0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe
Size

45KB
MD5

6879b1eb02f8759fca084c730e700f50
SHA1

bf929c08693f845dcb817d4f5c80d5fe7b4cbbfa
SHA256

0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb
SHA512

d1d3697da4b62fb7d203c7bf5503b80372b6dfa99a1e8d7a109178d365ed918a13e247ceab94e413cbfec5ba2a19740fed7d7ffc74a9a16756e2e99870e68b5c
SSDEEP

768:/SisJmceOoIDHoMspLfFpyT7QHbtm+BEyqnN+8Nf:vsJmfOjDILprj4QHbtVEH4Uf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
4424	msedge.exe
4424	msedge.exe
4148	identity_helper.exe
4148	identity_helper.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4424	5000	0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe	93
PID 5000 wrote to memory of 4424	5000	0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe	93
PID 4424 wrote to memory of 3772	4424	msedge.exe	94
PID 4424 wrote to memory of 3772	4424	msedge.exe	94
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2104	4424	msedge.exe	95
PID 4424 wrote to memory of 2296	4424	msedge.exe	96
PID 4424 wrote to memory of 2296	4424	msedge.exe	96
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97
PID 4424 wrote to memory of 5864	4424	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb8,0x108,0x7ffd9bc146f8,0x7ffd9bc14708,0x7ffd9bc14718
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12878332411216028620,14012902955477846718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9bc146f8,0x7ffd9bc14708,0x7ffd9bc14718
    3⤵
    PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b756eb23ac5464272f7d7ceee62aaf00

SHA1
6983bab07a494fc28668c931459d7f17e3172bbb

SHA256
3e8e5b9af05fe90d047bd627ad8f15ef2dff5ce7147fcfcbdc36d43fc2f94f47

SHA512
1c65def566b0293c1d200e0dff078191eb17e77eafbcb048dee4b912872a367b0f369d588379083cd1eb1946b04339f3119232ddd874514ac4311283da8c9d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40999ff60c86401c5cc33549b35a6ddb

SHA1
62c94c33fd1f9286c3c0dcab8dd68b9fd33c7325

SHA256
bbddbe40fcd6eb899d61e4e6862c76004970277294bd66924fd48945abbc759b

SHA512
7a530a9ca7d9cd57a2b2b569e737557f5016e6212865823cb3c1ff8da6b96a1e12c2e7364dd7e044b2f63df42f2b560114805fa80e351a052099e41ad4aad802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22f4defc39145702d62c877829307b1c

SHA1
2ee7ff56bf2715ad192c9c93718d8402f56f0ddc

SHA256
337d6a022da3983f30638f71b2f22350765e2aba4ef7a1b739df3ee702fb9711

SHA512
4d0cff9b65c6eddebed487299eb07616c9a09dbadc0a6f0c0bcc235eed3f51d61bdcea97ed7565f59f5c5d94b77abb55f024f1b3bac6dd5114fc7b58a93150b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f493dc0dbc7aa60d1dcf10e8c137ec4

SHA1
c00db73c6dc52f5f792bb4bf7b477fc8e8d5da67

SHA256
4fcd3aef9c9856f330f5e3d4f4982f90fc121a9be3a3e08ad3233c439124b7cc

SHA512
5d3e59e71a3a299d43f253981070ecfa0731aa5deec9df13f7bed5d07334a94b1f9749caf2f0122e173225905c691cbcab7b15e3be1b4f2d4ab5aa3dfa754e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a7d474325dcdca43517f9882317b1d5d

SHA1
92ef2348cd755d7ad732b06dad651ae9b937db81

SHA256
8d2704890a820f5c25a6a08bdf0edc515ae2db5db42a03e8b8436d472ba9884d

SHA512
a47e5b52c5841376c5d9175ae41e52b54b15d745b2b4ce0eea145d78ea332c653d296edd266210a2e18fe22f0a1110c9581247a2772f78557446bfae7315719b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a9ec.TMP

Filesize
371B

MD5
a928065b4423735db9d8b5ec226df240

SHA1
7c87e6fb6fa3672d796307236698f9a1cb20c05f

SHA256
43b3b64f450149689e6ef1ad5ef9f7002e0613800487bcae759c9a55687e3bad

SHA512
15b3b0725197c62879ffc4656d9e0d1683c1f693fd914c791c3307333977e3e761c5a3745b45bf14973039a350cd7fbf6daa7d41886e8121675394684bc24952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea900eb7256062f8a707494ff89ebe6c

SHA1
731c0c01d9b48026b168af890f3f4bb4a972661e

SHA256
09e28c59da02bfe09a6755b243482fd374f2b256a1203031844102f283c1cc0a

SHA512
1647392b5b41fdc5cf66d6764047099c458a66776705d64ee3b9d3cf4b201ef12bff7a9f552a5a98c1f7adbafce3fef246e1e3c0e0c689a0803cfb8a25866a70

Download Submit