ead2696dfe7bfab2b66e6f9e481202e6d9b0630f06e29133c1348fb53e67c479

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe
Size

91KB
MD5

111fff9fbfee168e67c144814c1c7190
SHA1

612f7c72f58938d4919fb31d23b12ad9f3f777b7
SHA256

ead2696dfe7bfab2b66e6f9e481202e6d9b0630f06e29133c1348fb53e67c479
SHA512

f9ada9adf8a48974804f311f7bce061db6262b4b77da664085a22b2d4d103ab02e7cc77f484e2561d7ff1459cdc289b4b39679395d73c9003b49899b3672f2e6
SSDEEP

1536:PuU4TpvSpjsLZQEU4WcILxdtylKdNHtO8LnbrUMKGMc/A/IzKVqk/6xI/oswZx01:juapjsLyEU4WcILg8LbZnMc/QIzKVqk7

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4020	msedge.exe
4020	msedge.exe
1952	msedge.exe
1952	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe
1952 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exemsedge.exe

description	pid	process	target process
PID 4816 wrote to memory of 1952	4816	111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe	msedge.exe
PID 4816 wrote to memory of 1952	4816	111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe	msedge.exe
PID 1952 wrote to memory of 2012	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 2012	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 588	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4020	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4020	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 1652	1952	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d1f46f8,0x7ffb9d1f4708,0x7ffb9d1f4718
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6701392652552555777,8137394122518252462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d1f46f8,0x7ffb9d1f4708,0x7ffb9d1f4718
    3⤵
    PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
683af7264ce05c2939411adb187b6d93

SHA1
371e9779db9e999d0a77abdce643adcbb490f807

SHA256
53637896978efdf86911bab571441fff2704e23f9e655f7ed729595b9afdf490

SHA512
5a7d641aa2ec0b9de08e415a317c8b86a080eb24b517456dc2c29e4cb7262414cda2143f2137b35af8c031887adcfff1f0f51bea80bb0aa403134d2744a6573c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b512feb5501b1ed3f977f3463a418e9

SHA1
3801597d5a1101e0e43dd56336955017d793184c

SHA256
e8f00f6a2d80fd767f9c68c8b37ab6b2020b6111519bccff97bbe59cbc37f704

SHA512
944e2012964b6776ba5112213b56e30317e33840d04ebcc4ef96ee2ef951a11029f4f1c7d21d218d2085b103af5fcc25602c2e90aeffda12941b9262379492a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
905462fb17b74fd8b153b164485a600a

SHA1
bab7fa94df1804ba5251d1199db93297adf3264c

SHA256
711123529fdb05a8f7754ed0a6c71dd292165f10b549f6a8237eb0555bda0cfd

SHA512
61be390e86e745ef4b62f05f647cd05f61e78d8c77bc1084882db7ae94b8ae1c9d628d326d37775714f21f80c489ce6621534aa9fe1bef46c6c250cbfa70484a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
496d8ff67fef9b7c261c574da6e82c0b

SHA1
9f6baef6a81dd02bfef47cc3bc9e4ab71f816500

SHA256
cd6542555beb72aed564b4efacf67d89cca59259b530d090bb3bf3a8811e9ffc

SHA512
6e85456918340770559cc49f38f0c64b1e2a8ed7d1d7beb815ae8c42a4e39af05ea606adb6b5a15c71d2193e5ba9fe83e7bc88546f1ca6d7cd43aeebaa971981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
363B

MD5
4fda659a4b2e57f4b9838be037406ebf

SHA1
911eec09f4fb224730a43756250b80f055e3afa9

SHA256
f0e7c92b8626c53808a53aa91db2f5f0d306be04b4c921d366f586b3965a6134

SHA512
6e916763d5b595b7b5e4b8c7eb6705dec418570f7448c5407df6c692c59960f643316b421ecfc204dfa35309d9271f17f0c759d6bd2c9cdf5f43fbf0c6c306bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a7b9.TMP

Filesize
371B

MD5
d0685af17d2812d914449cd23ad82107

SHA1
d1b04e484a4e005b172b359edd2494e0050288ab

SHA256
b420838bab79b037a958a75048482ba9f82327d8cbd299a373c6c8512c78f737

SHA512
678b695cb9aeac2ae64a2356be6cd023e2fdb32a1442fea030828ad7bce41674cd09582e335b3e62c85bd82d67673b8e8820fdfc4ba0e2ae16260337f2b231b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad17a4c00d89c6b3586ab6cee1f1a368

SHA1
9223f6012f4407186dc16f20814ba1c0eca8ae59

SHA256
93f86e33b43d7512ba1762636db455abb583feff29c975fcfa361a6da8dbc4fe

SHA512
3a653f017f3bf272972b052d6206f742db64fe2ab5bb5902553a5804d3d3c471e3c0be80616a074c93a7a5cd6889076d09a764233e61bd92a32275017320747f

Download Submit
\??\pipe\LOCAL\crashpad_1952_XRFRYDNJAWSWVPPV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit