64a32ac6adbb8ccada1ca74ed4af18eb3e38620b90d2573b2f8954bbeb6364b3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2025, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	discord.com
31	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
2152	msedge.exe
2152	msedge.exe
5936	identity_helper.exe
5936	identity_helper.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2152	4580	rundll32.exe	87
PID 4580 wrote to memory of 2152	4580	rundll32.exe	87
PID 2152 wrote to memory of 3436	2152	msedge.exe	89
PID 2152 wrote to memory of 3436	2152	msedge.exe	89
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 4820	2152	msedge.exe	91
PID 2152 wrote to memory of 3480	2152	msedge.exe	92
PID 2152 wrote to memory of 3480	2152	msedge.exe	92
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93
PID 2152 wrote to memory of 4488	2152	msedge.exe	93

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc00b46f8,0x7ffdc00b4708,0x7ffdc00b4718
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,497751519204067042,11642700599283172757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x318 0x410
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d6b4373e059c5b1fc25b68e6d990827

SHA1
b924e33d05263bffdff75d218043eed370108161

SHA256
fafcaeb410690fcf64fd35de54150c2f9f45b96de55812309c762e0a336b4aa2

SHA512
9bffd6911c9071dd70bc4366655f2370e754274f11c2e92a9ac2f760f316174a0af4e01ddb6f071816fdcad4bb00ff49915fb18fde7ee2dabb953a29e87d29e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a4852fc46a00b2fbd09817fcd179715d

SHA1
b5233a493ea793f7e810e578fe415a96e8298a3c

SHA256
6cbb88dea372a5b15d661e78a983b0c46f7ae4d72416978814a17aa65a73079f

SHA512
38972cf90f5ca9286761280fcf8aa375f316eb59733466375f8ba055ce84b6c54e2297bad9a4212374c860898517e5a0c69343190fc4753aafc904557c1ea6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000091

Filesize
255KB

MD5
e80cdded42978faae0ba033638a524ef

SHA1
4bc7ca1769ae8f7d4ae1abbe58776aefb4d0beb1

SHA256
f53ea4b855088dce71229d9760b4c6afef96a764daf95b5e3852cfdcc38e69cb

SHA512
b02648b654c1223ebecba8fbb8509b8e608760f6f8063acc3bc39511e9bf58d20a47d3f81cb627e9cd0d3a86a6ac554a51aff1648723cf20e61775e79982a999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9dbe1fd797d909a3404c605c0c02af54

SHA1
d530796db7ca8357a24d105c60be665ea56bb3bf

SHA256
6d178c83cf6ab3ded35fe06330c9eff55b3327705bd453f2ab2d7974c6f34dbc

SHA512
720f1b0c34cfd7106a3dbe5fe1e9b2400c24933026e8e46579c48bbcf96de6d9597f062985c03f5425c1734dc54573310c914df7a23493d43b0a4c676ae5b188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d180bda3dbc73ebea24f65b0189b31ad

SHA1
57a9dd5935c0b917f3b9afaf89447e1140094f43

SHA256
e9b646e050a4978f2873bc3f5692694b3f61d3e04027b4a69ff270bc812ea549

SHA512
21c1aa4f257cbca4b1109722e783cfe75bcac0a47f439241d2114a772072eb146bb95add464de370a3a584164c602a68496753e9221e47842169c8da865a32af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
52f3054a9f7a52672f5b6b188ec8ee91

SHA1
f9b9bd766e8bd32a92e69b58bc0a434899dc0ac0

SHA256
25656a7957cbf94868e50e45dae7b68afda7ae98a02b1b04680c30842369fa79

SHA512
52a93bfd4bfcbc22319a67b31dbf7e566ff586ba3428f589a8ef55573bd9641aefcfb29af9af461702b333daaab6e7b9911750c0f32c77f4c4ffe508ad08cb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
921b9a54cfe48f36b9494fe0fe2d1e5d

SHA1
5b39e2fb0132e4afdb1249d4213ac508c333ad44

SHA256
664fe3994aac04bcd37d20da9b327d00c6eb9888c3c916f5ce3b94cd1518b57d

SHA512
a2e826f39a40cfc8a42b8b75e4faba863fd95d0de4785cf3d80a2c54297f1996f8b82110637694b5331236c4421f3a4f351ea5c0468d8ebf98b0e624d6010f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
55c809caa64b78e32371e28b688e6fd6

SHA1
db9c11781acd402213bb0c9e606eb503dd459745

SHA256
2a52d94229360cc6af1033096a92a299ff8289b0b3e608e4fe7b36f0a8083d62

SHA512
8cc332699892ec1204f67aa4e0b2619f19d64a3479f4d31cca7a8893a59644ee297dae4d63e64c2cd1651d460a153853ddaf8f2d048c7bf29ba16b624e601ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6361c6b8c5338e0dcc33fe5ba4883347

SHA1
e8e6c493dd26a0dd3fe180090bd9ac9727214363

SHA256
43da50928e136d2c2d4ca55ef08cedbaf20b997385c930de2138fb5fcab797c0

SHA512
168d4fac0bac952e7725fd32c8a8def0701c6a21ea1f4771d592701de03d750cd42b65a377afb895db86b2fd08d42923ca28776a217f5c6150c394d06bfdf0ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee7228ec26468df4ff06f62e998aa72a

SHA1
7acc3810dc5abf98bc303e2166c424b92b379f31

SHA256
0704fd86bd9678ffe21b245012dd616bd0b3d72fdeece268f86b662062a9d267

SHA512
55df127703ed941811e0f1659285d030444d6f9db5a046903ff339d0949cf7e1ffa921aec56bf6786834c01581a3595c5dc0630e924423f563f306a16ef1080e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed6b223b00585e8ea3614b59038dc3ef

SHA1
d1c85854163e80d566dae88e6af7b7739bd88427

SHA256
be14fa55c08bb33e50dd727d86f1b5e9a6c43801fa94ffee33810d0a7e97a1c1

SHA512
f5719c333f239292167ca9ecbc20cf7e6b1e234764cf67955c03ddf565014fe3f402de7a2a3434eddc81e126525339fd262795a9aa0a6cc114feefec45ec0065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
11718684d064b8de7e6a84ee8a3230a0

SHA1
ef0f74a54c0462c4bd679cce75e6271b6472ca35

SHA256
92224c23be75a76e9ad96df8b2bb5f044bdc113e2d59c5e40db57ed5f08a8502

SHA512
f9f525999c00ee9ff985f751e48e476b2c510d6d0bde8fced58ed70c868c4ac1f71ee453da7d2f986a73333db7a9c3818d5ad8d79d00f31ee6c618d49127ebbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6cd.TMP

Filesize
1KB

MD5
721fb89d571a9547d113bef1167bc07f

SHA1
0cb3ba87337f81db7199f23f25e3db5020216834

SHA256
ba47f17ba660c5799a793b361feb796795f042e0dd4b38b07a4c5f323e85ab7c

SHA512
2a401da277b6ebd27ebf3ada45d67ee8d76d19d77f2de10660303cda7d92a59855926c2737751abbfb4beab01549b1cbe9fa6227c37f296980b091e8905eb78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0cf9a441ccd8b5dea0814fc5fbe292b

SHA1
027fc7adaecdb1b18e058650db856367e3a6d9c0

SHA256
ca1f96d58b1c27614aa959c3e9f8c62da8f660a72be489d6e5544ec1e6156503

SHA512
7c6c621d794cca4b646c5276e5c85f9dd272876d23a95e5d915b4135b136ee39820169f50f4a445a16004c127241b368eac35ff6d5044d263cf94c79bcac52ca

Download Submit