b43e4546cb3217813def9ed74d6a4ff2bd4834b45db07f028224651fe6f51e2a

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2025 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SLC.exe
Size

3.1MB
MD5

2c56b24a18d5432ed532e86810a26ffd
SHA1

3dec2f4e0b2cd11847d777bda2c200372992bf31
SHA256

b43e4546cb3217813def9ed74d6a4ff2bd4834b45db07f028224651fe6f51e2a
SHA512

3adf96c5acf2c4fcb2bd97f892b6ca8c9f9d22f1213e893499ad5482dfa23369fcf65fc1ad3267677907abd15839f95da439e7eca76b70225b4f1d33337ac852
SSDEEP

49152:VvEt62XlaSFNWPjljiFa2RoUYIP08I5oGd:VvY62XlaSFNWPjljiFXRoUYIP08a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
2096	msedge.exe
2096	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2096	4268	SLC.exe	88
PID 4268 wrote to memory of 2096	4268	SLC.exe	88
PID 2096 wrote to memory of 1460	2096	msedge.exe	89
PID 2096 wrote to memory of 1460	2096	msedge.exe	89
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 3516	2096	msedge.exe	90
PID 2096 wrote to memory of 1532	2096	msedge.exe	91
PID 2096 wrote to memory of 1532	2096	msedge.exe	91
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92
PID 2096 wrote to memory of 1224	2096	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\SLC.exe
"C:\Users\Admin\AppData\Local\Temp\SLC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SLC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xa4,0x9c,0xe4,0xa8,0x108,0x7ffb91de46f8,0x7ffb91de4708,0x7ffb91de4718
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6493263984394812865,13964616504361338180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4368 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SLC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb91de46f8,0x7ffb91de4708,0x7ffb91de4718
    3⤵
    PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc29044ff79dd25458f32c381dc676af

SHA1
f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

SHA256
efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

SHA512
3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709e5bc1c62a5aa20abcf92d1a3ae51c

SHA1
71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

SHA256
aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

SHA512
b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1b39159d0d4910facdfeaba1d0a613d5

SHA1
d97d2c5fd8446d6f8980e8888d3e1620e315b074

SHA256
e31e0ee9daa614be8d16ca5c5cd6e1298f01847a47fd0c3b91432d8b2b9933c0

SHA512
b94c767e81724424e3f7c1512ca5bd489382a9296e5277818cd0d7b624fa985fb66536c0aced20a856c3dbcad4371e979196398da571068862b54a3598e44755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13435d512f1ed480bb7cc9b5b95d43b6

SHA1
1e052a4c93b358097789863267686c1cb80cbc13

SHA256
335962e2644f59d36fdb8d77bb8aea6ce2e962f2379cff062ac6821be98d3f9e

SHA512
c4f2ffb297559674ec879d5aca2837be29ce4edf428fb83bc7f0ab43079ab751a72aea3443dd17f4fe9f177331dc768f0298f0cfb819cee577464f2f2883f5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d814ccab7b36e9bd1fedd06ddb28eb4e

SHA1
68f0bb055ac3476e4afc282574a2b0ee4d8a4a16

SHA256
990ab9ad6638c628c7435406f7975076e1bb72456d1ed0d871945674e277421a

SHA512
10709e3a4158bfe0f66eca05468a5e4ba6de8b4584446bd44306f36342eee2038477e50688f0e965b71affd22d0165afa6bae727af4db9a9fbe1de8fdcd0f5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42e9a437636186c7c14550b74e6e9e4c

SHA1
8b0ce15510fc0d929ddc3be33c41ac5ba2736e8b

SHA256
f4a8db08e857a231c3a6039bc6000d1cda15e8523f5a1d97300cb1ed98890808

SHA512
e0bbb36cc155e140a2d0a5ae5ee3b122ec855c11bb0a8a9ebdca1a5ea9abcc486c5529490e8b9974b5ded01c7c6283f6a9b289402ae840e17de00e0eb3b72615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
15e9f46ed694d2691d6700582f132db7

SHA1
f3b5a017bb366f05e95e48a635cfd18eec311284

SHA256
6d2ad1ef781afcbe8535404472b272c96938da430b0e937a0ec34ad2bdf939b4

SHA512
3f1378edb86fdd63581b88bf38d35bad99dbab976c89b4b18ca84ddd0c8fb0a6a240673456c09e8f8eba9ef35018fe9955cf6c60f8f961045e221f4465c9acaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817d8.TMP

Filesize
371B

MD5
7dd76c5cc5f9ccba07bd8f07cd37ebff

SHA1
2810a6fc9e01f579057cd11c631c9e07f621a45b

SHA256
1e4a128d78a79af3239fa36a62830b62ef7f35a4a8cc00e66473b10133932507

SHA512
7ba8141dc2a2c5c7426e973ffacffb946dc0a7587e6692e40c190442e23efe1ee86ab373fdd770912c3e690d3b83c2d3a299427bf7b5ede97741a0d4b4957e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8ef0474fac0b3a9ddca863217636e203

SHA1
ef153dd47ce33050969710c889a976cea6fb23a0

SHA256
e98562fa66a9ff43a50474979a9ccb943ee91d083f1f409ba8ff1d01c4d14c02

SHA512
499199d936c1f0adb6bfaa7d6d79abb857e36edd3de50cc89d21e79c0b0c0ab361d5b07cb2c0302acc4c1c0c43bdcb77701e98b5db2ca815ddb0c29c06d97b48

Download Submit