77bb35807e4fa5ccde415bfaa04496fa64e69e0c8a08163a37f3ba77af5f97a2

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mirserver/Mir200/Envir/更多版本下载Www.Uc955.Com.html
Size 371B
Sample241019-pvbq6swdrf
SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
MD5 d726adaaf77a5393dd5a4e76daed3df6
SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
4560	msedge.exe
4560	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4712	4560	msedge.exe	84
PID 4560 wrote to memory of 4712	4560	msedge.exe	84
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5104	4560	msedge.exe	85
PID 4560 wrote to memory of 5072	4560	msedge.exe	86
PID 4560 wrote to memory of 5072	4560	msedge.exe	86
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87
PID 4560 wrote to memory of 432	4560	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mirserver\Mir200\Envir\更多版本下载Www.Uc955.Com.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fffe78346f8,0x7fffe7834708,0x7fffe7834718
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12760966091803986724,14651542048583700703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

281c98e4-b836-465b-a722-88866ce99c48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\281c98e4-b836-465b-a722-88866ce99c48.tmp
Size 10KB
SHA256 82df800fe210dae97b57212aa58af32b90cd4a3ee688e171ca234395d3796a15
MD5 5237096eb4b4b4d488c4264edb047cc2
SHA1 0b98b0aa8b2fb1172e2b3730fbd5470cb4c7bdf0
SHA512 b9cd043ef99e6ebdcb39148efcf501d4eef3bbaaff09e4e80b987e44f6bc05786a4e608df27d64bd99490cadb187599081d0a691c2f692695c23bd894baef166
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXTje2RUWqml1K3wyLUu:29iIxuERzA83h09RZxYjzlXKhUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 aeaea05824d5d615162c13c69bfec06cdd15b8784c8280b01bd0f0d158bbb0a4
MD5 8bd1f053d3c3026142445cd814d51587
SHA1 cc1b886b24d0690616245d9bf6ca5063f9680731
SHA512 c084ce4ec4c84f935cde280728609d997600e26da3c9a5243dcb5818f5e1e19ea7b89760415b6ba861ff4fd1acc5fbbb83e96e1211d44c75dafb007dc683ff89
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2d6203596fec7dd05e5db6b69a608d86c87f0250fba5529a87b43c9f733fc6a0
MD5 14764d08290aa5b3ea5c8e2881948508
SHA1 9f4598882530499fc39e562172242492f27ce8f2
SHA512 fddb6e0c0f6a74de4affbb09d4c7f3b779944d414f1cd8c024a31eae6f871ca082c0d2b6d7de7c386d1b3987e889ad8cdaba6a96021c0590ab7c32187fc75340
SSDEEP 96:n8kyN19UGKX9wpvWMoiVmdeHtyHVuNUWQyV+VDCziEwb:n8kmXUGKtGWMXt+4Nro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 53cc84bbe4756a2f8830e8ddacc007e5519060358d8386cf6794ebf21e5e6257
MD5 8ca79e2d27965251252fca0c41ef0087
SHA1 15e8a9a1836f4b8c71d2c7c3207ffcc7cbdc82de
SHA512 e779dc060f11b38305216c6c4ce58a3af20c5ae4561d6e9ab787463ed2637caf399e75f214edf78c5d0e8a77bd7f71de595aef55967a5b991bfe793ecc3c9a6a
SSDEEP 96:n8k8N19UVKX9wpvWMoiVmdeHtyHVuNUWQyV+VDCAiEwb:n8kAXUVKtGWMXt+4NrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 763bc4c942533f16d0e56de0b079b15231db1f0df5eb836582915fdff3fcf47b
MD5 fca27a9bfdd260155972076de07aaa84
SHA1 a15540b84788b9819ba1f0d7cf98e6df836cb3fe
SHA512 04684a47905863a77fd78f11476837b9bb02569c483076e5745a2861f2da6b8ade7c87cc9ffa5f7455d035d7df57e7753792e28bb10fdce1e6cdfb9d0664b614
SSDEEP 96:n8kaN19UVKX9wpvWMoiVmdeHtyHQuNUWQyV+VD7AiEwb:n8kOXUVKtGWMXt+tNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ef87efa2fbd8624a4d3891d9b55c294ca0e959087b6af00ea512171026d09615
MD5 97739926f2ebd20c7ec94f50152c35c0
SHA1 27c8ae0c84345a148823367742a8c8baea36719e
SHA512 9d3d65e0b0e9336a05a8fa8262c7441ce785e648a15269e5f7e7ae353dd3c9e90a5cb317c5a8839c51a6a17fdca48ff184b7b42bc72987dabaa1b14b851ad9ab
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXTje2RUWqme1K3wyLUu:A9iIxuERzA83h09RZxYjzluKhUu
MD5 SHA1 SHA512 SSDEEP

Submit Download