16a6ea96ab35a9ecf817f8bc00cddc3a33bd1ed58dfa909256a5c48fbbaeef2b

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe
Size 7.3MB
Sample240514-m4rsmsdc44
SHA256 16a6ea96ab35a9ecf817f8bc00cddc3a33bd1ed58dfa909256a5c48fbbaeef2b
MD5 c3e8986be4f6e6663ae1758c8ff24460
SHA1 7b038188970df47daba8d50b6aee192453f39815
SHA512 746dd7a1ca3ca5df62813c7b8af3f3f063d33009cbfab40e0695655e0c5741dbc1c5e31155e65d489dc66944eabfa06370db124ebbaacf30b8dca6c7412f9266
SSDEEP 98304:EtBqrZvMEM0MUMRMxMwM3/qbNxbKzjLr4W11OKsZfGYWqOJwNu:kqrZUlV1qKp3/qbNujLr4TZf6nJwk
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
2684	msedge.exe
2684	msedge.exe
1356	identity_helper.exe
1356	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2684	3636	c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe	91
PID 3636 wrote to memory of 2684	3636	c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe	91
PID 2684 wrote to memory of 4424	2684	msedge.exe	92
PID 2684 wrote to memory of 4424	2684	msedge.exe	92
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 2224	2684	msedge.exe	93
PID 2684 wrote to memory of 3712	2684	msedge.exe	94
PID 2684 wrote to memory of 3712	2684	msedge.exe	94
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95
PID 2684 wrote to memory of 2596	2684	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff115d46f8,0x7fff115d4708,0x7fff115d4718
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,210164322541098360,14244397365330828908,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c3e8986be4f6e6663ae1758c8ff24460_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff115d46f8,0x7fff115d4708,0x7fff115d4718
    3⤵
    PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 195746543bfe7274df0b8315f2557ad94cf856f525dbcbcbecb2a6ccc2aeee99
MD5 7078dcdecbfccfc040ecc70aaff05d02
SHA1 089bed07c9710b6ee1c24b96a9e810e76bbad742
SHA512 7a9f9c4c01e044980d4a0c3445dfc826ed720faaa51e0092d7fb8265290d18a6a5f23ec46172006aa7be6e37c86f28e4f93a472bdf3306c66eeefe4974ed0efe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c4a0caeef69ae5b6cf59f702a3888340bd1fe230a8ad33c522241aef3dd0fc56
MD5 35a10b4681617a57b87d32bc4de2b7ba
SHA1 1693440cb2e2a9a436957dbb48d401a4ef8af1aa
SHA512 240690bc607b670648ea9aff57bf4a995516c0db0233e328e7705999835bea27ffda5c9df9fd2b93160b4818a20c61cbae0f264feac3e80d0c77eacc062efa90
SSDEEP 96:nUkY6158Xga9IQwpvWMoiVmde1FYaMkdfCpyCIFXbCDUWQyV+VD7AiEwb:nUkrgwaCQGWMrYaBaglbCDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 444dc2e91310da5a7de383e0bb3c02e1ac0bc801cb1c9196679a178d4d497cf9
MD5 892a071477eb624a2f6c0fcf7e4f1b7d
SHA1 e440eeb81eade43816c614f5bbf6a87fb878abc6
SHA512 a9ff89361ca7bb4b8f66b41924e880e0a5273b371670f47357e4300150f420dac774eec394bb5a38b0539c189c09ea041543f14eebaf3028add9943e304a9504
SSDEEP 96:nUkd615Ymga9IQwpvWMoiVmdeHpCrXbGUWQyV+VDCziEwb:nUkYk1aCQGWMXpobGro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 402995f7ef4a30ef284dbdfb870de0d8375ba1378cfee7ba84e6a31caa0ebc7a
MD5 810a109ec33fbc201427376a20f9cd38
SHA1 807b21c42af5963fd95828f13e4e407fdc8215c8
SHA512 2a4fbc2e08ed1ec8bbe977405d1306d41ccf809a66827691a3e6fc7841f045e8317be0cb49ca55fad0a6d2ee6c5c2d76370b84ace0c29b8e07f63c6500eba054
SSDEEP 96:nUkY615Y2ga9IQwpvWMoiVmde18OuS881jpCqRXbGUWQyV+VD7AiEwb:nUkrklaCQGWMjuyhptbGrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 cc21ec0d13ea974e3112e0233463f2e4d07dc8749b29e21c46dd1d71ccdf57f2
MD5 d48a286946acc4e92381cd87a133b6f4
SHA1 a7b545c59df568ee6f221d11b45b3d0b5c9ccbd9
SHA512 684d84c8b7a4cfda144e90717c5879bedf11ee636fcfb241fb4e6ba14b337d8c82516f0eb035296e77633d4c1140c6fde587d5bf54960412f7c5880e7cd857e1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57aba1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aba1.TMP
Size 371B
SHA256 066f5c241dcdffa4e7e5a07aa251fa9cfd7fec9fcec47c216108d54b1ad65e16
MD5 1df9e406deddc684f9e3b5ce8fee6e5d
SHA1 63711983252ab912857c3d338871cb0f03392ef3
SHA512 ad280e3e5596605d67763f5fb0169fb560fbd96b6d5e538ad79c509d5979ee8e0094aabcc69ec8b43db58b21d391507dda12caf1da5e327ef32a14c1beeefcdf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d29ccc52145986017f721e05c1ba2a154f7acba83f0631104c2a90cd16a4cf59
MD5 dcba1f600fdd0ee1d7d9f08774d84ceb
SHA1 a462bfe85f6824658fdbf05eb82d6d8c9944c5fa
SHA512 f97ea2dc72e7623183cfecbdb532feb2c60354dbe4762fcd2a054e885f9f39830cb11ee70d5a7e456ab13e712fcd8f7949ff4ee71bdcfade77e75fcf00e35ced
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2kUe2RUfjf7Z8+OblfBhDm:A9iIxuERzA83h09RZxY2ka6zZ8/XDafH
MD5 SHA1 SHA512 SSDEEP

Submit Download