ardamax | 3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90b0b68127f75c6a3440d7e01775559e.exe
Size 2.0MB
Sample240205-bzg7vsffc5
SHA256 3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9
MD5 90b0b68127f75c6a3440d7e01775559e
SHA1 ed6f93ddcc2e36fcf50f5e5cb8dddc6878c83e1d
SHA512 81aaedb5ecd46b75a5686bb201b725bce398531a19918887a7369b593f4212b8bdeed418247bc4be1f5bcab656d15974d8e1d1e3c9ea714d451faed3fe098aa9
SSDEEP 49152:zKwnQ8lF+i3nE2PKIgrMWbid/swD0CU/2wZOIn:zKOb2izPMrMWs3DU2wZR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e5c5-100.dat	family_ardamax

Loads dropped DLL 5 IoCs

pid	Process
4552	90b0b68127f75c6a3440d7e01775559e.exe
4552	90b0b68127f75c6a3440d7e01775559e.exe
4552	90b0b68127f75c6a3440d7e01775559e.exe
4552	90b0b68127f75c6a3440d7e01775559e.exe
4552	90b0b68127f75c6a3440d7e01775559e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
2308	msedge.exe
2308	msedge.exe
3812	identity_helper.exe
3812	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 2308	4552	90b0b68127f75c6a3440d7e01775559e.exe	88
PID 4552 wrote to memory of 2308	4552	90b0b68127f75c6a3440d7e01775559e.exe	88
PID 2308 wrote to memory of 4888	2308	msedge.exe	89
PID 2308 wrote to memory of 4888	2308	msedge.exe	89
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 5076	2308	msedge.exe	92
PID 2308 wrote to memory of 4416	2308	msedge.exe	91
PID 2308 wrote to memory of 4416	2308	msedge.exe	91
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93
PID 2308 wrote to memory of 2580	2308	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\90b0b68127f75c6a3440d7e01775559e.exe
"C:\Users\Admin\AppData\Local\Temp\90b0b68127f75c6a3440d7e01775559e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ardamax.com/keylogger/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98bc46f8,0x7ffa98bc4708,0x7ffa98bc4718
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2893866475623021777,16517841471758525013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35
MD5 eb20b5930f48aa090358398afb25b683
SHA1 4892c8b72aa16c5b3f1b72811bf32b89f2d13392
SHA512 d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8
MD5 SHA1 SHA512

Submit Download

95d6bb48-6898-4351-a754-4399529f55e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95d6bb48-6898-4351-a754-4399529f55e0.tmp
Size 1KB
SHA256 79488ac9fc4d29dc6b1fec16246dff7ef9723cb9a0e6c4cb5767617f3617b5d0
MD5 42eb6d80f2e9c5e2d3cc523824bf9c45
SHA1 47178a387e71f6de03312aa25ec57fcb5ba12989
SHA512 8c6deebf9d8be989d02f196a3be419ee2884d9a5b2842af899abcec933a32f97f0d76b5c6f4eb453820c1c8976886b795695eee93389c82b933276f4af687e07
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 59e85c40e64af5a3858ad851b609b6dafdb265b8e11d17b06a5e0c4aa9b19c97
MD5 52d62cbf0a336afd4df4d65068349af7
SHA1 51982828642012da918a01be11c65320d1f94b11
SHA512 3610291f269d0355f8a69d597d6ec3a675c8880229497af645b0c7208128f64600a731a12ede2cd7ba81b32a70cf1827005708db742ff363c0e5bc88cd353428
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dd55f181b14829014fdde4f1065a9dbd48ecedcb09f07dcdb244a94115b1653a
MD5 ce7ecfe49b30d15219e1a0653b74fcd4
SHA1 d96e1df76f153cc6843d8cc4abecf38517ae5f06
SHA512 b66da383ca814a517a3d8710b8308ff8396e8a0a0f7e6ab0f17b65d641463b4e495060bb1bddb0ddd6b0a530cf27092ca517abdb38031f92953400155f2f1f47
SSDEEP 96:nZkcVK1ubwpvWMoiVmdeluy1wIvSqY2k5CXOF9UWQyV+VD7AiEwb:nZkYKwbGWM1uyCDJ2knrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 24bf60dabd593a257b648f0e8b71889927ee39ac137178ce1c7b49be6af32a4d
MD5 0b8843f23e6b09814283491720a4ba58
SHA1 1783d3abf3ff0a66d0f71415243d885d399db363
SHA512 ee43ce1bc40c309d1162226e0a3c21c2e6f1453905478918cf2d997b801c8a34ca8809c31c43268400b09e5c71e8cf73504aacee053355f61c980c87387b639a
SSDEEP 96:n/kAVK1urwpvWMoiVmdeHk5CX09UWQyV+VDCzia:n/kEKwrGWMXkZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd
MD5 2bbbdb35220e81614659f8e50e6b8a44
SHA1 7729a18e075646fb77eb7319e30d346552a6c9de
SHA512 59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899
SSDEEP 768:n3UWLT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpLl3wrUGxzBy:n3UWLTu1jaALpuzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 54ed839e54325fdb54082aaa01b911359230cc3340c8c1567fddee78b6b91f9c
MD5 c35af3c1be84f2a8d765f743011043b8
SHA1 c0c7cf2e0a55fe9c49cdcf50071b5e3b79571b20
SHA512 3401c05ad47e51126b2a65d3e0f40a1d0b34e4c9ebcc0f7b4f28142564623ee6ba10277d2a065874474667dbe2175a681d62fe4965db90bb1b67e8eac4b19657
SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAI5e2RUuFZtbRQhTw8AftG:W9iIxuERzA83h09RZxYAYzPz86W2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\UAC.dll
Size 13KB
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

Submit Download