8416cfd085b7ef5a5a3708e7aba52b6f4acd5d0f432c62338c80bd07f78c18c8

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe
Size

168KB
MD5

0a1e1d868dfefc1a6f52fb843d0c5a60
SHA1

1a69f5b9c0168a62758474c6b5c46933181af42a
SHA256

8416cfd085b7ef5a5a3708e7aba52b6f4acd5d0f432c62338c80bd07f78c18c8
SHA512

871d22f5899ce6c8e62c3b8539c9de2bfdb5aae1680c3baf6405df1b6d7475115e97b390a76caa0b82e459638518912958d5814539c4fefff8ef1c70ff430b30
SSDEEP

1536:He9KqhVZCGWDv7zPB/8Wc9agcwV3tTGqVE1WbuXMOJsy4C9u184wYkM8e8hj:HwijR8WcTBkqVE8pOJn4C9u158e8hj

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3936	msedge.exe
3936	msedge.exe
4984	msedge.exe
4984	msedge.exe
3576	identity_helper.exe
3576	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe
4984 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exemsedge.exe

description	pid	process	target process
PID 4052 wrote to memory of 4984	4052	0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe	msedge.exe
PID 4052 wrote to memory of 4984	4052	0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe	msedge.exe
PID 4984 wrote to memory of 4804	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4804	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 1244	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3936	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3936	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3876	4984	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa68f46f8,0x7ffaa68f4708,0x7ffaa68f4718
3⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
3⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
3⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
3⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
3⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
3⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
3⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
3⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
3⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
3⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
3⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
3⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
3⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13166536476268011875,13449390732787691217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0a1e1d868dfefc1a6f52fb843d0c5a60_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa68f46f8,0x7ffaa68f4708,0x7ffaa68f4718
3⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
0a92ca9f1cfb6078a23e4cbe39cdecbe

SHA1
fd02ce26968d81579b219fd7266398d6c305f43b

SHA256
6715ce26e7ff88f1001842f2f94eaa4d893c55ed559ca3fb2f67be8f998c7424

SHA512
72dcb78ff45907207889482bfd2eb63e17ee8025fd064bbb2e012a408006d7ad6efae98d2f9c771e5e8292271ab7a939c421ca4b18870ed11c19d5ec3b0d7ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2963327b4abf36183e3957468a2cda59

SHA1
da672c1f2d9225f2ca0509dae17b879192987230

SHA256
6403d1b2131baf21c99db825ddf83e5a7a92c94878f3d51c5427cec3711f942e

SHA512
40ba25b3a8eb7b828b73fa742f21c473f4809e0bd8ca3315aca20a3a2a561b8ae6335525f617160cf2b281909d62b607f2402366e2ee861e3b850f1c8e65a781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6b7d3f567661010a4aad62f600347210

SHA1
48b0e43d0055276d0b4ec00e1a5894baf30beee2

SHA256
48f78eda4f832cd9ebc6d363fd0620e17379385cd43fdf584304b3ee4dcb396b

SHA512
8822dd0dd54e6c3cd6699ce6dd3e6324091f1ef37c531b95efa6381069b682ba37f05294e26727c9d8fce5d420d67bb27a155969a8efca956206e5b08992bba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
068876863cd0203ad141a137bd55e847

SHA1
8b48050fd9e526eef3c918dcac036c9475d1063d

SHA256
b79ec7a0e30031d702f6fc785b4a48c2f1ea71dc32877227b209603da986906c

SHA512
bef6dc0478796664320f7dbe19378a92a2e7d898979c6c959fe1626193904851e4140b165454d51087d336375c4dcd0a18af5fb9e7fc179da1e53acb5875503f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
371B

MD5
417d3513b5b704e35e4a0658db24015d

SHA1
3c3e930188143f760c0847dfeebfa8f2ed8fbf76

SHA256
eea86738e5e8100daf5cbdf60f264c91b8d6a2892e3483b4c44f9a9d2ce0f2cf

SHA512
a64b18d32ee96a64ffea61f47388b57c7a7d0e3a69a43f76f7d90c482fca8c2fe4cb54ffd620bc46d7ad35be235941b9002ac13e6cdb9d9f1c0e33fd7f17ce15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a48d.TMP
Filesize
203B

MD5
a71ccaf90545563de21325b8a3475ef4

SHA1
6cb35798399a1626e5a2196b8aac8b6e8b8feecc

SHA256
70671d41aaaea7ffde518b36fe44613b533e6ffe5c7e6f8cdd5f7e11523070b8

SHA512
496c53bc5f30d6c15ea9ba2677df1bc2b2298a03c75f400db4d3bf66384a5fc211731e389d5f7fa2578a753e81bacaac0bfeec7d388f1f4e052bf2a6d20b1bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
424f3bbca3f20ac24b4d377210622f2d

SHA1
9f42b59c90bfb425b1e39b270b17114696c5e7c1

SHA256
418575d3d1acbca4832637471bc4a7b71177c072996cb937d0fedbbf2bcb8755

SHA512
63ac9c0e9dab66c37b3536aa304f9c313205651ec96df9da18056bbad21f13096dbce834804e10d889a46029905dd45e8d2c0a4e0056047c4b72b1399501e433

Download Submit
\??\pipe\LOCAL\crashpad_4984_OHLGTWCJXUOZRAUF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit