2fd86f06069a4cbbe9a40cb6c710c77eb1b436874745b1b9a078510ac2e5e384

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe
Size 23KB
Sample240525-t7bddsag7w
SHA256 2fd86f06069a4cbbe9a40cb6c710c77eb1b436874745b1b9a078510ac2e5e384
MD5 abfbccfd1dd51687f33416225a3b61d0
SHA1 daf6a2919f730d90a26f2694577eae759c0bf17c
SHA512 a99f35774552a1737556c7f63c8cc9cdeeaaa9ff0dfe61494ee50bd7481ffb1d513d361d7ceafeaebc3f2d88a1474dff38fb28b3f90a65195d08fb927fbb00e3
SSDEEP 384:+Ymdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZYV:hwWkti/aeRpcnuL
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
4672	msedge.exe
4672	msedge.exe
1016	identity_helper.exe
1016	identity_helper.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4672	3500	abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe	99
PID 3500 wrote to memory of 4672	3500	abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe	99
PID 4672 wrote to memory of 616	4672	msedge.exe	100
PID 4672 wrote to memory of 616	4672	msedge.exe	100
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2872	4672	msedge.exe	101
PID 4672 wrote to memory of 2104	4672	msedge.exe	102
PID 4672 wrote to memory of 2104	4672	msedge.exe	102
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103
PID 4672 wrote to memory of 6136	4672	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa027b46f8,0x7ffa027b4708,0x7ffa027b4718
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:8
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14166120814776285682,154972962889344822,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4112 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=abfbccfd1dd51687f33416225a3b61d0_NeikiAnalytics.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa027b46f8,0x7ffa027b4708,0x7ffa027b4718
    3⤵
    PID:1220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

9dc5e2c9-26d7-45b9-997d-1519c4742bf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9dc5e2c9-26d7-45b9-997d-1519c4742bf3.tmp
Size 5KB
SHA256 11bcd24987a1042a784960127d86e1eababf97b76aa38896caccf10a4f48e2b4
MD5 7fed5e292e190e60ce2470aad3f3eab8
SHA1 d36fd06a74ceeb2922806ee42b81db38e7ed6196
SHA512 fc42a7b1fd37bdcad5f71a9c8bfb4b7ddc20454b84b1741a02c365f6dc4f612eeafed8e2595b850fa68c34cd59d357cb13a1d83d40876b7b796be5bd13669249
SSDEEP 96:nw/kio1M1wpvWMoiVmdeHBrzOUWQyV+VDCziEwb:nmkjy1GWMXIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 8a01b809177983fb382d0a1685323c164d8baadde09199b7070604eaa484c0cd
MD5 653ab61c39552ea42963cd98d3178df5
SHA1 63526d7a2508aba76ce701b892307efa797a5cde
SHA512 0740f842331bca15496f738c4163bcd568409df70845e66f5a09cc91bfe35dcefcf7eed46ee1ab62c032912c3d7d3ad5a96f1e8a279d1132d84d2a7cc1068e30
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 caeb22b14c579696625d2cbfefec7d12e164a178202f005666286adb8585c68f
MD5 3fd99b3eb62b22c535c1ef38ebe5dede
SHA1 94a7bca1dee9e57301e8dcc91ffb3e1c13cb65a4
SHA512 c3080a66b5ccbb606e8b4fdbe411cd3163c1a6ef132cc037c8ca4940b495136f47ec9a7bd302863f6f432bb4675d142afe2d061c101441504d0686dd9af39fcd
SSDEEP 96:nw/k5o1YQwpvWMoiVmde19YXMkdflp6r8YUWQyV+VD7AiEwb:nmkySQGWMXYXBNcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c6c35cecb0368d415e5532c3064b513061d5e73f4a30cb80b4183a6769a50071
MD5 5792217aa3d0686d66f972085238d455
SHA1 e884e6d0fd3a409e3027c530faed57d12f4a6574
SHA512 4fcfa9ff69d67ee60cb26d552de148c7193708c851a17d08469ba3346b8af050681953c222228d050cd29fd1edabc6301b213a9aeec4accb9ef1972f4216edaa
SSDEEP 96:nw/k5o1MFwpvWMoiVmde1Yuo1jBrlOUWQyV+VD7AiEwb:nmkyyFGWMSuohWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 af38c429e218e6aa84fcede934235d60d4acb5b1b6f7cc62f4f59e0c4118df73
MD5 07b112ced31bdf544ee1808a0ac07d7c
SHA1 7a9f226d7d0dfb9a96dfada88f3327cd3cef71dc
SHA512 1f7ccf25329ea642306a8e8288258ce922f4755e5df712bd528587e525879dda42ccea86e187d95f4163a02ed198b56213a3dbc561673d8fa4208115dcd0ccbe
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b74a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b74a.TMP
Size 369B
SHA256 36fe10ba8937e9ea116dcce6e7400d295ad36e855406951667c0fa73a1d9bb6a
MD5 ca72cdd58e62aefd6e2fb77614960947
SHA1 b144b8a52d3983484d9d01ea81e2040fe5f50370
SHA512 c0130bdf0443aa0eba1c4dcb0414b19499be6e31183532b68fd3d867b3df890b2b3e89a4db6ca524f5b6ffa6c698f6904624e2663313868ff28df113b780e415
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2a459210a2227d4d517176277b8fde6823fdf81e6b946cc66601b9be29cbeb60
MD5 3a903f0a1e872220e899de62e797481c
SHA1 e1ce4ceade8eae40001d320a63f41c7103628d74
SHA512 157b19870f3deffbfce4a9c71e4b1174c0def35acab72bc30f31d71b8ae300b560d08bd548366f4d1de75bcc3b531449a1bdb02bf6724af96e00e9c1394ce6e4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbHOe2RUUMj2d3z2OMDCRH/:A9iIxuERzA83h09RZxYbHQ6ydaOMWRH/
MD5 SHA1 SHA512 SSDEEP

Submit Download