0bd604dfe2fa74a0d911ffba7ffea5365b0a7b0368b767bb7089cc65e227a9af

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe
Size 1.4MB
Sample240516-sqzh8aaf7y
SHA256 0bd604dfe2fa74a0d911ffba7ffea5365b0a7b0368b767bb7089cc65e227a9af
MD5 e2f634d3f6177b5c6fd06df0b44baba0
SHA1 1c18375387bca54737dec9384ffa11e5a0395f99
SHA512 9a7730758214cbc5646da7dd54e1199eebd9ff8c64bb0d3e691763ff217753a3f61490015c5944115d1bceeb62d7c0680856251922e13e21299502e4614eb68a
SSDEEP 12288:WfHsZe2oaQnso6i1qnWR++YTTEdpjXTwfV8XwYHZOZD0XErbsufli:WPD2o6fWR+tTAdJwN8A1KXEz
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
1312	msedge.exe
1312	msedge.exe
916	identity_helper.exe
916	identity_helper.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1312	832	e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe	94
PID 832 wrote to memory of 1312	832	e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe	94
PID 1312 wrote to memory of 3712	1312	msedge.exe	95
PID 1312 wrote to memory of 3712	1312	msedge.exe	95
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 5016	1312	msedge.exe	96
PID 1312 wrote to memory of 2832	1312	msedge.exe	97
PID 1312 wrote to memory of 2832	1312	msedge.exe	97
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98
PID 1312 wrote to memory of 1632	1312	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x58,0x108,0x7ffc112346f8,0x7ffc11234708,0x7ffc11234718
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11315118961469642065,5775465931748143253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e2f634d3f6177b5c6fd06df0b44baba0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc112346f8,0x7ffc11234708,0x7ffc11234718
    3⤵
    PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6aadf003-f02a-4a33-a9d4-82251b582869.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6aadf003-f02a-4a33-a9d4-82251b582869.tmp
Size 11KB
SHA256 7ace0c3a4c85ec5a3febf0a0f72723ba8d61640a2d6780942a402b62b2e19ec5
MD5 2bfd79b3546ffb3dda2c520503bf66ed
SHA1 048fc7680310c8a5aa2adb1bcbf0ecd80d33826a
SHA512 01909eea14fd2e8763bc1c573c29902c6614504bf26a76e51665ec4772106fd376db9924ed508193e3be482af8c449153e6fb4a840ddaa1673e52fa021451f7f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppkke2RUtA/jf7ZfB+Oblfg:A9iIxuERzA83h09RZxYpkK/LzZfB/XDc
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 41f04b3881c4ef8b69a59221a4d6e13e8276306ca18b5df4309da243ccc7bc70
MD5 8f1758d3c06e48cc00fb172af92398ee
SHA1 877f35cff74e7cd2ef5ba16ce9f70eb6b4295e22
SHA512 fd9038a49cddb4d2f68f2a69c3713f59f658534173622276bd7863031b229b0404c1c2fbb1d651e148d9477023d168140fbda9a36aeab7dd087660f57a59751e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8ff007ca88c8d5e5965e7a282a2a654b8077c52dc6dfc6fcb78dcd54352bb69f
MD5 aca28b331e6c40c80d97ff8db44d3803
SHA1 9b65596044b3a16763caf640b0dd9a095680200c
SHA512 7caf9d4602186a2c4d27673a9cdfb6542b8e775bae076823376d50c2e4b5e32fc046249a24f301b17e9fd3bbea9a85ee43165c0bfc621093f6629235f315fdcb
SSDEEP 96:nhkKZ1zega9IQwpvWMoiVmdeHpCrvbcUWQyV+VD7ziEwb:nhkalNaCQGWMXpYbcrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fae316ceb32450d109ddfa7204683ca9ec25b3fa0529a08475e7dc164cd1d68b
MD5 2588e83632ff03cf2f29cf9a24bd6db7
SHA1 5e3ab055349168f0c4da06dbd871c7c50c3a5429
SHA512 806a20880650347073ce8697173e58c99b12066df3b21a56f7d8102e4365f21de00c509a8cf8252ce234d9a5581fb35b5abc2eec55e67b24b1ba7cdab9579512
SSDEEP 96:nhkhZ1vvga9IQwpvWMoiVmde10Y1MkdfHpyCLFvbNUWQyV+VD7AiEwb:nhkntoaCQGWMuY1B/gkbNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e984ce8e2ce219d049d5597f24f3bbeab025b166aec0c207ddb4a8054ab6076d
MD5 9f99bb664bdda49c5d58672f11bbd9bc
SHA1 decec78c06987a15ecc38f383a43ebcbe2a2610a
SHA512 75f5f40d41c8c97ec494a5b4ec001b46a6ba680ba3184c26b7e0c0ba9126ebc38630928181f63ff7f548cf2d01f66870b8fb5870ef2884c33aa13a5c1311c0b2
SSDEEP 96:nhkhZ1zuga9IQwpvWMoiVmde1zuZ1jpCGvbcUWQyV+VD7AiEwb:nhknl9aCQGWMVuZhpPbcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 f5f491b9aeb531914f6dbec291b8d9e2ea0dfc319cbfdbf8922dd439b44a0b7f
MD5 513527e9431bf3ece4720ec303b18098
SHA1 3c870462c3c9e6614341024365e1ca021189b5a8
SHA512 46c7d24d8a053f2b40936bbe23a0446f56672990b07233b498a4038e500375409e87f4a63ae89726abf6a1b395a918bef4a19296b7e0eeaac3f3f79722d80733
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ef61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef61.TMP
Size 371B
SHA256 8b46676eb86b1ad7ca2039cd74cca37290d8225948459525cb56d1b5e23f9568
MD5 872a698779f33b1c3daafb9ee0c40c31
SHA1 28fa2c7944818347e4e8ed769a18278019b9cf16
SHA512 3c5398da4cafec7423cd5e501b63b271afe9fa0ede407bf4b2454f9ba1b05ebb8236ba9bf4a6de39799931c927600b2cabdf6c2a2ee8abf51aaa7a88d7bee946
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download