hxxps://hurlurl[.]com/ArXEB

Analysis

max time kernel
61s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hurlurl.com/ArXEB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1656 msedge.exe
1656 msedge.exe
5108 msedge.exe
5108 msedge.exe
3888 identity_helper.exe
3888 identity_helper.exe

pid	process
1656	msedge.exe
1656	msedge.exe
5108	msedge.exe
5108	msedge.exe
3888	identity_helper.exe
3888	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5108 wrote to memory of 400	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 400	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1956	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1656	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1656	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1908	5108	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hurlurl.com/ArXEB
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb75074718
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
2⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
2⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
2⤵
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:5164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1976 /prefetch:8
2⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12551408666166456785,11267277416404059067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:5952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
6a999dd22b3d4445374d57df098eafd7

SHA1
7398946d3be34c517ca9ece375f01dae69d25953

SHA256
19c15183cb841db00409f9c9314a5bf633bac7b691c99abc8034844b570ff9b8

SHA512
6de160d4abc454f53ba20a4e1d137af9a53bc23292bb98beea9092fff1441bb6e754314abdc4529c59f353e2f5fa7e69840197c373aeaa32b36d01da62aa721b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
c586b186d4119efcfeb7da4775aa7e79

SHA1
70b181f1ffeb6b2f747440cce0451c6f7cf12df1

SHA256
1122933d4213d79fd60ce353025f0703ae7c7afe76b4d39aa3f3f6d4053b2891

SHA512
c99333714ede252fbed9b368cd42801d7ea34a942f90dd4841efe79ae210225ac1b3168fe6fb9d818cf491f2b58874b6d7ca8f77318b49d524c5e76a3f3ed2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
dfb30a034053f747e68b0f50fda11967

SHA1
69e1f41625a08008f709f34463fb460e32119f17

SHA256
9b79850488ea5877f7e68cf1aa342ed86252083706e38b0dcbbdd9568ceb2bf0

SHA512
8d4383fd2bf6fb81af3089a32a20f5c6e1c4263695d7569f354b32c927e13ddc733c40528543fc18f967da1b80ab30c33696beb7dd51aff600c3d6cc30c816c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
cd94fd581171a97902f614758b9a570e

SHA1
8f7625465597d6bdf0e101fd4a6312e30d538259

SHA256
168e81c06155e79d71ba58620c58bd0382c5d473ee3dab60df0b9121da26c5c0

SHA512
68837b8b259e4299160ab217f73f0f74a1e37cf2143bc553c3ac02966792285285f372e153354ef2b893c3a212baa5404d1570b96207f66be830473c75844e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9cac82e6644461356daf689d8b52b815

SHA1
9937353f55a7e543f06ffed8185dac5938de1b96

SHA256
dd7d1f0bd3b675e6f114aae2fe2d9da01562c6ae15eb4c50e7177b7975e2ce13

SHA512
44176faabf98e181fbbd0a589e0c002b6afceab4518fc54dad6e679d7269991fb17b41180292b0c65295fcfe1e9a007cfecec976ba5c945bde25dd69babce89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8a63f03e9e516976a449fada6b611164

SHA1
6572fc9196afb74ee802c0ca6bdd920e07df6705

SHA256
7506068cb7301a529ff2f3c24bd291bce929a03145acfb66898d9747edf5a2a1

SHA512
b7a4986f1692013c6f852cefd2e42b4b4b47fcbe74daa230b2ea7b3c7351ca621d7decda600635fcf7e65508dd16e593807df929afad33c04cecdee616399f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
a7307b5c64331c7e25ccedcf0958f0cb

SHA1
d4c4685a659b91022bbbdef86d14104aca2f1ac6

SHA256
0bda66a7a3baad2f61aa09cd03424d57c23d721e13d27b59397b4e46f54455cb

SHA512
4173dbe23be277f3b801d2873a6ef92bdbc081d79f5b83df8a27d0c443272990ee2a245e876700eb9ac1df0648267e6f0867b605754a7c3537c77c247c3f23d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a40a7877ffda91bc26bc66509f4930db

SHA1
44a672d80d172229bf0be270176199b59767216b

SHA256
1fa4d5725977ceec098f0b33c120f91df5c761199d188e6010e82b1cab7b7070

SHA512
f5d7aa4b120d4b87a1b75ed1c023307b5bb4ae2becc7472730b32d75661b8adf892184ff8ef19e132a2c27c8e6877aee31af88247ece6ab850cbb273f2373ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
708B

MD5
3bde81b9e5a48ae34426fa3c008a2dc0

SHA1
fe32be831c6b1e50b29cb6ff2ca6622141ff0703

SHA256
db203d125c634241e28c35a539c8a755b368112157734d21ba4e1aaf709cc9c3

SHA512
16c470055b9c29bb54ecb63ebce0989ad2d8f6a04df6e990902a52ec0dbca4f3e89e601bc7fdb4ead9d1bd2e601385845840e82ef8fd442edcacd64c398f0c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ece.TMP
Filesize
708B

MD5
1e2512ca884497d951938f575135dc11

SHA1
22effdc395b84ccd17168f2bd4e571919c1d4316

SHA256
2afc716352341861f91644c2c2402b4f8cb240c35c5b90d5907bd5851ca7d8a6

SHA512
9c3af0e5809c79ae3c4503be59fadb2ca612a212c2709b6229dbd06c00454a5381b0edc7fb66f6075bc8ea5624d4c0907b7ede51b8342976d574423e72bc8ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ff49ff8af2cdb94255984122e23cd611

SHA1
28888c2f829878908f0431cf8b490f74fa9074f6

SHA256
fd6a26273d173971376286b13218e7bcf06593a62d28e6891082b7458a669b5e

SHA512
5d318e242adc150e908eb5eb00b9e006c2f3244b90be25efb6f3e575687a54b88756d4370ca20309bab50eea6884e7a934598468dec8135c40b7079a345f9857

Download Submit
\??\pipe\LOCAL\crashpad_5108_PRHRNKPNAJZQTXMV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit