d8ef5ae19d759524d9e72a70de36e41c64e3ad465f94c6d39c7e2645c3363bd1

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe
Size

172KB
MD5

051571fe6a02149a3a3aa2bab6703c00
SHA1

f082351d92d3d8fd224634afd908ed4d107013ff
SHA256

d8ef5ae19d759524d9e72a70de36e41c64e3ad465f94c6d39c7e2645c3363bd1
SHA512

d1c43f90e9139ae9fef290fafac11e5b19b51e463ee422ee48bd54b2e5f4ce41068af77cd3d30bb05a016d2925b8dd1cf10fa25e59dca12c727ee786bfb2e03f
SSDEEP

3072:RqaJm74qpXtmOnJjBawT253uaxfKfVvXgDOL3DzpPL0F0JCb3O3Cb3hHSHUEcC8p:psfdPnth

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4912	msedge.exe
4912	msedge.exe
492	msedge.exe
492	msedge.exe
1916	identity_helper.exe
1916	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe
492 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exemsedge.exe

description	pid	process	target process
PID 1336 wrote to memory of 492	1336	051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe	msedge.exe
PID 1336 wrote to memory of 492	1336	051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe	msedge.exe
PID 492 wrote to memory of 5368	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 5368	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4056	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4912	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 4912	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe
PID 492 wrote to memory of 948	492	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa121846f8,0x7ffa12184708,0x7ffa12184718
3⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
3⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
3⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
3⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
3⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
3⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
3⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
3⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
3⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
3⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
3⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
3⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,238503701100238849,15644676282844767323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=051571fe6a02149a3a3aa2bab6703c00_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa121846f8,0x7ffa12184708,0x7ffa12184718
3⤵
PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
6d5342eb30ad4eb1bf5901c04fa8b755

SHA1
6cb4f1bd5f3378fddbb3acef858d840c8d2f7073

SHA256
f51f9f36fedf661278781b06baed8fba297d6b86755c3c666eea5a0bd4080838

SHA512
99ed049ea0efc8e34697f95336df216dcbfa9b4ee08a2b9955ee27078e05769f14143deb20aae4662d5a174c3c35fb47f448330a3a98826c07b3ff9fe9a1ed5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3a9c92a3613033ea6271d8c76f7f2de0

SHA1
e7273dfd46a8af7430d34b6ffaffa1d93e199ac4

SHA256
2811e712c55857ab5b2330576c96891339404672a54b8da54cefed598f5dcf73

SHA512
5c025c09cb0caee931c772cbe5148b94fa9af1e2142fa36ac15a9d1b43353ce1052f0ca3c737bad99f1ca5bf7e43caa67ecfa3f9717c9e754f549a9ae06febc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9af20a8601b9129a2e8582bc931197db

SHA1
0fa6841a0ef6b22c417b3471c494167109f969b1

SHA256
3f8294a44897354c72411c20c50b51f1a569f7a23a5217614c59579b3163bbdf

SHA512
4ba73f0867a193a92958eac688d81d62663d3d8c9ccbf24aefef455cf47cb438cca1ef636b741d95459df9eeb4c592987a009540bcdcfe0f9708f89c2c653269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
055fe9c10e0ab0b9ef68a83e2407b536

SHA1
ec084af04727ae30103cc3f6887316d43af93329

SHA256
529664443b4b77d97a43371b52dde101ddfffd8245af48b3818bf6d8852acd82

SHA512
13d07350fffc0c30b00db7b9f7846de385edd39de122ce468923824f2474a0ed4b8ee49790a93ee8c6f937a88394b35c741138f0d58495da41afc780e7e406fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
371B

MD5
cd0e1d7144136ed424502d68dc991857

SHA1
8965ffc243464bb7da343db5e4dd094e608280a2

SHA256
5bb3fcd3ccb839ff42eec1cb9ce57dd692c7ba9f2c78a9aaa1b4dd865b100ca0

SHA512
147d29b4e19d192b4a615ccae17b720fa3568270cf013f122f6765fc22a10c3679aaa97eac3abdec603ecf20e4ac81a40fce2dcef84922512c0928525bfa9b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b74a.TMP
Filesize
371B

MD5
17a2e83fa1142f0fec70a07db0732d5e

SHA1
13608812edce6967f6b13907eb0a5138c9750be3

SHA256
3d023c42e037273e046d1e06cdabd12e729e2f0f8d38a4e58a8076f9125893ce

SHA512
adf1530646bd98499fc76197732e6697e156e5ce501bb24df76bc2a597b5b34cd8409494f817e5a0013d09940d4e74b20f27e410b3399fc9f934209ce6c00f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
583b1de79b90cd76854a5b474cc050d8

SHA1
884ecbe7e3a3dccf9ad4b3662a10d5a2f6c1490b

SHA256
c0da71eac4c6b49985d429f9277aa4e1e5622ad318280cc6dfbc1c02db6ef789

SHA512
e0d6c540822a129eae607e9c7b40cf3f2a31e323950fa205721a4c17e13f16fe15ad01a9a3edf44d5df388b4a0e0ce4713c0b1deaafdc718678186135af0b3e4

Download Submit
\??\pipe\LOCAL\crashpad_492_ZNBDKBHHWTQRYDFV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit