hxxps://hurlurl[.]com/elfAH

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hurlurl.com/elfAH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

4468 msedge.exe
4468 msedge.exe
3912 msedge.exe
3912 msedge.exe
1360 identity_helper.exe
1360 identity_helper.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
4832 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3912 msedge.exe
3912 msedge.exe
3912 msedge.exe
3912 msedge.exe
3912 msedge.exe
3912 msedge.exe
3912 msedge.exe

pid	process
4468	msedge.exe
4468	msedge.exe
3912	msedge.exe
3912	msedge.exe
1360	identity_helper.exe
1360	identity_helper.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3912 wrote to memory of 2472	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 2472	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4184	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4468	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 4468	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe
PID 3912 wrote to memory of 3464	3912	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hurlurl.com/elfAH
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
2⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
2⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:8
2⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
2⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5255356876302672778,9711132889441699386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
d446e6b0fe0c966d9abb637346de8661

SHA1
2c2b640acdc3669a7e85cf9ed948e0a32b2696a8

SHA256
2dcd1f4b3f05fe9b018979c5b48653d4836f60f638a369986d11f1fcc841ac67

SHA512
9964528779b4b2e51c56cf9c4b176d81ef65205e8c220471f1cc97f598c1972038255322eef42d40a6f02f6033ca0379eb3b96c7ea0d411591c97fc4bed89f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
c8a42a86bcddd346ec58f27bda96864d

SHA1
666aa9f7d94900581a6c225f715284df76cd64a1

SHA256
1e4b1f628b1a186f1e63c720a27d3d1eda3f8dacf6a88b5a3d7ede97a221a82c

SHA512
c7fc07b8c8cbbbadd042df145fbd15480b175d7b44fcbb171f794c1c133214b34bec0276af230e48b3658bf8974927620616b80cf1d80a5c15eb5d853f357e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
384B

MD5
d92c98a05a14d8a06f1b98548c9ddb1c

SHA1
caee9e9a18e6a0f833fb1265b9125e472de16b76

SHA256
b3023a6c7530e21a4044fd62efd59affb81849559b3a0977206b25a8cffba5a9

SHA512
6e1de874dc7d9da08a61220442a65607ecb8096295b7875c1842c3d9b29e272cab52798ad958a16d5ff9cadd7552ed11805cf1199e5c59eff2963bac1bb66b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
0b0b4e0c395084d436a0b1cc6f0365bd

SHA1
a25ef03a9eaaf9e0976508125a8e21a9a12e2156

SHA256
b9ea4f87901bf3600068c7255e0075a1154f0b6b0db88d7e3768491a4366825a

SHA512
ed13fa9fe0acc921071595d06575ff0b752e21c4130d5a19d55b165619bbeba8e3b7a575b4070b8aadf7ccd5cbf5dabc1eb85f621c9529e4a955706aacb27a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
755B

MD5
a0c14ad0c1254d510bce6b568f4cbbe5

SHA1
cd02135189443e127f59130874965eaa51e5cfcb

SHA256
0b15f8c5eec1953cfce84e54a16ecba0c64cd01383d76589210f8b7095582009

SHA512
622a747adfbaa043d2ac338e441ff8ec3d0676cdce729f7ced6785af5f38d912bbeb888f32d1ae2a2557a9ea41ca9a2f72118214fc2a492665f4c336005448a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
786B

MD5
0077ecae21ee9d7112c50ced66fbfdef

SHA1
874f24b106a3b8128e4283d06fe96a9e3221cc4d

SHA256
7a3ebcc1f87aa634d4b99a5eb7acbcc87a2e53c7492e6c2b28465831ad4d2f70

SHA512
7ad3339b67e67100ae1ec2f01f6778645f1cde2a9762e062bba1199d0f02dda4ebe74ad429e22e7a07fea79944649876246b23cf47341c4e97b64feaff13b4df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
241b06979c44f66e707a68010151db1b

SHA1
137aa0ef1f611fd2c60d3e3c962c8719f36df454

SHA256
41080e6a5839a7b3abfa06981bebd7baa0559b46c50a371b2a1dc18e6050dffb

SHA512
4dfe9b2078fa01205506bf038eef1284d99f2d2b058048d273619426f4623c1ca66e2ea1c54bb05187844a07843177ddc098263e66582f163e5fa8b316310428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e8e02ed99d456522434b27f3ff0db365

SHA1
14e9a747b8147fede9c1c8ea47e254f07298fbc0

SHA256
4e7468c95c881cfa51ba7962c346e1bdf5f49b476d02615ed3199850bd6ecb5c

SHA512
159397300208d1b3f5c28a5ef4af2d59cb466a2e983a86fa114c4510ac0727456269079138035098c3ecdb038a11d76a8e587f0c715cc4045622d0e1498fec11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6b934a49d2115bd4e38a9d8efe899eff

SHA1
28e598cce108a977f432592dba9732e0e0d1ecc2

SHA256
0549eb2ef3af452dce8326954c209227ce80bff06b07a3585f4dbca23df74d8a

SHA512
8d925da02d91381811bd016c6fd3eec4404b44796e8778d3e90cc735323c9668be28097d0046479baa7517e5abc7a20255e68ab61d02038beaec19649c8623a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
a8a2afb67174c888da46ee662d0e519e

SHA1
bdb90f664dc0a328a88914bd58047124f9c50e9a

SHA256
6b96607268e58cb4f8205d09a66e2591e61675cc9ee35d8eba1cba526613bb3a

SHA512
b5b46623ad48c6f12cf7fcc280af962b5922ed3e21e706103dbd70c3340cedd69ea995ee4699bae82a674f2d4e1076f0aa7cfb7947441374f1b1bfa481712350

Download Submit
\??\pipe\LOCAL\crashpad_3912_BGLVHXZWEHEHXLRR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit