9e3327d12acea9578bab64209c6beb9112a97f5e12ca61d93e80cc601346f6a9

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe
Size 702KB
Sample240518-p8a2ssce9z
SHA256 9e3327d12acea9578bab64209c6beb9112a97f5e12ca61d93e80cc601346f6a9
MD5 c89ab245fd2ff96eab8fbbe97157fd90
SHA1 081b6809491414b2d3d8a9f07e82f1d2ce9e6f1c
SHA512 f7e888b4df7b894d90c4b856eb75cb11f9cf0b24ebcfdb4fbd51b38776a39aeda3ff834742a237586cfeaa31b1f35b51f9cc1d9891e3aa57d072b737eb895805
SSDEEP 12288:BxhbIr9rf+HfmI+aFNco0s8YUEByJyhikN+sfWPk4Qud/YMjhvPie/rByY77777k:BxhUrMfl+sOo0sVjByJyhiO+Ds4QuRYB
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
3360	msedge.exe
3360	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3360	1396	c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe	93
PID 1396 wrote to memory of 3360	1396	c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe	93
PID 3360 wrote to memory of 4408	3360	msedge.exe	94
PID 3360 wrote to memory of 4408	3360	msedge.exe	94
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2000	3360	msedge.exe	95
PID 3360 wrote to memory of 2384	3360	msedge.exe	96
PID 3360 wrote to memory of 2384	3360	msedge.exe	96
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97
PID 3360 wrote to memory of 1528	3360	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffe89ca46f8,0x7ffe89ca4708,0x7ffe89ca4718
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,718408770356411210,11192527589027878554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c89ab245fd2ff96eab8fbbe97157fd90_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe89ca46f8,0x7ffe89ca4708,0x7ffe89ca4718
    3⤵
    PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 a082e29f0137db29a5211fe625c988d765faec742f97d89fdb58e115073b9461
MD5 845e480f4299917305df195a057d1b7c
SHA1 199f1c03b997f809b3f21be84d69c32ec2399a76
SHA512 c623a7a4ffcdde41d411f952aa33e37bb8ad06d291590ad8829a923f4982a55af8518ae4cbc647182cbabcb590a952fbbe887152b5e67fa89644115739a96788
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 96f8bff89e566be7877b9dc65e161ba06fa0f478a819f0cf17e4964d6cd0f5f7
MD5 1fd551e295738d3cbb249437ffd0263a
SHA1 fab9e36ed037d25eaac5354c1515d6d258c157dd
SHA512 f66d0f0450ab133fc0837f46cbf29730037521225d0d527a6e20198cee29f1fcacb6867cef9be7ec8a50cccd35c3269663004f5bd42c73ff2988906011302b59
SSDEEP 96:nlkEV1bTjuwpvWMoiVmde1ZqY3ZMkdf4qpcSmFlUWQyV+VD7AiEwb:nlkYxTjuGWMPqY3ZBQqqXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7afe4b03f7b9753faeb72c6f57e93963556589896788438b84fb0c35712227a4
MD5 1e8f1c060bc01ec43fd57199a716225f
SHA1 32695fc59b63cba6b5ba812dc4ef9c553dbb42df
SHA512 1b04db35f34ebb058294fb399863a8e377a8cbd6ffd8422bbe775ce9c87b8a721034374192681e216ed476ecf3648ff37897c2b302765269c7179b48038ba925
SSDEEP 96:nlkhV13gjuwpvWMoiVmdeHvSSFUWQyV+VDCziEwb:nlk/xgjuGWMXHro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 28727f321a35e985f8e6914ffb993dcd4557ff5f43473f92e9f6ba8aa6eea115
MD5 7ba122e01f507bd07220e181d48405b2
SHA1 f3206d340c18732ac249c45a1a02261400fa37f8
SHA512 9cfdc8bc8deaa1db7793571cca53b317619408180e72b591c66587efe9125eec6cd7fb1ff8a619a5cc82c13e0281245c3d79afd5227dd7df6d83c00a911d7881
SSDEEP 96:nlkEV13wjuwpvWMoiVmde1qup1jvSQFUWQyV+VD7AiEwb:nlkYxwjuGWM0uphTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 ebb7e06928e6786bbbc1df3de35abefb13506f485a875ba2e588659eb54d01e6
MD5 75e921084ae917a752e4e57b2294f707
SHA1 f6a267387b221ab0216c8b5e8c85e59b7f2916c5
SHA512 539d976b202410b8564f7775eca4e6ac8ec4a87d18e7fa70f897a10eb0e155c5b3726fc1b3ec9182c5f43eba5826ee55cda839cb48f510fd66732d98aba40916
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b4aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b4aa.TMP
Size 371B
SHA256 b9246047d0b1b6be67c0d7f07e1bfb1490db78d12b86fab36f97198a97f9d4bd
MD5 1b4ca503583e864716e710e50ba056b5
SHA1 05f0d182e172e4aece68f39b1c8d293fc8f8bed0
SHA512 0efdb8d7de03b1ca5b555d82f58c1ff96ca9c72f5317993fe7f67e918d9e0455d303a85062eba2885524f5fc2edf2c5117233cd2f06d8ec21132fdfd96557a91
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c2c0062866d2bb779582e381fb9a4d865efed577d931e06c3e754f2e2f942881
MD5 c7af34d84701c915020d105f8d28235b
SHA1 03a691823d69b22074a686ba2fadbfa1f6fd0ba1
SHA512 fd8f1af6e041b10fe806af57933c27885246a63323291410bed46c2bb2a90a220e25bac78cda4260573e92c1f8a04ea168ae2b875388f33246533c4efa58b383
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptmVe2RUC4uo+OblfBhDaaj:A9iIxuERzA83h09RZxYtmRHo/XDafEBj
MD5 SHA1 SHA512 SSDEEP

Submit Download