8618c98e3446a47be757fa2f7e2985255b02fe115fc4ba92bc148170a3c3761b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe
Size

552KB
MD5

04e288221e9300436aad51d0356020b0
SHA1

21c763411e60149cf4e035806ca368b2c47281c9
SHA256

8618c98e3446a47be757fa2f7e2985255b02fe115fc4ba92bc148170a3c3761b
SHA512

9c30a99ed1f6fa12c2e4856c159ac39089bbe1823d22718f159a5e4c53a52a847b38d433a6fd5f9c0d0b58f31d88894c5dbc83276d76acdb0e4418348586c036
SSDEEP

12288:aq8i3BV4HwTO3XiwxjmAxM35B9qgOUN8F6qlfNUqIFzGRIF6nj1K20XdDixi8B77:aq8iP4QTKiwxyAib0cE

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
4428	msedge.exe
4428	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe
4428 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

04e288221e9300436aad51d0356020b0_NeikiAnalytics.exemsedge.exe

description	pid	process	target process
PID 2904 wrote to memory of 4428	2904	04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe	msedge.exe
PID 2904 wrote to memory of 4428	2904	04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe	msedge.exe
PID 4428 wrote to memory of 3564	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3564	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 2712	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 5024	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 5024	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3584	4428	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb31d46f8,0x7ffdb31d4708,0x7ffdb31d4718
3⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
3⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
3⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
3⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
3⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
3⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
3⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
3⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
3⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
3⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
3⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
3⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
3⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7664739027455981211,9779737790876660681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=04e288221e9300436aad51d0356020b0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb31d46f8,0x7ffdb31d4708,0x7ffdb31d4718
3⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
ee32534966aae7c8a4658cebc90b3418

SHA1
cb58fb371b0a663f5476df6ddf17db5a4fa1d981

SHA256
7e2e72ca6911074d7a2fcd1e961521e40c0d195c467e76ab8f975aae19eacd5b

SHA512
2ce0a55e6ff2d59b99a5be5e5c72a849e1df57688d7f9592ade40e14e8befd53a762a58728cc64604daaa960f8dd653d74f47659694c85bedbc9f40bd49546ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d7aff25276d647b80c83ea63cbe26264

SHA1
34386772d808f461fc596bd77dc1188c7d5546e4

SHA256
4e1d256255ab34a3c2e92d2829b3c826b20b68cd9f34713da7ac3534bf2f78ff

SHA512
be21272c860b068655693f5be299ab6feb9f06313e4a3fab3a9af33cc21564504dfa3a3e3432c448e5d63799d06b1bd002b6387e4ca9122fa42de0ac8cbf8409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6e97eebbb99f042a2c0b23d64b25d8c9

SHA1
3ea063184550c65e72a9f057b092bfed4ac0a342

SHA256
5ae81304525ec68ca809b3d2cb7cc1187d7d77192d3dabddf119901921b2c728

SHA512
52e3dcfcd7f629a4ea10cf156c9cbed9a30d4e174a57290e51749399c6440ae05b15f6ceab5ce12f75d0fbfa6ef28a589ef5ba4e76a68e72b82058029fe94a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bbecaa657d5a272b153c109611da59f0

SHA1
519ba8784341e6d14cc9ba0ab3b7fc25e7770f1a

SHA256
67649d84d6a204604be5315707e2e2a477ad91b617ecb5bac04c907ec9d8f9b8

SHA512
242691fb33f3a9afd05a4496c86dbaf1b0c173219c81e06435b1471baed2db3be23075acb8f2e85926ba23cb9e0148241c511489c2c280a434e46e844e3c206e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
371B

MD5
0ed024a49d94888dc77a931742bc94c8

SHA1
3030a73b9c3c77cebdb728101be68b98ca7e7d23

SHA256
e70645dfd6c7d175628b117ac85d2f9a01855d0d132a6ed9935013d5dedb1253

SHA512
682242eaaf5c488d400833df6435778086a4907ea1a2a9e1f413f3d016a7a5c8e9e7864c29a92036872e10d429b3425d80173dcaaa8b1055fb90f00690bf28a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c2e2.TMP
Filesize
371B

MD5
35a0d4055d9d66701e86b53c1eb033e4

SHA1
beacd927d08a5057ac10b4dc2e003c7aabddb557

SHA256
8289b7943efda6556352f48ede8070a2e6a34122b80eb317c0a808215abd42f8

SHA512
b3d9fb21ca4642a8bedb488ac73fa20c7405d0905e888e44a7d80e692fb6b798f6f9d5ed22ab9167b97be5988569b4f4adcc02eecd0b50b7cf394bdd876a1106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7319f6d5bcd3b53ff87455b477bb7630

SHA1
d4eaa7dfca8d25e7c5ab8d84478a81cb804e5cfd

SHA256
443886967a4411a945fe132d1ed041d062cb194b0eb238fba00a3e6566eaed08

SHA512
4306681dbe80af53b93d335d79b58a745a660d1c1a9907b0376f318d03056c833ea7aa05d007926a20577bc26b32d5063041f1a6e11e75224ed480e10455b68c

Download Submit
\??\pipe\LOCAL\crashpad_4428_CHZIATTTXPXOAWLS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit