hxxps://medicare-user[.]top

Analysis

max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
15-05-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://medicare-user.top

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2324	msedge.exe
2324	msedge.exe
1456	msedge.exe
1456	msedge.exe
2912	msedge.exe
2912	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe
1456 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1456 wrote to memory of 1140	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 1140	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2092	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2324	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2324	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe
PID 1456 wrote to memory of 2784	1456	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://medicare-user.top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffe18fb3cb8,0x7ffe18fb3cc8,0x7ffe18fb3cd8
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
2⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
2⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12406750619064785178,12627976069684972868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5784 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
7bc6da2aadcd32960b0cecb45e15dfa5

SHA1
b4f2192a3b5421debe34a82745e71a4c00ba6d58

SHA256
19839e62896dfd4fa43f13a13d69d0a020ce6bc2cfbee79c7378f73cb08ff590

SHA512
f47c1b9a56f6bb9a94931671556f061ab299ae5af885f00a376fdf52fcb81ff5dc15f1691145e9f16fbb87f185de676babe53c758e50a65d9edaa21e472dc77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
e88c0d47b5bca2d3c4dbcbd3b73b71fd

SHA1
b140894596d8c3ddb0400a5c1f6924d538746be2

SHA256
2d669101424825f97c899233b73c1266d43390c16084d715d67b1901f0dbc7f7

SHA512
e4560d1728c1677ec5c2ca32b17920a7e094b679c42c58acfe6bee99b32b26b93f5b370b5e6ac9b89c94a36853faf127f34afc503902f905e71af49741869235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
741e4d82857e4ae2658896ba453815a3

SHA1
78c3e93f5d23454150c29ee2ccef6e4e295d603c

SHA256
f76b1684dfccd2a50a64a01dabbbe8ef8a3f5bb8d87e4a73aa842422ce3afb75

SHA512
da61257495e0a074eb3640a843a4c9696e8a3211366353c485bfd66228b7997afe3dff20c96514ae91f36db54dff385600358285af7ba992c5f8d42225aa83ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5859bc9ace2cc33c803174f23bc3de94

SHA1
1c3b2ca99f8ed457f762f4234dc21e3e46f3f5d9

SHA256
a218d021aa0cec4b5f8d60509726413ed5edd6dfb1b1d6b66a4e77a1ab141971

SHA512
afa8c07bf67129162a91c28345d75a216673046cc64da18db46123943d7082f5b7e7e6580017350098b60d400fc23415163149f4ae9b940271ed1f0d666dbd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58e1557139988611922df9acc15112c7

SHA1
a768de7febe545d55406a151f21eb9e30e48ebcf

SHA256
4b4bda6fc62c439ecb793964f03da8ac3b9394e774928afd5f1f750c63f65ea3

SHA512
dbadf54d865aa0bbd24255c78536012497d62978c064ea2a5476798719017760d7a2423b096440154052302bdd46170f254ce9990eb119b22b81ed4ab5070247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34c60a85f44d24a66c8174670fe4123c

SHA1
ecb06b0e215483634e757b8e0770502cb93f82fe

SHA256
fd5f49a77653aeec06f19c8316ed62361cd00e708b5f591f2599d872396ab8a0

SHA512
1d3ed6100a33431b82cdf1841a8a28a3134f44acd5ca8137f142ab72afcc1cd81af2f5c63619050bc57a1d4b0c49891c68684144e0f4376f55757bbbdb9535d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
93a60c13ec42a0f2beca0ce7e89b1440

SHA1
a7d950fa9be96ae226cacc64988b1cdd450bb831

SHA256
15d9640be6ca8e44d07fdd03e27feac7f1a0684b53c33b5ee0c977e697aebf22

SHA512
72f92e47e5a038d37c628fba22a8b643dcd9cc48870e9fe0adaee395faa4d93ef9ab630d3e274a9cca8c51ff3fb57b183303e31138247e682d1b170c8a464748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587182.TMP

Filesize
706B

MD5
96279f778689772f531985e2f66598b5

SHA1
056e7cda67cfb8791e11451963defe124642e031

SHA256
f959e042dd5057e005b35c021a28a2674b2276116a34114dfaa368694079c056

SHA512
3758f4117281c9eab471da458bdb0ce4a407ef2bcd5b099e56afcb7d6ea2b984408edaa3d523e939b97d672d3089e875124dff96fca8ab3d0389a9e6b6695e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e89a6d47d13b18f3ece75d186f223a76

SHA1
d996ebaaa82aa1a57590f0553f8d3ad05727c99a

SHA256
0cd9fc673e70bd8249d48f8f6481f52a2a425e8793144d61a53ee9d18864c910

SHA512
5e0ce326a72feddfd2386d72264051fdb0a7fa7943f407e929c2c7a32773c3a1d07cf9f5e9745e15014eb18fbb2746e5a56cea0f050883ece48200b95708479b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
896235f889f167baace9cd8216c4cd99

SHA1
3b5cfe7289a285a3a73e75c8314ee68e8faa97dc

SHA256
385d57803249dcd5cccb9d11aa830e172d4c3f417b3a659d88641861f1636723

SHA512
750329ca99304b66f690f89e6d9949283bb06824f6b5a76e3040107a334ad637cf8ef08c121805727747dd78a467936c9e180abf9e5691dd1e6df6c66e2141cf

Download Submit
\??\pipe\LOCAL\crashpad_1456_NYBXYUISMBZEJIBG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit