hxxps://support[.]google[.]com/youtube/answer/6276924

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://support.google.com/youtube/answer/6276924

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1108	msedge.exe
1108	msedge.exe
4072	msedge.exe
4072	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4072 msedge.exe
4072 msedge.exe
4072 msedge.exe
4072 msedge.exe
4072 msedge.exe
4072 msedge.exe
4072 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4072 wrote to memory of 4196	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4196	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 3528	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1108	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 1108	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe
PID 4072 wrote to memory of 4052	4072	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.google.com/youtube/answer/6276924
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff29d146f8,0x7fff29d14708,0x7fff29d14718
2⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
2⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
2⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17307105444589130456,1959209278299666601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ef2ab50a3d368243b8203ac219278a5d

SHA1
2d154d63c4371354ff607656a4d94bc3734658a9

SHA256
2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

SHA512
4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
c2423346be5d1a28fb4e0fbd4c928b63

SHA1
dcfe2c5e9515a69ba275f8a657a0e9a6a5b9b642

SHA256
61167b5f6439173ac034267675051237a21b26b3b1fdcc70dc0fd7e6cae2a1c0

SHA512
3df9bd6c7a40d44462a8845bb76b84380503df2e334c2e1990dba42331c9bf1c9460936ba366c6e3b80886cd1cf23727405db3d46a059fe2a49e5763aab18c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
511a87d0c7927182c14bbb6d86d35af2

SHA1
ba6e04f1cbfe8be5e162c0b10cefda677eb97702

SHA256
1617df2c36a0629e7fd55d8c4bb8de8b0a0ae02c58e875e9633b9a3b10dd4f26

SHA512
454a9c4b52dc704e5f1ca014b1b3582c059c57a5a067722d3b82ce244b35563d4a2714331c636e07eba9cacbd9ff2540385893abc1798ee0180d63131f993404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
3e20ff4e6c5dd7e1faae02dff88eb7a1

SHA1
15516676a8c5471f510489946dee107d6221a8db

SHA256
6a2c241db2569ac1e8c1ed6c5bc88ff23b20d8d0570ddb3f91959a7400a27d9c

SHA512
de6ea5631ab77489a9248916d4e73387f69a1f30d9609521aa0c780ee8dcd205894aaa5587a90d7d07d310133897055acad07ba1f799078e6a87b55b45d9e7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
40e697fe8b885da1cff33bafb3c155b5

SHA1
4c065c0a65af706dca878c899d43d0813106c5ba

SHA256
eed5b0ba668b4be354c66fd769bc1d308ca6deb896103769ab558d625d039368

SHA512
d27a2d01d7dec681de429edcd70d0815ca97fa6c181cfba974af46450a692117d09fa87d5860942a6eb8a257ea9a182a7d412a564cee2414c743663cf47667d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fe8090f9356b0662c36c8ace01d282ac

SHA1
2252dec41bdfacaf2cacd82b6787d96281bf1cbe

SHA256
00ffae9095019473c1084f1c6ed141ae2b1aa36672b16a9f180796ef89647a57

SHA512
8613f6feacea0cec800630cba23669fde79afdb7b5ec7444e9a03af535b471548ec6f32907ae84c6b42ed523ae101ec3195b4a91a02124367e561aa05a1649b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
bf38e67347aea6d520cda5fde321a1e5

SHA1
0e7a8def4c923201d76b41dfa9918bb1052827ea

SHA256
0f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025

SHA512
f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
73bad42c6469ca83d853eab386a11a4b

SHA1
3692fe06bb620ef492281e2899dfa15e99f2eb6f

SHA256
b3a0a2e28dec842d3ccc5fb4e094d49f79d81c026d711baefd866e4e1b27230a

SHA512
04a6e20f35dd09b5c44726715ac64f50863ef6034ed52460e7a60f7bb373df608cc76041b34defa37dd305a3eb9f71f86524611ba5656511231213179e428d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3f4305fec119f9a4efb88a848faf994a

SHA1
09c7877c05284db4ba41eaa1e82da5c053444183

SHA256
b6630008d6edb8967bd23bcbcbb42356ad3f406ecb68b69d78ba547a5b4e495f

SHA512
3b923fefee28f67e6f866dd5f8c1de5e006d2f012a78803e64d53480bc197d6f80798ace6b85db86d2c9535f04112e4229c2cb83cdccd0a6c13ec9416a827232

Download Submit
\??\pipe\LOCAL\crashpad_4072_WAEEJMOBIUNIETTK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit