0dd885c30f2de0cd97de47bd95cf83dbf18169ca6592d902d29c4d99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3bf399ecab9914dd14adee7262741ff8

SHA1
d2e9c8099a6d3f9291a537dc3419cf3a4fa2575b

SHA256
eee1e33fd70004277bf3fd90e8a2110d7b0c7f124ef7dd5f5b5884c22caf1330

SHA512
83a216751353418dfa83e069fe15c29243a7d41377bf2fe67026065c22f693e73c3e849891395e3da046b04a3d059ab86525dee225eb2807dcb2f1ea613af3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a547d6127eeb6c84c3176f750bbad58

SHA1
101b1a7c713c2169ccd16046f2d8bf40d0c0287b

SHA256
17636904cdd5b344432b87797df82d018805a7d3c657b25974ca8eb5530c0c6e

SHA512
5fc43ea1233e8f4205f846e802dbfc65b28a27a6fd0cbaf5654af7c51eea9e3b6270dedbfcd8fd35f562a2d926f74e16c02325f49af26166b28feefb66518db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38eb4bd672e92cf099e19f79851ade25

SHA1
a77d56c917d516dc4b2dd046d7757223f0446f85

SHA256
6538ab715d83d9da84e3e3c5736e013f1610a00d40b69348a90c0ed3d6c08f44

SHA512
6593e485833eb44122003c375b8e31a9378103688b717b11f309a3a6fbe7d92ced996d3a0e771bd9723893eef6ab07cda42c08841461369b1e0725d40784a616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bde070bc3378b809e5ab66db9c5d44a9

SHA1
34f0e6186f7867918c3e15d7c107f5df010311a8

SHA256
70df0026886f4fd4dd669161233d970ec952f00939de711bf35088fd64405bc9

SHA512
12e1a91dda39709641d108ce742369e303888761a8058d274330799e6bffa48e9904395d791c7d8ed0f4217feea795a08f79de7f57b4264b70a8b2e5104fcf1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fccf.TMP

Filesize
707B

MD5
208cab332fa6a855d9546eafc1a0cdd8

SHA1
5a64ea2baeed65394adf4842731b7ab82623d7d2

SHA256
1483cc8983a11919d9d52df21b5d0d18858d8753dc96bad14752f8499b5fd237

SHA512
62aa37fef2447d1d37d4b93ae47fa4b536a243f5f92bf1e03e3dab346ce85b90cb3cec30dbdfefebec55d1caa750688e10ef84ff25f48273d70bacbb9ecd5ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b51dd661-0c3a-4d2c-a480-f6658857ff77.tmp

Filesize
1KB

MD5
a0e06899cfdce2268551dffc64b30fa5

SHA1
673c811e30d19143f0b8b68a176e59f3986a9cac

SHA256
7380812e677abc61ac9bc6ac0383990a1938b436ef81163285a0e46c8c3d3359

SHA512
984c990356587fd45dd3a6afa0399922d52a9564fd718c827902779948900f4f1e9b0db2c1e1ed54092fd26a2d40d779cda54ab96b92c18f80f5a8cc06a99db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f675a584fdcaed95963f61a4f9aac149

SHA1
18b97734728cb9997f344575141091237070fbc3

SHA256
5a2726c41d555960cab810d305c94c128accabfa33d4d9293c706c239ee941c6

SHA512
6553f0316ee3522d01b18afe65c5b1353026afd379958f85ec8241b8bedf0b120e20f5059bb01424a099467ef7ba1c5841932b8718ab0eb1c09d5a7acca796f0

Download Submit