hxxps://qptr[.]ru/OqVS

Analysis

max time kernel
151s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
11-04-2024 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qptr.ru/OqVS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3548	msedge.exe
3548	msedge.exe
1300	msedge.exe
1300	msedge.exe
3408	identity_helper.exe
3408	identity_helper.exe
1596	msedge.exe
1596	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

msedge.exe

pid	process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3548 wrote to memory of 3508	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3508	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 3180	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1300	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1300	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 2856	3548	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/OqVS
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8352c3cb8,0x7ff8352c3cc8,0x7ff8352c3cd8
2⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
2⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
2⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
2⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
2⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
2⤵
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
2⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
2⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10789545251010329030,3757323805044688087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4113e45804b7888f88ae2a78482d0951

SHA1
4c59bba45c65ba65aa920cbd4eb0d7ccf517a220

SHA256
174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db

SHA512
16355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e521eb4a4c2bbe4898150cf066ee0cb0

SHA1
c2b311b8b78c677b55a356b8274197fdcbae8ab5

SHA256
1f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3

SHA512
59e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
384B

MD5
a23d2329f32e4088d748f26fcf260085

SHA1
ad93b122f0ab03fdd490228112f56d75c8de266a

SHA256
95e494dcef480aaa96aa5eafa028ed58d2dbcc3a18aad25730784a046b85b150

SHA512
39c8ca6a99656ca3bbca73b43f1dfb52a47215430c6a6399db727ca174c7ce3eff69fa94a9e9bae39d2e9cd483405c73e6730b2aa65b17853eb575c3d4be2df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
672B

MD5
1092af2e6586e5863edbb842ae73930c

SHA1
7fd892047e0c25831761ba23cf25dca1cfc91c3a

SHA256
5585938ee3539b4768095c12622d747f9a7a9b669afdb78348de595a252d9adb

SHA512
df209dbe22c6a64d26e123520a172352ae949dfd215b13a61ab2f8350570155ab05bfb88e30e7e13196f385918cabfe24c8c58ff5cc4b1111a7a03fc187324d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1001B

MD5
0053c0b5e8edbe64b0880b833dc387ff

SHA1
e493c1f2096e368a09169ba677cc47226cce175b

SHA256
182ae70a0f8f53461f5a9bfe22b0457666049516e1e58d887ed0ce4e2d2b2aac

SHA512
aa2ea2a61818e28d9983c6bf951c28638d3b4c978d7fe2488701d22e45bd28c967a783199e4b909b8666bbe720dd2343865f814344f32e009ccaed19ca382baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9c58ff339eb6bd40f97711353d6aafff

SHA1
2d8a0a8ccf2808bc32ee9b43ba9af133a80c33a1

SHA256
0451f6ae54f57ed7dfc18613202f21659302910ca3bd326d32dd15c292847bac

SHA512
d47ff6ef1b1853a7c6bf4c7d1e14863b3c692d99d48ae9414c098fed512d1cfdd804b214ab57f89ccc1f98328e89d420f88b5fec95054ee883d8c12c41381f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
32dee0037e0adaeeba996ad1d254504e

SHA1
f9b26df02d25c9c2c3a712486c8fe18882c68cdf

SHA256
ea4b4b0ed0d490fd4b832cbeb59e9ab3cdb7cdcfe96284e8f6b74cea0f0b5477

SHA512
63028ca4dd7909c3a82b0670963b5c0beb694e661f664d2911dd0602a57a72a260b9df37cbea20f3f87bb0744022ec70f9e08110d1bc9acbf1a09d27196a2b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4c48395791ff958f9481bc52d18d39d0

SHA1
229450a8f5308963407e139476e511f24be7c4a0

SHA256
5977fed8aaa3e20445d7ec757de4c5967e5ba9ea1435da14775cafa284183cc3

SHA512
138f02a6cc64743ec62dd24be0396125083ab2c88c29dc0ed7cf021d145b0bdede75e1999015648d894acf78d290ca53ef2123af98678e071e6d067b340e4b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c9cd5943186764d28d85b3b1ff5bff9e

SHA1
9b814d1e51583e5cf19e8bdff8263a1300e2122d

SHA256
ed8072a0ce229b796449adc4d81d3129f29ea2a242b773485a85e985fc830ab9

SHA512
fb544a5f5a0f20fd9b7ae4b52403aff810ac4dc9b513d187b6ad9f1dbadb7e27f79e835127739ee36403cc7c0e6daa26c2311d8a2c9847318c228117a1f89c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a39e7746081de74ed86964974e75bd10

SHA1
be95e0db2f02095be8ebaf2dd71efe6c4a2864aa

SHA256
30f165da630797442947dd800c9479311a3c2ef6fd505a1d765ed15644d2ead0

SHA512
78584cbb374e419280ea719b9c55cbb1d0e81d066ea6f4fa904971044ccd439d4c203e30899bda340b556ce749df2f56669d0a5b46e5867708683c66a521c2b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a65a908be4a23a6a9879bb44c8c92cd1

SHA1
5367e3bed941c50cb73fa078ec9e8cf1c0118cce

SHA256
fa6e79e240e6ae06f0ca3a48c1e5e39a0c9f875039e84db1bc1870a4e60bdd42

SHA512
19e5cca26c5bda33f01f2a584ebd81877f03b85319022fb0fe12b12c3400db2f6cb2cf0a6b89c2c607761ec3c03458060c51fefead125c88ade6f99c57d3adbc

Download Submit
\??\pipe\LOCAL\crashpad_3548_XXJIOKMIGORNUGVT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit