0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe
Size

45KB
MD5

6879b1eb02f8759fca084c730e700f50
SHA1

bf929c08693f845dcb817d4f5c80d5fe7b4cbbfa
SHA256

0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bb
SHA512

d1d3697da4b62fb7d203c7bf5503b80372b6dfa99a1e8d7a109178d365ed918a13e247ceab94e413cbfec5ba2a19740fed7d7ffc74a9a16756e2e99870e68b5c
SSDEEP

768:/SisJmceOoIDHoMspLfFpyT7QHbtm+BEyqnN+8Nf:vsJmfOjDILprj4QHbtVEH4Uf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
2116	msedge.exe
2116	msedge.exe
2764	identity_helper.exe
2764	identity_helper.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2116	2000	0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe	91
PID 2000 wrote to memory of 2116	2000	0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe	91
PID 2116 wrote to memory of 3180	2116	msedge.exe	92
PID 2116 wrote to memory of 3180	2116	msedge.exe	92
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 1204	2116	msedge.exe	93
PID 2116 wrote to memory of 3236	2116	msedge.exe	94
PID 2116 wrote to memory of 3236	2116	msedge.exe	94
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95
PID 2116 wrote to memory of 4064	2116	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xa4,0x10c,0x7ff9e70846f8,0x7ff9e7084708,0x7ff9e7084718
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17032251313891249529,5428249988368718425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3992 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0261b2f24b98b9d5646ed108e7a1e3081e95a9b42e60f1a31e7500144c2372bbNeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e70846f8,0x7ff9e7084708,0x7ff9e7084718
    3⤵
    PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
54f4b4bba3f03ce12bca9c6d091b64e3

SHA1
6c735cc95521b3dde64b924b46bdd677a88eb5d1

SHA256
9638373d73495c083e7717b012a26467aa9637584544e783a1b74ba5d8a32c79

SHA512
78dc405f92f1d0f73882da91a6946ae8626339f0fb3d3524efec2e260541a497f84aa3f9ffb039ea602e07e52a26d99c508d2c1cb76423f31dbb235b16fa568d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dedd09e3a1b9883b703a736a9ec3ad8b

SHA1
e2209f1ba2a52efbce5c621d3cdcc1a84a6f0812

SHA256
4fdee8bc86f5e2cb27b27691ce02014f5dd41aecbd83dfeeaee32c7505fccab7

SHA512
6af86a830bc1e74338fcac4214364cb935771d655c283d4c7f2fd2bc025069786759b49a749cf50f1d76e4792662fce85b76a7607302374fb9c1597624b79d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e53b1bdcc066733b94111b4176ce18f

SHA1
0241f15f10400d4a431d7c584a1e73a43e8235cf

SHA256
dbfe5e86f01fd24679edbf5e6f0772ff2d86e914d3fff780b0d2281a22699f8b

SHA512
9b6c18c75e4fde59779fbee4099f9597759c154211b3017b26009d37dd96dd6bc3df40efba63317d5a334cc348d8eea128e813e9052daf3320844b754ba60756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d82d12c4e0bceb5b7d2cf4a7c720956

SHA1
ae741accdb49ddeb75a2fe4fb4cf3ab1f153d3e8

SHA256
2b5d50aeaeaedb788468612ba6d19ae19274933fc4d43b451c449b9ab4804158

SHA512
0492213c18d24b909b57600162a77881bb2fd873e486bc7efef453507dbc1cc1b879047c610e1727145e53ab6513aa9b4dfed2b042c5799cfc0832b98c2ca49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b7d7aa60ecd81b0ab0e7461e8f8b27c4

SHA1
187d62b55f9892aa0ee5e5a96bba8eb94d00085f

SHA256
9ff0c57c3fde3b49fa74ea02cbcb4627991eeb3af2b8e1a28d89611a6f772943

SHA512
05e42a22dfa5467e1efaedb499e271454a02838276041498902ed4705ddc667419e6a0926e2f7f553c265338ef5eddd60e7d82921b69460f215e4002e23bc4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a25a.TMP

Filesize
371B

MD5
b6f2dc130a7e60e23fcadb90fa8fa46d

SHA1
9be02b4c3963b8fc4fc6cd903f700e18384d731c

SHA256
e6312e4e10bf535b2791fb599f54524bfed088cdef09d19d80b11a32814b73d2

SHA512
4806dcd746f59eb8ae146343c51f0f59c6b0fa04be311f05cbe09a6fe35fd82cc6a30ac9137d0a0863bd3c34fdf2e0dea1813b14fb665ac0aa28ebced0b81f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfeba1a61742185b82c71d651d9645d6

SHA1
0476ff41a5cf53f36c208d68128259b4481a9f69

SHA256
83c84906e4e14b35809f6bd860bfbc740ef8c959c6d05e5c42af3f5f27079c0e

SHA512
4fa8866012ccd60796106d33e6cc493ff986f9c42eefc6a0559c2d69440c2581b591b84f1d9a170d8818059db40fe5318eb8e01be7c8b9b840fa5a339d49695c

Download Submit