4ea66900b10be26e04f33777b14a0ce1f56b365c63af2205faacacebcb6747d3

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb87cd811c9b59739783f3409d97e460_NeikiAnalytics.html
Size

154KB
MD5

cb87cd811c9b59739783f3409d97e460
SHA1

1432c9b11cff5fe0f38f7dc9b2c6cb28ab97dd0e
SHA256

4ea66900b10be26e04f33777b14a0ce1f56b365c63af2205faacacebcb6747d3
SHA512

a4266c7f2b54523d309e627f149dae63eaaef568cbf5263cdd91fcbec505a75239015e78638357d43f87c09b683a00b7a876d757338153e3e76048912dc06e86
SSDEEP

3072:cIEijZeqLoEijZeqL9JUwUTPAPmR66+KYQOH66+w:cIEijZeqLoEijZeqL9fmR6Nf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3168	msedge.exe
3168	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1548	3168	msedge.exe	83
PID 3168 wrote to memory of 1548	3168	msedge.exe	83
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 4708	3168	msedge.exe	84
PID 3168 wrote to memory of 3732	3168	msedge.exe	85
PID 3168 wrote to memory of 3732	3168	msedge.exe	85
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86
PID 3168 wrote to memory of 532	3168	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cb87cd811c9b59739783f3409d97e460_NeikiAnalytics.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8699846f8,0x7ff869984708,0x7ff869984718
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14851794158719076600,8133820128714488065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2be2c32b7567924b3b3b692d6d79384f

SHA1
8b8afc61c640b249e915c517650e72e1f9a42369

SHA256
58028ae7b9a42b725f6b23c432af5d4013c6e6a56821a83cf19ee65a01815aab

SHA512
d28f83d42b27c4f464a825bd21f3ae124ca55393f9d0bab53530d3feb5ead1a4a162173eae5003f922817c3340ac50594a0bbb126e0b5ae4531237dd282e2ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0496deabe6c5577ccab5702ec6a8382e

SHA1
aadd8cbdab78a0731f1481930f7119c8cb76a0d5

SHA256
1ac79214abd98632c26a2829ae02c26474516064ec47b4d8d0b4b279f748f2bc

SHA512
f0993b14225bc971c38f0138b9719aac5142d27516bbaa31b9d87254b1eaa247abab1ed89cd6eff130ad34eea585dc0d453272807e54bc6281f2b1a224386140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3d03876c0807a17f1503dbca408bbd83

SHA1
12bfb45b820f4968ff90275c4503402f7330d014

SHA256
51c604fc71ffe61f0b8efab7cb79191c896678cd0f18a1dbecc81c11bef22be6

SHA512
dbb3bac40e0c40359b85a323dde4bd65d40483e03ba8fbe9b4384008724d76fd7e0d63e46c7341d84790ce76bd5614a822541c34a01683f7e724e9bf0f0a347e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce89474ba32b4bfe4fd102f2fe67bcc4

SHA1
53658437a909fb4105e52a3dbe0a69a522efefbd

SHA256
a64b9285b00c854bd4809f5e08bde546e81d82ccf6ae87e432e913eaca80b128

SHA512
f5ffe2398f76fe14408ce3af4357ac000696f2add63e89dcc47cd823ec191820345a93b044000e668991e67b0207b4985e2f4910b3323279f7f346ad58171cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ced13580fd1771df39a78a78a7fbe194

SHA1
9e8cf4e3c9dfee2f6567bbfff55eb37eb7c17be7

SHA256
b503ccbdf1ec1d6cf0528a206c336c7592207fb14e2bf5c06be350ab79f83ba2

SHA512
07f4b86e2fbc65fb2e450f590a0d51b9b331176d61197fd879d6c0705c156a11a235cae5e5b5508603a09cea2c5c82387cffa3d167f328cf205f17b65b3fdcb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2da44a09331f9a830d71b9717167ec2f

SHA1
e8d51ac4432df598803bf8adfd1778e585010d6e

SHA256
d367c388eef2c548847134f1c2c13b4cdb3dd8eeae77d2b6bd007f72616d20a4

SHA512
5821a88942096908e41b87780dcf81324e40c40b9eb1de988a4aaf64962288e5309e239c0135fc5d10915d11793ac6bcac78b56f96ad38a02decede154710501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
13d203cf21660029a80e291670f5ca8f

SHA1
b1b611b4e6d0b8139246383017d5c49fb7404d27

SHA256
5a2cb02be46f9b01d70338f231212cfeecaa03bb4818f4704437e934664d90c4

SHA512
e3add48be7df71d21f6b2ac3037adc88682c262fe21de69fab523772f8e66ebadaf4bfe09436f55ef7467f4d32e8a207d995369c79ee8f85ac0bd0f34215c952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f04fbbd3da1ff8fe19b7e5212939edb

SHA1
6503214466c96e81cbc0e61849e7a54e1e58be87

SHA256
00b2a3bab67ab6f2d6195f47ec6df56e4b5c9ca4d0e42e8893a86d5dd934c05d

SHA512
f0db3f41c3ad9eccf44045a93ab52a553bb27ff80e30adb683e3160de5a0cc2bff019c3c421125c67275f9865c3086f59f1b638662bb5a7a96e86a2262a34c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0bf44ad889d9bbc341baeaacd22992de

SHA1
5cdc180ee3e217f11b7738e7ee7794ec755afa61

SHA256
4c4437b71041ae08cb34cf34d037767ca8b9597186be5fca8f17e716bf652584

SHA512
cd1671b34fdf190b04afd135315547e33fedd63f65cbffe23c2df93d8d018194d35e3e50a332b668b22da1ec33b140c549306652da9fc4e43a3e11d8e4e345a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8ff.TMP

Filesize
370B

MD5
eee1e14f4a77e9f64e2e36504220f43a

SHA1
237608b8ab3fb4ab4864e7de0f3d00f930df9fda

SHA256
19cbe5a89d250d72c4d65e6b3432081d15b1959f0805f06095f2bccf29bebeec

SHA512
54e3f04137989bba8cac775a0495fe417d3e06c61b9605ff46848180c8ae32ebd35cca5906ae4f399ed7800ea1dfaa45856ba91fd8d44cbc4033e9602e676791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e46b0b1721bfa0fa7a54d86b67e40982

SHA1
8891980f0844032770683e62efbec2485fd065ca

SHA256
569fe225af0a5c424ea22a503ec294a6cfd3c9885ebaf624600a6f70547a85e6

SHA512
1caa1d9e5d400cf00eda070642a4cc6fc48c5567a637fb0855fc3a52dccf8b38b325b7a2dd2254b42499d7a801ebb2caed167b85ec502de1bad53f2f8978c298

Download Submit