0b7fec34ed002bcc19381f4e953f12c1e924c32036b8996db848264eb04b36ad

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	discord.com
30	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2860	msedge.exe
2860	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2860	2836	rundll32.exe	86
PID 2836 wrote to memory of 2860	2836	rundll32.exe	86
PID 2860 wrote to memory of 416	2860	msedge.exe	88
PID 2860 wrote to memory of 416	2860	msedge.exe	88
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 4804	2860	msedge.exe	90
PID 2860 wrote to memory of 2384	2860	msedge.exe	91
PID 2860 wrote to memory of 2384	2860	msedge.exe	91
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92
PID 2860 wrote to memory of 3588	2860	msedge.exe	92

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x120,0x124,0xf8,0x128,0x7ffb96e646f8,0x7ffb96e64708,0x7ffb96e64718
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16466092904242158703,6255792949416995888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1464 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x4c0
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b5cfebecbfd715cf1c2e86aaba6753c

SHA1
c2d783bdd82fcfb68e8d566bcd34ead327ed7c13

SHA256
6fca1fe2a780fb27f0493353a73b9ae02e9671b51a50b07566a322abe3b25cbf

SHA512
b6ba779a8bb083a12f7f100c4c338d5902f2e2762654f70fb578dae4c0dccba1c7eec4cb0b5cbc1d8567fbb02624a077fe9f60573dbd12b78da4e5ae618a751f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a690d53f0215760186aa07b114ac4561

SHA1
601015b3d5837e99e481db0dcdb0ea33fa80cefc

SHA256
8ee92ce70ce780b9af998d760d7226892a37c4a7ca5bddfaaaa5da016dbedd93

SHA512
935db7966c0c541b2894b83af14586dfffe138a2a18dc60bfd9d076fb724410841b5536261a090ce57525f8a7dc25e4bc3b133fce61569beebf4efb126607a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
b7d6ea1f87d2820869cd8897f62528d8

SHA1
3a5e13c3e45ec5d965126b25db76cc43c8aa35f1

SHA256
759a23d2c38b6eedd33c3a62184e2161541871a0cd957a9ca7c9a7a9ea8cbeb3

SHA512
0fb669c1138fbe7bcb1801a2d6c1846f077a6e647e5e68842579dd6b2bf5e680cc50e485dd9b10f612a3768576e3ce9c0c199e4239227703bb41b5700cf5a7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
743380ad5fbcde95fc39f50d5b16df63

SHA1
7bb56dde5af025bebdec0eaee92f7e590c1ec018

SHA256
7dad5a5aff4579054f396ab30df1881a4264febe45e0bd3f0d70e555b6c55455

SHA512
a788c6c7d41d7446b136fc2df0ad8f331c9254c2638b2c729d8336bac58f54538343e6219042c1fdd9b628daadd0b9d70475341fdb63de1fd506be1c4bcbadff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7a6987dde478e27be7824e111a78808

SHA1
0c64fc851b27439a32bfe254f42a5beee512fde6

SHA256
e8702933f3248f4c344c50c2ba97fe99e8722b1acc9f6046792a8d3a7cb26f90

SHA512
5ac2c26c08cc60d4fa296233e6d072de0b8e5decbc2923e9a84e7c49689f711edb7897bdf1216ad01dc0f9dea3f5d72eabdbc2c9b5a91e2779aae6e769cd8163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4afaf942d59aa3673b32f1160f8b5fd7

SHA1
14da1d9db5765f2b1d8c498dd093d30b929c2e46

SHA256
e44db4f67e36104e318b4179025152a2edae420c57393e436a1bccd40563123b

SHA512
7e9704ffd35f6d2b9501de12219fa41669382e4f709c634e4448689b6fb0048d522173c893cf3ec017fdee2d197a2b04a8006f269ac59054d112033d0fb4fae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9ac7d64ba533facf33c12b2972d57175

SHA1
0ebaf3c94cc3e9b9b02d7547a09bb717a947fdb3

SHA256
3a40027ca447bdbc4a277cc817c600cb359e26ff350c7bacf4c87e8b35f556a2

SHA512
96c4f83e1963bc4f6367b8916a97c8185cdbd9e33dcc89a541f1688103296226c017c84e3e41fbaff1ed197563871183f620562a02f1f0bcdee117247a878e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
960a81b802110e1a745e78066ca7a921

SHA1
41c342018e8199a14867bae354898e7c64e839cd

SHA256
7ad841682631a6f2d1c615bb1a2e3d26fea718f127648e9dbcb5932ae7a26295

SHA512
c4518d8ffcd487239b3b1782a29d4080edf792f27994b1893a2ddf8837edc068b8faae562c9ff3b59e1c8285c6c8a991c4ed325459605c2ef96bedfacc6d62de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583747.TMP

Filesize
1KB

MD5
4239f3bf6c6e046f9d10aa7da56a0780

SHA1
1d07ba7762bfbe2349f35754e36a8605ce9a63e5

SHA256
1e1765d829e7c337f71fdce81a8b111a1332280bd902442665c3f78ad03f8e95

SHA512
386bc3e624fa3c3d6c7aa330a37e3459b0c0e294d8258525e96086c063cf905fc2d78583ff15e93357e0920c852f17a47cde1d0beca26e14582cec2ff4223e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36c4b1af8db526a9465fff954d689c1d

SHA1
6b27896ca3c0e115e8c981ac8f886d27f26f2a74

SHA256
2d350a620e45437f83d66887c52fa4606ee43a457e65514122c20901d35469a6

SHA512
4b4b02bfa8a34f9eab26a41ecf427b41fbe66bc140c32047d53e7dfcbf110e55e6f9dba412c8a1d78ae34af4b5b738becf6b7b9d9623c7eb174452203863c560

Download Submit