hxxps://is[.]gd/iDKEEx

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://is.gd/iDKEEx
Sample241126-xkdf1strax

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
1400	msedge.exe
1400	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1012	1400	msedge.exe	82
PID 1400 wrote to memory of 1012	1400	msedge.exe	82
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 2548	1400	msedge.exe	84
PID 1400 wrote to memory of 4360	1400	msedge.exe	85
PID 1400 wrote to memory of 4360	1400	msedge.exe	85
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86
PID 1400 wrote to memory of 452	1400	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/iDKEEx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfeac46f8,0x7ffdfeac4708,0x7ffdfeac4718
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3028042256824826111,15033951997762213569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 93e5f2e9fe223b09394b23b295d89fd5f541980ae87b2917fc55549de08b2968
MD5 2e5e7c6f1833beefdc54fb91e43ec907
SHA1 d5f136ffa04e46a6bf35f3f1f679eeb69ec344c9
SHA512 8946632f1b3fb5bba5eff7bc258ab70dc2ed1b037f3373265460869450f17af589d733de454dfd98d67aea8e052da55ebc80218595e0a57da0187c1714fa4773
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 acd62863f1b6aaa16ec1fc2a86cd138e8f7729bc69dadfad12cfb1320f0300f3
MD5 13357c96213cdeb2ec6b85c4a8152831
SHA1 c03691c7c64800322b34823cb746bbb2f2d2b2f8
SHA512 e06b4706b3d206ace35ddca8ff8e754a74606e77fce2eef4d19c19772de5ba44ce8ed3b1d38614e884af312ea83c90bbdeb444f06e47f33f5821d71312a89f18
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 22b61e0e9b2e70a45cddb8242468ec68ec5933cbfed0384ab3b31e4f55644d7a
MD5 d51054b4629de9db05116c4afeaec180
SHA1 eda0e57c1bc506f906615fefa94c7bdcba7239bf
SHA512 588ddd635797b955332a79f1fad41dfac8cb0bd3b4c087851449448b3ec2bb294ab34130e5e9a1489f84b22a5ae8c5918ad6d864a4234491e3b110fc58619e2d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3e024e38fa9ab5efed708153a7c7e5b8b3bdf362702c7132845f1255d34f384c
MD5 1ec08c7649d122874e66751253d26b9e
SHA1 d3d4ac0b569ce5dc07da8bf87cf0815e15924243
SHA512 04007c98e46ec6da2e6a5efcb1ce622d95c1e786b8d71f0ceddda618a2bc2c4adf5f437f1c2d3f04d2ea46cea4f2fabff137e802cf5cc1d3f4f85c0ab638f5a7
SSDEEP 96:nCvkySa1z0xwwpvWMoiVmdeH7Ck7eBUWQyV+VDCziEwb:nwkaixwGWMXOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f4fa7588ce606a598e8a578e4da14f3d670f30bcd4492655eb022d8198a5cb37
MD5 8e8aa975677282b01efb70ec29e85aee
SHA1 246f6f933f5927c4e374fdc8ee5dc88a7b4dd24d
SHA512 ae63ae5a942043c5ca23bfec553def9d6499aba13b661b80d3487e1bed6a8f72910ac96d3f415d31d652ae4bdc6a9a05cbbc4501cd38a86e04f433161cff0d9e
SSDEEP 96:nCvkxSa1zQhwwpvWMoiVmdeszuYS1j7C5I7eBUWQyV+VD7AiEwb:nwkXihwGWMuuXhirg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 17481a2bf454745ddfa7d233621fa1e784e64d8f9081488ba15bedadd348d1c7
MD5 1be3d676d31afcf93046424f9558fe91
SHA1 7e364661a5656aa396a648f805c0231485005c57
SHA512 4cddcd69e7e61e8c9fc4d501464048466b519addab148be2fb2e019cdbe14af52c3c784898d1b0821913d48cdbbf261365b46b1b8222f4731d9b09b6651b81e1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5816ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816ee.TMP
Size 707B
SHA256 e04bef739b4795da1d7c7361f8f3702496e4d5402b0cff8b03f1fdb8aff2c7de
MD5 e7dcad8557139f596aaf0fe7f88cdf9f
SHA1 97c9bc508537af557af26134aa1322284ca04a26
SHA512 f9496727c24642ed19d67266373df3bf4736d022e5c0cb1edb7d881e3a279b51c256f57535cf8df9984c22e75fbf7a11d78dd62fed06eec6fe806cb3646dd4c0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c180395cf41a2641155a9cdb8f13ed890f1a9e773d7f82e963481648d4132acd
MD5 893f5b0879b3c28d9812227de785a785
SHA1 50f4d670a9b9a4f473a880657ea6b8db5bd9eb4c
SHA512 ee51e31fb6c030238d1cd16d675cfdf9154719b9dd7a56305a38d7cbb4e5139db7ac2d28c1410ec942f70f17308af993ff5fd1f083f2e964df88bcbf311ac0b7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB5ge2RUMB4nD6YdF980JQm:A9iIxuERzA83h09RZxYB5+VQ6Yi0YZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download