hxxps://tinyurl[.]com/updateseragam2023

Analysis

max time kernel
296s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tinyurl.com/updateseragam2023

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
740	msedge.exe
740	msedge.exe
2340	identity_helper.exe
2340	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3008	740	msedge.exe	82
PID 740 wrote to memory of 3008	740	msedge.exe	82
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3380	740	msedge.exe	83
PID 740 wrote to memory of 3564	740	msedge.exe	84
PID 740 wrote to memory of 3564	740	msedge.exe	84
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85
PID 740 wrote to memory of 4520	740	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/updateseragam2023
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff942d846f8,0x7ff942d84708,0x7ff942d84718
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5213038538509739570,15297384175919635480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
30KB

MD5
691a8d68c2156b314142b8b43208609a

SHA1
3be7d9dcf4592433e67e284fba8edab274bacd82

SHA256
a7618a91af9831c8cdf5863b4179236ec332904f166b2a3d6bf41be9f87fcc37

SHA512
d97b30640c248bdb3dabaca3f3746e3a6f55f0363ea60ae6a43c615ae5ed310e3e16fdd1a828409c539feafcb2f5ded4dec75a972972d1fa67d19f63a43ee392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
21KB

MD5
affc2b93a9fc23bbba65931b19b1e12c

SHA1
a175097d2aa7ffb4b54193f197f296ab57967308

SHA256
1c383d5958a56ed0858150b049c83da4d4b31a4ac05314ae9a4f623933a3df25

SHA512
ebcec84bed7e03d99f02ba97e8a6bcfe157b2b1a78399f1493f8ae5476f7550b23fe6b1023d7c19b89d56d2ab8ae51df4284d0f8ab001d86acca019f30e97215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
17KB

MD5
7916a894ebde7d29c2cc29b267f1299f

SHA1
78345ca08f9e2c3c2cc9b318950791b349211296

SHA256
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

SHA512
2180abe47fbf76e2e0608ab3a4659c1b7ab027004298d81960dc575cc2e912ecca8c131c6413ebbf46d2aaa90e392eb00e37aed7a79cdc0ac71ba78d828a84c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
c1fcb7e59af8adf26b6c3cca6f4c6c61

SHA1
8d5d1d90bfe5fff119cb953641f321ee9992d478

SHA256
6faab12566bfc2335dddde69797aaf24af90efd17aa54c891569570b2b35096a

SHA512
2a89558244ac95dee64117ed8ace33b8e73b4835b5df186ad1b77fcdd9e196d86f69ab31e56f8d5560d3d89de1799b1b74facf0a027880d7aa82dd34f2497505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4f265c322f71ca805b42dd803435f4d3

SHA1
a06cdb4c257f1ce7b6d9c70efa248461c282ffa4

SHA256
b8f31f114f746780e0690c59daa98c94829377b793f9d040a15b29486810227f

SHA512
21f7112db1595c97c8218d05e7e600d470f4022a195365c9347056bd786387ebc70e7a4784d6e0332a3cce3c0fac42968d99525f0664e48bc7b182fa8903ca4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a923714645d7816c94ec78fadba0dcbe

SHA1
ee43e3dbb72b40ed620018403e06f8c2c653b978

SHA256
f1d8bf82bb33f77e5b3888bc8be2e0749f2fb81d4caab33685ec1f667a3def2a

SHA512
650aca9704cb1ca2e5292cd407f46d699814c565d151280ecde151df798e74a02a113ad1022bc46ebc8b8883d86f5358b31111212b91c2372f5a0489f82493f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19b4b6b202ec0ec12e5dbc0d5e39b5e7

SHA1
29a2aa6bbed7c83bc8999d9821c8526fe7923e4d

SHA256
9dbaaee04c172c8a2442917f23e28c31cd25c39e5d39d5c8beeee46a6f6e7464

SHA512
dfe848b35ab3ac2c2755adceaa8fd4438831152855d51acf649fa09b9f9c54ea9395699cfef58bee4aa8387d349f88d729daad751fcbaedb2d159d9722cb2ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df45c93e8338dadbb06eb513a7bac490

SHA1
dffa29ddc7881425987336d816f07d171e9048c0

SHA256
20da469e5d6f9575b0ebcda741430463ff25cfccd69f435e6062a25aaed5e184

SHA512
619c3bbdcacdef198303fee679cefd00c1aec3625b41dcc47d452e24a72805fab7cea6dbab1cf87544bc9c1581030388ac7e41100f9d243c8630b605f2319fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d50359b38701053f62f3c0017b03e15

SHA1
845287a074b4921d20b58e3a7e18186bcb0efbac

SHA256
50994d2d510706e50d128f533700966b2e3b4e50440969aec6bfe28c832325d5

SHA512
af3fde92fdb062ad85407d1f420503fe6806f72bf34487a8bd94cf0149ef646d2113be7bb462a7322c94fcc11f541f6d8151a0010d1f7919bb728b26484dce17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d0485c1feafe4ba4106ac7b8583832e

SHA1
7dfc22e842810223f1ee19874779ccb0c5bf3e89

SHA256
15e62087af828a39d03763cd8b9786f17e155f63eb455f62e5e8e173c8a9b077

SHA512
3fa18022039f573530765a7b235a0962ed8cbd1c6f04ba5131b9e78d6584e37561f8060a46e495c6c8eb6d467a7422ae31616c5464563e8f18a8659dbe27c7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f76486890f4bddbb5fdebc61ac813361

SHA1
edad3ea5ddff9498f64bbe9cb3ce32706c1c72a9

SHA256
f2e6ac4996822c17e7bfc402b05c0fdeebbfcb3410d5708909f50de9fa638d30

SHA512
1491583db78da032ec0b932dc09c5953206f71a2500646fcea169d42fbfb3970be08ac8db6743195c8c2092297cef4e71b401123ba5fcb049e104714a273500f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b5f924b71edf36b11d2d47f9197c3bc8

SHA1
733e182eaaa530d9661843b4c8405aa844e7d0b2

SHA256
329aafde0a5622e8b0918c5827754e188f0a64bb7493dd599cbe0bd859f9861f

SHA512
6641ceec9fc1eee3019d42fbea8cceeca14d2051c7f268ae2351760e28139db611fe7837c65e71e9b5781313f9d01be9dd97efbd43ad76f65c38213a43fe15e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f11cf73be6d9547b73403e0e99582f37

SHA1
232572b4a36dad411c3e2ad23179a6527618af6f

SHA256
0d430a48b074993c686a938fdcc0fefd08e583e8b082b011dbb05a51537d1622

SHA512
6d024fc6299021b19af77ceca10fc107a426a825e8188ce575c8cf95f161f19b59aefcc2af41a7532fe59b0cf450ba81671efb4ff94a23f809c307737b5d6daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c68c.TMP

Filesize
1KB

MD5
d94979715add4934a2862a6e6e650850

SHA1
7ba68838c19569a8f1f1f2f91b73aa18a7cd0bdd

SHA256
c3c86539a1df8bb564e9cbcd20e33b22200f9909019b7e4d195952a00ecb1581

SHA512
42fd42eb6c222169c3a8f5554651e83979981259c5ef33f054345dfc38635d12a47dade9718c44ce99b1526759472dc65313cd82942412efbe28173eb56f0ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41d787448b8a0361f04b0cb0aac6d467

SHA1
7a445f1cc6176e618f4e0485862ddf0df7761dd4

SHA256
379cb4ce0fbf0a30e9e1ac6ef674f50d91cc509699ef4be52c065291154005c3

SHA512
4b23b0be813f9dc0b4267216e728f2137432d86ff5cae8248a390df07bbc0e4ec4da697e832af80edd540a8c4f6bf09e935cc7afa3474199804ee7be1c50ba4c

Download Submit