e4bb9c7a79e633f3a4a436815310ba1e8d5634a6fb1b64cce4908c3cae459dc4

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2023, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe
Size 149KB
Sample231020-zdnphscd25
SHA256 e4bb9c7a79e633f3a4a436815310ba1e8d5634a6fb1b64cce4908c3cae459dc4
MD5 ef2b6fb5dc1336971409c554dd2e4bb0
SHA1 12aec986acf45e4f7bf8db6da5629abc0a53b7d0
SHA512 aa927ef5025d032b4065319dc963d36e995aa48fad9c7d6dba33ba977c5815d5e26cfa25671d1134dfecd7b54c5924d327968df6e570ab4e6cbcbd4e5be0b434
SSDEEP 3072:TOG9FzSOKlfKoHOnRvbkYOO8tQLlmjDpt8BWJlHZKHn:TOG9FzSOKlfKoHOnRvbkYOpQRe54
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3796	msedge.exe
3796	msedge.exe
4800	identity_helper.exe
4800	identity_helper.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3796	4392	NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe	80
PID 4392 wrote to memory of 3796	4392	NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe	80
PID 3796 wrote to memory of 308	3796	msedge.exe	81
PID 3796 wrote to memory of 308	3796	msedge.exe	81
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 4992	3796	msedge.exe	83
PID 3796 wrote to memory of 3840	3796	msedge.exe	82
PID 3796 wrote to memory of 3840	3796	msedge.exe	82
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84
PID 3796 wrote to memory of 1052	3796	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffecc2346f8,0x7ffecc234708,0x7ffecc234718
    3⤵
    PID:308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9243607652088632955,10090098838980763439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.ef2b6fb5dc1336971409c554dd2e4bb0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffecc2346f8,0x7ffecc234708,0x7ffecc234718
    3⤵
    PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5247adecb13d0664e188ba65524419d0b4960e948b267bd1a059e71218b49d5a
MD5 c0477e8d5f2ca61e6037746d359e0e27
SHA1 025ecbf1ee3429c252baca04b648b0b1c343d5b6
SHA512 f04dd3db67545bd46ea597d514272df57d6040ec8a3d391d2bfed09d5a1ab96943fa5013f850ea5c3b56617a0a12949ea75ecac892fd167a329ee8fe01189c5d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5247adecb13d0664e188ba65524419d0b4960e948b267bd1a059e71218b49d5a
MD5 c0477e8d5f2ca61e6037746d359e0e27
SHA1 025ecbf1ee3429c252baca04b648b0b1c343d5b6
SHA512 f04dd3db67545bd46ea597d514272df57d6040ec8a3d391d2bfed09d5a1ab96943fa5013f850ea5c3b56617a0a12949ea75ecac892fd167a329ee8fe01189c5d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 d177b825cec6be9940448bd88b17bc61df4b048ad6b0035754dafb6b92d8b4fd
MD5 5e7e5d65a5701079476f947383cc88bf
SHA1 4c057bc779e73694d37f88f229afd4bb9e96c8de
SHA512 d8e2ae83794916b5c92cd2a4b3a5923ec3161a98104bca7d1614aba0e2cde39aa5a7707f5f9ca5d328e0a056987f30d44cc9e425482495c33590e3dfc1c0e900
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2337f86d912be92aee631597cde7d8474dfb203218ff18d4ca2f0733fd8cca15
MD5 6fd1a02ae3ce7ac53826c6a577d83cf2
SHA1 ce3e8163f9ec13b696fdb55ea270856354b56837
SHA512 b65fe1d76dbb65dc188e6d46b19fff6c6b6573ad7c40465e91c0a415ab4536a25680a13ef3e80c70d0054db96ce70e34422f9719b103d595b600609e9721cb62
SSDEEP 96:nlqkD13Q1Cg4wpvWMoiVmdeHRLZUWQyV+VDCzia:nMkWstGWMX3rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b0ec30ff959e6a8cf0f9856a5475ea8906708169480feb0caac483fa289752b8
MD5 8e3b0a577db11342900e72da06437125
SHA1 6928b57635e2038ae50cc3792e09a005aab3b31c
SHA512 773772e5697f219a6704d6930f8783ed0331ef6194a1f553db89acc98c4b57059f8573acf8fdf101e9897af1f91cb154d32da4227d239fb40b8ece4d8d6bad6d
SSDEEP 96:nlckgY13Q1CH4wpvWMoiVmde18YyMkdfbpmdf+UWQyV+VD7AiEwb:n+k84YGWMqYyBTw+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2c8f7f4b296eb028c5236359379707029e78eb8aab574c620e76300e42912b8a
MD5 0938cf19592afb44d0bcac363623985b
SHA1 ecdf7a20ed208dd9eafbae08f9601e11783e6c4a
SHA512 48c725a477ceebaea1c67c68594d6cf980c0f59c18a674bf1ecdb8ea4d8b7ba7f2941dc2a675bb42e8d388f5db3699100b56e4cc6dffc2d5ca0b7a9e8a33ce7c
SSDEEP 96:nlckgY13Q1Cw4wpvWMoiVmde18YyMkdfbpmdf+UWQyV+VD7AiEwb:n+k849GWMqYyBTw+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 0b0187771ab2a3ca3d3d74fdc473d3baa8844d2da2ec6961ea9014f43896b99b
MD5 78ddf646b677edfdc3743730d0ae969b
SHA1 2834692ca105a5387afcafc2179d8e1021909ae2
SHA512 2f67041538953615c6804c362dbad816089d1a5ed603478d491e52029f7678aa5b1a1fceb913445ececc98886a54a1491d0a0fd8f5cc695601dcc48d05a16206
SSDEEP 768:nfEW1j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRLlVcrUyNj:nfEW1ju1jaAL3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 74813f0be548da1b40c6fdc4e26a78f35fe93c841937a01e3e31aa7f08ba69c2
MD5 c881b8693524e43fe67f3f5e01f7d19d
SHA1 c7622a605028ccf91b8557a669b759224e0590f0
SHA512 af4dbfacfb977ad5423dfabd6404de5a59c0ba6c654d7d17e60b80c5ce0a834462c1600559959a9eb9e6e3d94b15975c3870afc096516bf25c00b1f85f7f385b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5846c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5846c8.TMP
Size 367B
SHA256 7b5c50118a27abb07243d8c7bb074fd903b80e9b0d0b0aaafa463432d3db6ae8
MD5 0a496018eb2a8b074f7a2eff730bd5d9
SHA1 02d13962843bda62880107a782f063ec25bb896b
SHA512 d045fbbca7ddb810c428b914ca7bf39e6b324e2e37ef664a7350658fff1f974f0b488abb3f20d12761f16b0d1507e7d51d37c966984faf41c0bd8bd77450fe71
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 be210e51e5c10f7666b28c7fcb1f6220c2953333b8398ca77c5b68277560f39c
MD5 d2f4025f3e40645daac1cbde8397a58c
SHA1 45a82788bcb90b8120e59d35eaada7100071bb9c
SHA512 3e736d5dcca6d4e0cd38af46000c8a752214d2bf02cf1062c736d7cf4caddc36fe6dc6849ec11782986bdd6f650d8513a849c2f7268c3ea431b1505a7223dd05
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVte2RU/9S3bAMTLdLlAuss:N9iIxuERzA83h09RZxYH49p4pes
MD5 SHA1 SHA512 SSDEEP

Submit Download