hxxps://cm[.]aehgre4[.]sa[.]com/krg[.]htm#test@sk[.]com

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2024, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cm.aehgre4.sa.com/krg.htm#[email protected]
Sample241201-3f2wpssmep

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: sk-btn-investment-still@2x_2024-07-03-002923.png
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
4884	msedge.exe
4884	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1388	4884	msedge.exe	83
PID 4884 wrote to memory of 1388	4884	msedge.exe	83
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 216	4884	msedge.exe	84
PID 4884 wrote to memory of 1456	4884	msedge.exe	85
PID 4884 wrote to memory of 1456	4884	msedge.exe	85
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86
PID 4884 wrote to memory of 3648	4884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cm.aehgre4.sa.com/krg.htm#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae5c746f8,0x7ffae5c74708,0x7ffae5c74718
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4273890130351320525,18093274198753973917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 13742145e985fdab9947dbbd56d461670cd14298f501f26e806e37912f0cb89a
MD5 381b93dfe023242ccddc1d655255c244
SHA1 7c41f4174a8e1db42f509e9aa277a126d0337eeb
SHA512 f433013826b57acefb2c272ff6207115619eecbd3439af38c0cb5fcb5177571a7431c7b443f0f96289ad36e085999d46bdcb5aa1edbe4c146f2f6f550bb1697b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 85f729760141c72116391084d3883994bd81cb2c9272177dd72beab527d4b3d5
MD5 070d36394c38bab4bd1acb230d9d5b45
SHA1 d80afdb2da14746456a72cbbd84cd577f4c99d99
SHA512 0977798fd52828618fe486993c966cdabc75e02aa0e3bc721e97107edb98f766209fd21dc329b4c8140bde4a7d2d1de74fff340f526f7e43cce9743b34958664
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f98019463028c1de2edec5d70e8af8dc6d46185085ef949bec4be0cb07d929b1
MD5 7951e7ea3e3ea75f1f7ee529009f7154
SHA1 dc336901769e29e9c1dffad8aea4978a8c34ee71
SHA512 5427f1c39cfb9daca056969594f9e45222243ec50621a13761e19a9653d747992859e6649ad4472b0a8aa7dbdab1d1bf8d911501df129bb01b1fc7c8f2d24edc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 aff69944ac608d5036dc41837b3fc118c707972498c52b3b262dccbae1aeaa98
MD5 e2c777735e0ec5680eb47656662736d7
SHA1 1d611f146549520827b45d3457ec112d704bcb37
SHA512 9ff2e5414a81f6f6c2ba59aae07eb0773eb4f1c920845347a4b3b330db63609e31113ecfa6b82b057cb914235bf32bcb4a96b7427b5f0bab7b4b2440ce79e53a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 9bb238b6ea3c6028ae88ed27b299d0e1d119b1970af80a98f8b37e40ff73ca7f
MD5 085878e1a6b5dd5d313c8f7ebb27c5d1
SHA1 5a33ee88c304a4e0c09d3814c68b3bf0886d68e0
SHA512 703517e94e4895b83cd3642d26d6708dc7fa2f7a8dfe6d5810c99f8930cd903b8e3738ee82cf713f2b51817c66258f028e10f4f9bacf193af8e52357a9170eb5
SSDEEP 192:nKkeb1Apvd9YqXu5roTGWMEJbc3A22cvx+rg:nKnEv2BoCW7iJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 3394032196a475dbc3b893e37af9ae49864303887141a37f62a8541ef07fedb1
MD5 6e3587c17a94d6db2ce735c650baf9a7
SHA1 5b88676219052942ed14e0e77b206c4b0898819e
SHA512 11506346b304e00cdaf064bb4b2db1096c68fa00a7c6e0d10b8b4dc3b00cfd08d4a12222b6775c49df4b40ca844d1f3860db23123d7573c60704a3156d635b1e
SSDEEP 192:nKkeb1Apvd9YqXu5EgNAoTGWMEJJIzA22cTx+rg:nKnEv2YoCW7QJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 332e48091b2d7dac59a7a4f2a20cea5337aecbaf849c573820cc49d1ff18c230
MD5 9fae29f025c8f3b2247bbdc125b28bf7
SHA1 1efeab69fb27c8e3b4be7bb37dbe46852266574e
SHA512 97b3095be93a696270b4e77f9ab7b509e2035cd8205cd62efd83eee21feae0c0b35c7498c6c67a65e3dc3f36dad5af690acb0b9bd20d07a1ee79b6d4b42a855c
SSDEEP 96:nCNkrSF1eTwpvWMoiVmdeHhOM787F+UWQyV+VDCziEwb:nKkqoTGWMXcPx+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5acc6bb865499897216ee5f8d003f18b6b0ee513911dc75ae93cceecb1f77504
MD5 6f62b248bbec82abc82cf4728b1b2824
SHA1 72565abc7bff02f92289b63c19f5b7ba0c5857dd
SHA512 9d38d03f15699596c0faaf6544e8d6a99f5e02bd7312762b893b6e87107aa898b484e3f2f37f95b261fbc825498583c73d6f597988ffd5d93d70b7a9b7621303
SSDEEP 96:nCNkLSF1eTwpvWMoiVmdeU/zuI1RBAQOK2hORI787F+UWQyV+VDCAiEwb:nKkKoTGWME7uIRA22c9x+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 92c622f68f07752a853bd407dd8f1b1f5143a44051b3259c3d4805a9ace04c93
MD5 53945172a1a038f5401d0318d6152fa0
SHA1 51d8114446d0418c5249504eb0da6b5eafca4fb0
SHA512 f4add31b0905b583f63482d9620d7bafb854de464c451775ca502efbdcf82154c60cec5aa681d73d71628495d5ff122ce9853f1d719283c03c5361e19b1671f3
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5994f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5994f3.TMP
Size 48B
SHA256 7d7cccc34776661c5bcfbb5ac403d694ca4b3f4d2023e594c590104e9dff2d5a
MD5 dc293514ddf459376eb4dd38beb03095
SHA1 9e62b54ce4b2deed09920b9ea4a8c7054e98d1a5
SHA512 a065e05ac45c98d1e81e0e014e149e90b3f62be4146ec8d68cc0f86b8e1511043ebe9304530e0c4488d67d8c3bc4a21cd8cb0fb177e19d4ebe6ea374fe4f0184
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1ea041b19ef54629f6aa478136b0b784f57d3e1072899f6cdf2127902a83faab
MD5 6ab6a0ff3c5df8a025cbbcd624dc4b8c
SHA1 46ff672e76d3bdc6842a4bc336583d771c177426
SHA512 ffde4ebf975c9f32465c7738b30c755bacd9db4cea265c75cf995815f69118d858726a535a04939f7e0857e6238df8c6a14a7250dd002daa120b93df80e309f0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 d479c53bd6d24d48dbf53c89381c78de732c924e7836d66943463a43c5c486d4
MD5 0f0e81a44cccebdb87fd1f500afc10da
SHA1 7ae69bb0887ae9ef0b43440ae99e50df771c6ee7
SHA512 38bf99f36c71af1f86f98d37a85685e73a05f555698036e451cf17072a399e985537d8278daf61aa8284f4876a1e7c14f7877c7265c9b6ac77c8d5b9ef467be4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 831f2a461525e60853171442de52b89fd82b048daf3c9b6a4da24663d5baf333
MD5 6115406346237a59f526fe19f3ed44db
SHA1 d17c83ba62e5e6fa2cbff1de498b6afaf4a2575d
SHA512 84c2469c4475deb2db1cfb1bbada46f3fd9d8c767fdddfdbae9970599a4d8b26ce7982422635d0d6b8cfe7d9b3cc912283fec527a8959be751627f474687e2d7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58cf9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cf9f.TMP
Size 370B
SHA256 6d599ea96c2dd24e5680c63fd00fbba7182809b7dac8c1d2502de3b9d6d47687
MD5 1500160a4e5ddea8c9e32f177f2d0c9a
SHA1 3e8e7ae1fc11c9afe8f2673e87b3861b2aaa3a2f
SHA512 ecca88be82e68826029f665a35c710a8a7efe1865735d933a2da72f248f4144b9144042fc4e60ee724e0f1e2dc68a3d1daac4215c709df74267d4c8182a50132
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4e4610b4cc9bc3815dc91170f6f4a94c7fa4bfc9652115ba76896610e95bc8da
MD5 ec840a50a7d1a97f5e7922e2f04c3567
SHA1 0fdf64af67b0bbc4134a1fb702d573d7d815792d
SHA512 dcd5939e363a89f0622b8c646120827b5b6737119fe376c245447d91fc4c674a024d766b611d162c25dec2011247c60a5df657a2ea9a5c3e2ab682c7eccdac42
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm82e2RU6IsKYdF980JQwUH:A9iIxuERzA83h09RZxYmXZKYi0Y2u
MD5 SHA1 SHA512 SSDEEP

Submit Download