hxxps://qptr[.]ru/eUJ6

Analysis

max time kernel
84s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qptr.ru/eUJ6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

3936 msedge.exe
3936 msedge.exe
3196 msedge.exe
3196 msedge.exe
1176 msedge.exe
1176 msedge.exe
4184 identity_helper.exe
4184 identity_helper.exe

pid	process
3936	msedge.exe
3936	msedge.exe
3196	msedge.exe
3196	msedge.exe
1176	msedge.exe
1176	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3196 wrote to memory of 3232	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3232	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3816	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3936	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3936	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3892	3196	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qptr.ru/eUJ6
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe6bc53cb8,0x7ffe6bc53cc8,0x7ffe6bc53cd8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7601558369518089941,14486745956516348088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b4ef6ff-5c99-4cfe-8122-5c8cc13fe617.tmp

Filesize
11KB

MD5
e0f1c6f180ead6764d13e8381da0c5ef

SHA1
3e460551fafaf23eafa3322498a88c8878482f91

SHA256
226a31543eb10652dea3d3289a91fdef148c3e393cf822d047a55f0c183bbd73

SHA512
80d812f1696477d1ad0c14457554450547bdf03017c9375d5410e68ba58c1684783867a0aa02f13b56d7d0e9e2bc6cc5309d505d3b7f30973ecf04d1ebc65179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
fc5c1e1f6f5b08125532211fb588e530

SHA1
099244ef9ae63cece2fa53da33413d9fc774b55b

SHA256
101702ad7531cd720760fc87a85e0b4ded8a4534e15ef7bc60c965d0cc0c1a71

SHA512
12cadab4844f9b94655af7b17e39c328a26735f4a34da8db00c89693ad73c24734fc726354ecc157c8874898c7f11e9f6e9a45cf302063f10460d2160257faa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
714add0c52f9c30a380fa01c63fd3c78

SHA1
abcd6c948cbe3c5c68649ba2e0caa3e687115adc

SHA256
475f218c217cb1c0331689e8d8af205348b11a178bb89d7ef39a22bfac7fb823

SHA512
dfe8bc1053cacfd9b69158a896a68f86f179784666443136113ce72daf0a0cd2f7e427b675dbeff0328e5c01e3de64aa38f9a60db066b87632621b95f12e127d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
74b358fec19dd1768ae37aad18937538

SHA1
3a28b70390e456cfe1c2f53a4e059ac5d949d85d

SHA256
435fbd811f2709337064cf735ea32afafcb2d57f000eb17a30b1a54c63a38b11

SHA512
7f101c6c48d31eb6fe33b78991e3906a5f32442fdf62ab78ae45384cb092cec27e816e10492da44122a419a4b5c26a1781a3eb7cefaa06c0eb696dc6d9164a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
115b7b92ba880ae7015cfcfd4024f913

SHA1
befbbb430591ca6d038f6e6b666686e003bf0326

SHA256
8704d72cfc0f82287fbeabbea9310e0706167254734d348fa6085f97086718d8

SHA512
f30b89d60c2ae95950d20a763cf55e5ee525148709370a8030078b5873e069953729acba5a18b7976e38044d4e35c864337c5bc7ee8158e16da0309264bf2c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
44740698631c466eda54163347dff562

SHA1
7f7a6ab29afa0608b83b67c14b05f22874ce0b31

SHA256
e1d19eaaebba4725b907346cd6a42530d8cf008703054b088c44ba47e0aba5d7

SHA512
521d865b01e6e8d6a27e957f2bf004cc6412975ffcdd662858bf6e9b52f3e144bf490121e155358ec74b06322ae4df48bb4043be4c2cf154255fbd080f88026b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f729a28eb9d2be4625ac294b5dc6357

SHA1
7d812e1984bd9c22b058987a76ca35e53bc1c72e

SHA256
737e9f798eddf924985e97b77a0c73920b0cf2fcd37d7de399edf210cdd7b95b

SHA512
b4a5a1db79639f39f0fb2efd1b550edec5ed8214f664b2f1d2d7cbf7282804a410a0ad9581b1bb512c38256e891970912db994bcf2c3f66a274338c72443bc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
644679d0304efa02b391fe4f88da7ed6

SHA1
dbb1fc7196e083414ca6c9b5ac1a6162a6a58dea

SHA256
d403a28b4c4123ad742421ecb9d8ad2f647904e38596e0f19785ba742d09745c

SHA512
e9851c5219f81609750a146325c9390e72c9dcdc539b288379715ffef64c3567dc0d0c7de48e88a945d1761ab15a2844418a250df7329238d7f00b014b3f5a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f9f0.TMP

Filesize
707B

MD5
b151a61972dfb763f7ebb014014a961a

SHA1
2428fe280ede8ffc7bc6987c056fbf5ae4b412e6

SHA256
fa6e1ba382a49bfc0517d5d785f65bddc6fe8abff5843c9f91fadda6e103ba84

SHA512
327ec46b73199134f474be835f8ebcad57f7a65967b06bb2c6cc09edc19cd60a6ea26e5b28cbdf8dc44618c37128b830638df851628b6c87c387e840e9034fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41b001d9076ac2b9cb402e8e59a0930b

SHA1
6eb8eb0fc8b2ef92bf1cfda4dffe22e30a14d1d3

SHA256
6cd14995bd5d4672e0a5da2e84c3a619b4768f3cf196bc288be3976304b23fa3

SHA512
3a3ae78556a20ecad76c2442af1a381cfd19a6d2fc9cbef872e74b8e0602ca8d39121e380ce01cfaac9643ddea95cd5f962a3ddacf320987addcb5df332bc750

Download Submit
\??\pipe\LOCAL\crashpad_3196_CKPEIKDTEMZWMICX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit