hxxp://uretskyinvestigations[.]com/work-related-form/

Analysis

max time kernel
72s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://uretskyinvestigations.com/work-related-form/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

564 msedge.exe
564 msedge.exe
4452 msedge.exe
4452 msedge.exe
1108 identity_helper.exe
1108 identity_helper.exe
1372 msedge.exe
1372 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe
4452 msedge.exe

pid	process
564	msedge.exe
564	msedge.exe
4452	msedge.exe
4452	msedge.exe
1108	identity_helper.exe
1108	identity_helper.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4452 wrote to memory of 4540	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 4540	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 3144	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 564	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 564	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe
PID 4452 wrote to memory of 796	4452	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://uretskyinvestigations.com/work-related-form/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe01eb3cb8,0x7ffe01eb3cc8,0x7ffe01eb3cd8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5447480879973045182,14835118652739529956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5b1e7ce20b96b4b3151f3f18ce8d9cca

SHA1
f4d51f25d68baad822feb5b5d706d6f906b0ae2e

SHA256
981c73f26725ceb9a1f3a017b9386aadadc596014027fb7860353082ca6df2f2

SHA512
705f94ca06e65bb6029d5e9b770eb382601ba3e2967239815f596ef314b3389b7a007e3057bad8979c3a36c84a3a9efc6b67237c5a08f26f109bb31b2dbe95ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
18692903b742024eff5dd294109436ac

SHA1
1a53ea982aa4fe25f74070ad2eb07abf90102890

SHA256
f51d63742ab69a50ede423479570eeae6800c58ff43071fc30b2f29906bd4e1e

SHA512
cd31a245be240eb31015c4933163b39fc50a332de11ddd12998c2b719526bbd362c95433ad979840cd4ca22c6d3b2c1a805c175b8376675e7578e6d91a004db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fb874291372878d0c81e9a4b560d0ed1

SHA1
094a1cf4368f5db1943b2c52a0d906d88610e55e

SHA256
a2f6862b590d56549667fb70c6112d44c674dee7c7838a3881aee44b6096b5f4

SHA512
afd931301e4e68b1062e70e10f107295534d084dd8aa915d190e47771fc6ff17d38811970a0dfd520fbed38c069912a5c9ef4ffbd37ecf50de3160612c94c688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d1a3032acbb0e532c0b98291c047dc8

SHA1
d2c099788cff5d182a9d4ff943a628161368e80b

SHA256
aab01dbfb402551ffeadbe8cf4354f54f884dc0443f62e26b2cce1b2477dc845

SHA512
596714175ef042b9933ceefa6f418e3dd51aa69503c693e6576c3bbc18be19547036c3219745ab1469459e9c76c9b430e8de332e0521989c7bd2fcb9de3aef00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f55110ea2a9d3fd2b81342cf1a3e975d

SHA1
cc457b8c09c2fb01b71d8bf91b6d39ad7ece1921

SHA256
17ae1e27ddbbaf5aab4535ca8251900e6fdc3d440946e07b374448406364b3eb

SHA512
bdb72ad25ec7396aa25bf5c2d24275f2dd0d686690d634160b494f59d1e00e2b73d7f1ad3788657885e9f3d5878fd9bfbaebd98ad757ce42ed15f4adaa375104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4825b5aa98ce1723d9876d96a329679f

SHA1
603d8c5b99b8a3780630b0704e9d48c29be251dd

SHA256
1db8b665c99a8f55954a0cfdb8f4465105f55bc1dc4037efc41b12c9b48239ed

SHA512
bb88714a1e8ff0318eb71e0fead96c14ef8163a3141bfd26147d3ed68b01f650d3aa63d3f608df9afd90ca7a38859a0c3237108a1f33725ab486aec73013800d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
096d798c2042e4b130493712b11eb2ea

SHA1
5c1c108082e6b207c3e9a5b73fca104da4f20ced

SHA256
e9c8a04ba162ba8c63f5cf103ed732333432538776dfa5e215c5a4691057a150

SHA512
c46a9041d8e9a51e0ef114e0baba0ffa1d03e366447aeb637881889483638f6e73f48d7fa293352e1d22a2fc96eb9f3f734ec6c343bb21ef17af219167e81876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580b36.TMP

Filesize
204B

MD5
489cc9cee8f352ef64852747cb296a0a

SHA1
5160d5de98a989be52b7e6dc3699813b18b5646b

SHA256
4f766f453557ec793dee27c3cae0999d04a6e07c749fb908e9bcfc830d41540b

SHA512
c20db78270bea5084eb230d947e2fb401e0cbb43eefb5bb197b0b646e7759650bcf8e34b9b302f01b8e9e9696e97bb7affc486a463094dd09370b32180954af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe82916ef3b3fe15e9ba6a806a5f9934

SHA1
e119b3ac1758fb62e94af4faf8b29cc23104abb1

SHA256
99063f80733b861f917ce25e773f498c8e57ee8ae5cd349b2218e58285e28f47

SHA512
6cb282d0470950dd4058f12abbd687298204e8a419a1c2c08e12a6950dcb7ceec2c6b04e1000ac5c39a1a105eafb5cc1b9e5522cb031e3f6b36ba4b1de900295

Download Submit
\??\pipe\LOCAL\crashpad_4452_RRJLSIIWYYSUKPZO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit