Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240319-en -
resource tags
arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-04-2024 19:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qptr.ru/OqVS
Resource
win11-20240319-en
General
-
Target
https://qptr.ru/OqVS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 3548 msedge.exe 3548 msedge.exe 1300 msedge.exe 1300 msedge.exe 3408 identity_helper.exe 3408 identity_helper.exe 1596 msedge.exe 1596 msedge.exe 1076 msedge.exe 1076 msedge.exe 1076 msedge.exe 1076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
msedge.exepid process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
msedge.exepid process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3548 wrote to memory of 3508 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3508 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 3180 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 1300 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 1300 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe PID 3548 wrote to memory of 2856 3548 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/OqVS1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8352c3cb8,0x7ff8352c3cc8,0x7ff8352c3cd82⤵PID:3508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:3180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:82⤵PID:2856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:1852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:12⤵PID:240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:2532
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:3492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵PID:2888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:4672
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:1288
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:1548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54113e45804b7888f88ae2a78482d0951
SHA14c59bba45c65ba65aa920cbd4eb0d7ccf517a220
SHA256174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db
SHA51216355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e521eb4a4c2bbe4898150cf066ee0cb0
SHA1c2b311b8b78c677b55a356b8274197fdcbae8ab5
SHA2561f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3
SHA51259e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
384B
MD5a23d2329f32e4088d748f26fcf260085
SHA1ad93b122f0ab03fdd490228112f56d75c8de266a
SHA25695e494dcef480aaa96aa5eafa028ed58d2dbcc3a18aad25730784a046b85b150
SHA51239c8ca6a99656ca3bbca73b43f1dfb52a47215430c6a6399db727ca174c7ce3eff69fa94a9e9bae39d2e9cd483405c73e6730b2aa65b17853eb575c3d4be2df2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
672B
MD51092af2e6586e5863edbb842ae73930c
SHA17fd892047e0c25831761ba23cf25dca1cfc91c3a
SHA2565585938ee3539b4768095c12622d747f9a7a9b669afdb78348de595a252d9adb
SHA512df209dbe22c6a64d26e123520a172352ae949dfd215b13a61ab2f8350570155ab05bfb88e30e7e13196f385918cabfe24c8c58ff5cc4b1111a7a03fc187324d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1001B
MD50053c0b5e8edbe64b0880b833dc387ff
SHA1e493c1f2096e368a09169ba677cc47226cce175b
SHA256182ae70a0f8f53461f5a9bfe22b0457666049516e1e58d887ed0ce4e2d2b2aac
SHA512aa2ea2a61818e28d9983c6bf951c28638d3b4c978d7fe2488701d22e45bd28c967a783199e4b909b8666bbe720dd2343865f814344f32e009ccaed19ca382baf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD59c58ff339eb6bd40f97711353d6aafff
SHA12d8a0a8ccf2808bc32ee9b43ba9af133a80c33a1
SHA2560451f6ae54f57ed7dfc18613202f21659302910ca3bd326d32dd15c292847bac
SHA512d47ff6ef1b1853a7c6bf4c7d1e14863b3c692d99d48ae9414c098fed512d1cfdd804b214ab57f89ccc1f98328e89d420f88b5fec95054ee883d8c12c41381f22
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD532dee0037e0adaeeba996ad1d254504e
SHA1f9b26df02d25c9c2c3a712486c8fe18882c68cdf
SHA256ea4b4b0ed0d490fd4b832cbeb59e9ab3cdb7cdcfe96284e8f6b74cea0f0b5477
SHA51263028ca4dd7909c3a82b0670963b5c0beb694e661f664d2911dd0602a57a72a260b9df37cbea20f3f87bb0744022ec70f9e08110d1bc9acbf1a09d27196a2b24
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54c48395791ff958f9481bc52d18d39d0
SHA1229450a8f5308963407e139476e511f24be7c4a0
SHA2565977fed8aaa3e20445d7ec757de4c5967e5ba9ea1435da14775cafa284183cc3
SHA512138f02a6cc64743ec62dd24be0396125083ab2c88c29dc0ed7cf021d145b0bdede75e1999015648d894acf78d290ca53ef2123af98678e071e6d067b340e4b0a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c9cd5943186764d28d85b3b1ff5bff9e
SHA19b814d1e51583e5cf19e8bdff8263a1300e2122d
SHA256ed8072a0ce229b796449adc4d81d3129f29ea2a242b773485a85e985fc830ab9
SHA512fb544a5f5a0f20fd9b7ae4b52403aff810ac4dc9b513d187b6ad9f1dbadb7e27f79e835127739ee36403cc7c0e6daa26c2311d8a2c9847318c228117a1f89c22
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5a39e7746081de74ed86964974e75bd10
SHA1be95e0db2f02095be8ebaf2dd71efe6c4a2864aa
SHA25630f165da630797442947dd800c9479311a3c2ef6fd505a1d765ed15644d2ead0
SHA51278584cbb374e419280ea719b9c55cbb1d0e81d066ea6f4fa904971044ccd439d4c203e30899bda340b556ce749df2f56669d0a5b46e5867708683c66a521c2b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5a65a908be4a23a6a9879bb44c8c92cd1
SHA15367e3bed941c50cb73fa078ec9e8cf1c0118cce
SHA256fa6e79e240e6ae06f0ca3a48c1e5e39a0c9f875039e84db1bc1870a4e60bdd42
SHA51219e5cca26c5bda33f01f2a584ebd81877f03b85319022fb0fe12b12c3400db2f6cb2cf0a6b89c2c607761ec3c03458060c51fefead125c88ade6f99c57d3adbc
-
\??\pipe\LOCAL\crashpad_3548_XXJIOKMIGORNUGVTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e