60320bbb5defdb684f2702f8dd40fb3ea804057aaa45071ed1ee3a3fddef0bed

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c274151bc65dda2ed965b8ef26891b40_NEIKI.exe
Size 534KB
Sample240509-b4vnraea72
SHA256 60320bbb5defdb684f2702f8dd40fb3ea804057aaa45071ed1ee3a3fddef0bed
MD5 c274151bc65dda2ed965b8ef26891b40
SHA1 cfa5277605bb71d0803c91674bfadce8e006cea4
SHA512 9583b165c82b5c3c831b310fd7b993144f523406b16f42fdc5cee54aef712607401663fded1b404d4fa029a389a368df1d90bcfda4b6b84667ac0f99a7c87751
SSDEEP 12288:UZolmTnFdf1cnDTTuP5V3rSWmlhp3QdFM8YmW7nX39nbLjng354:U0mTnv1SDfuP5xEpuc
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
4260	msedge.exe
4260	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4260	4364	c274151bc65dda2ed965b8ef26891b40_NEIKI.exe	95
PID 4364 wrote to memory of 4260	4364	c274151bc65dda2ed965b8ef26891b40_NEIKI.exe	95
PID 4260 wrote to memory of 984	4260	msedge.exe	96
PID 4260 wrote to memory of 984	4260	msedge.exe	96
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 2084	4260	msedge.exe	98
PID 4260 wrote to memory of 3908	4260	msedge.exe	99
PID 4260 wrote to memory of 3908	4260	msedge.exe	99
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100
PID 4260 wrote to memory of 2264	4260	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\c274151bc65dda2ed965b8ef26891b40_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\c274151bc65dda2ed965b8ef26891b40_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c274151bc65dda2ed965b8ef26891b40_NEIKI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd05f546f8,0x7ffd05f54708,0x7ffd05f54718
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13850864761250454310,14174092300602640607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c274151bc65dda2ed965b8ef26891b40_NEIKI.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd05f546f8,0x7ffd05f54708,0x7ffd05f54718
    3⤵
    PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5ad3b709d8f57a081a67f08f5c93f52f7b84481972861aecef406d8e525d6996
MD5 ff94d91008789272822452ca4a86a951
SHA1 952eba0c40a32b924eabe081206cdc8e5a2b1558
SHA512 11af87e6a0eb983f524336627eecbaf1968e31b30930c8d8295c69fcaafcc745ff245db61243379513a2088513ed35ebb7eb07df8d10d3d64a3130737f8b4715
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 987dea031f812f5434d2021b9a1b7c7e820fb714113e8d8e63de19f6761fd8f9
MD5 1295f51b2a98646a112f79d4ac435f5b
SHA1 247b860d6699bda2ac0ab0b8bbb7e6bfb45a6a87
SHA512 3088f6fb099c9546b046598afb686041c05f0a8a797e811c9061b5bba419f89c0f8e8d12a93bfd9dcd575b789c832057b8b7676db3470f4eae6c872fe0f2d41b
SSDEEP 96:nMAkCc1aQU3XwpvWMoiVmde1mYyIMkdfZpy1+5lmUWQyV+VD7AiEwb:nMAkrYQAXGWMsYvBRgOArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6a754d090e6de2a13f834f5e127d5b5c288cde1d6e80164cc613909da6c74f7f
MD5 992f097e656e663dca51112490aed9e9
SHA1 626b6a48ed1bf7450d094a148210d1736fb24a69
SHA512 d5787a74ab6135225a8bec02094373f3a7e1d0db76b7fa58b3b6b8bc5e8fbdff515eed598c4e7a0efecfc4f79cffc95d151e120c02178bd6d6f7b0114fbac82c
SSDEEP 96:nMAkHc1a033XwpvWMoiVmdeHp1k5lcUWQyV+VD7ziEwb:nMAk8Y0nXGWMXpkSrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3a61b87bafb099ba4ce41d19e7d01da3cb9bc93f6d2b8b90faa5075fc22e6bd2
MD5 a172a1748ac07a60b7babc1b2d9622a4
SHA1 9d141ed969e68abaaa4de5211e6c1b82cac4f249
SHA512 cd8c3a96523dfd343cc5412a1b2e7a7ec8fbd6beb5db17a857442007bde2af43bbe79ada410b231518e656f5427950f0ba44f2ac7ac6e52a23c035ccbd092f3e
SSDEEP 96:nMAkCc1a0n3XwpvWMoiVmde11uK1jp195lcUWQyV+VD7AiEwb:nMAkrY03XGWMLuKhp9Srg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 fbfa983abcb876d2bcd387cf1e7e5252e0c6e75ebedb800d9380a3d1cb38c056
MD5 e274713b9e8a48ba51cac86de60c4e68
SHA1 f90e37939adfe0b06be3248f3f988fa6e1aa4738
SHA512 4f5f9da2e7673d48cd6ec1cf2b96968120bc425844f1eede660b175c8520555a494910824c96da0bc62c412f34d8d99dc5584fb2d970018de7b515a19a8d6693
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d7d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d7d2.TMP
Size 369B
SHA256 e8cbb5688537eeedf5809d3d9dbcfa30a97cc321a10821612a7e64a94531e33b
MD5 54efd49e0e98e4de44eaa66b96eb9e4c
SHA1 fc01d180c20646719135ced382078fd7cdfab770
SHA512 9bafba996e90afd6111e676750bd73bd22d1f94d51ddab64407d8c8728e8d2b509afe013328f7f5f08c74e44eefad981516bd5cadb45f4003e720c9a24a0174a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c52ab1a4d87b778233ab43043fe0a4355cac562bc97b8d41d3f0f3be8bd90666
MD5 1838df8cbdcf0965c433bf364438434f
SHA1 d29d7e1d8ced1b254160fbd154399912e9f00776
SHA512 83a8abc476e337def24c3e6e0355c11daba1ca945fca0a8d26c8a3a6c2b66a6221a1ab60b63902d6229e3a360ec8d745545f4807951ae4d756bb7ab9e0f92f83
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupr7Pe2RU2/o5O+OblfBhDaq:A9iIxuERzA83h09RZxYrLDwO/XDafEB1
MD5 SHA1 SHA512 SSDEEP

Submit Download