ad766d035f625ba652513e2867faf90806c9f0c3048174e24f736d05fe9f6f0f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninst.exe
Size

376KB
MD5

e912a6ed3832be1d40f3aa5a925d97bf
SHA1

08dccfe1bbe4f104613eb6822aea486812e5e4ee
SHA256

2109e062e3fd01c5f578df3c4f881087f0ab41cd287036005b05589e81156d19
SHA512

7e17f79fb572d6c449e7a8d37d72b16e3150f2aeaa8a86c1910e65632154e26e7f28070bd4392bfc8fbcfc6ecfb004267f9b374884cf3cd36f647f1c1df71bc1
SSDEEP

3072:k3c1fP4AJJT2WrSfqW4C3ZtmltDcFtlEesjdQ317NL:mOPjH6qY3lEesQDL

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4376	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	Au_.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral32/files/0x0008000000023c53-4.dat	nsis_installer_1
behavioral32/files/0x0008000000023c53-4.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4116	msedge.exe
4116	msedge.exe
752	identity_helper.exe
752	identity_helper.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4376	3312	uninst.exe	86
PID 3312 wrote to memory of 4376	3312	uninst.exe	86
PID 3312 wrote to memory of 4376	3312	uninst.exe	86
PID 4376 wrote to memory of 4116	4376	Au_.exe	88
PID 4376 wrote to memory of 4116	4376	Au_.exe	88
PID 4116 wrote to memory of 5084	4116	msedge.exe	89
PID 4116 wrote to memory of 5084	4116	msedge.exe	89
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4476	4116	msedge.exe	90
PID 4116 wrote to memory of 4932	4116	msedge.exe	91
PID 4116 wrote to memory of 4932	4116	msedge.exe	91
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92
PID 4116 wrote to memory of 396	4116	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.rmzt.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffed5e446f8,0x7ffed5e44708,0x7ffed5e44718
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16800451870291312210,6323469870225888352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3596 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21eb3d56e65690fc560b16169a4c2d3b

SHA1
835edad5648f09fe61d4801af28d917788a540d1

SHA256
1e7be33e740fc36e478b1c269e40f800236f1b765ce079b379024ee05164964b

SHA512
39e95d8c0f97354df8f26b1ac31427ff702b66d378936d213d139b05ce3c288d657bb7cd500de218719cf3d96139fd82706c2d9489e9d050bec606fa1fa6c299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d1b3d8922c869b9555e6badcb980c8f

SHA1
65735baa1b58a5edf0d2cfc77880fe806ec24845

SHA256
80a94180e75a94d3cdd5f79184e5999f506be5b1468cdceae13a839318ed9e2c

SHA512
a65ed3bb1c2710ea4888d63c852aa082bd75626ef8d26bfbedcd254238ddfb591762fdeaf1fd0026c38c61706d744eb26a18362daf7e34363ce0eacc8001fff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b904de72719fd703f45ff2bf3793b32b

SHA1
1176acd1541aab7c82026d4352fc76b0a05f5f84

SHA256
f8dfe61c5fca4927989a6668b0c09b5dfa6776962d7a3d08f6d2720c9f853372

SHA512
742aa350d97a16f4fa4bcafb02ccfcc2f0bbaede5de6222478ec7db83d397148a5c984e836f89f10768cc2d1ab685b5fb9e0a0051cf448b9911d84b18e2314c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
376KB

MD5
e912a6ed3832be1d40f3aa5a925d97bf

SHA1
08dccfe1bbe4f104613eb6822aea486812e5e4ee

SHA256
2109e062e3fd01c5f578df3c4f881087f0ab41cd287036005b05589e81156d19

SHA512
7e17f79fb572d6c449e7a8d37d72b16e3150f2aeaa8a86c1910e65632154e26e7f28070bd4392bfc8fbcfc6ecfb004267f9b374884cf3cd36f647f1c1df71bc1

Download Submit