Overview
overview
8Static
static
3@Wanna.Bud...in.zip
windows7-x64
1@Wanna.Bud...in.zip
windows10-1703-x64
1@Wanna.Bud...in.zip
windows10-2004-x64
1@Wanna.Bud...in.zip
windows11-21h2-x64
1Bonzify.exe
windows7-x64
8Bonzify.exe
windows10-1703-x64
8Bonzify.exe
windows10-2004-x64
8Bonzify.exe
windows11-21h2-x64
8LOVE-LETTE...XT.vbs
windows7-x64
1LOVE-LETTE...XT.vbs
windows10-1703-x64
1LOVE-LETTE...XT.vbs
windows10-2004-x64
1LOVE-LETTE...XT.vbs
windows11-21h2-x64
1MEMZ.exe
windows7-x64
6MEMZ.exe
windows10-1703-x64
7MEMZ.exe
windows10-2004-x64
7MEMZ.exe
windows11-21h2-x64
6salinewin.exe
windows7-x64
8salinewin.exe
windows10-1703-x64
8salinewin.exe
windows10-2004-x64
8salinewin.exe
windows11-21h2-x64
8Analysis
- max time kernel
58s - max time network
57s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
09/03/2024, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
@Wanna.BuddyMemes.win.zip
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
@Wanna.BuddyMemes.win.zip
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
@Wanna.BuddyMemes.win.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
@Wanna.BuddyMemes.win.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bonzify.exe
Resource
win7-20231129-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bonzify.exe
Resource
win10-20240221-en
windows10-1703-x64
17 signatures
150 seconds
Behavioral task
behavioral7
Sample
Bonzify.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral8
Sample
Bonzify.exe
Resource
win11-20240221-en
windows11-21h2-x64
24 signatures
150 seconds
Behavioral task
behavioral9
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MEMZ.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
MEMZ.exe
Resource
win10-20240221-en
windows10-1703-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
MEMZ.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
MEMZ.exe
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral17
Sample
salinewin.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
salinewin.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
salinewin.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
salinewin.exe
Resource
win11-20240214-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target MEMZ.exe
- Size 16KB
- Sample240309-vszm4sda87
- SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
- MD5 1d5ad9c8d3fee874d0feb8bfac220a11
- SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
- SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
- SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 MEMZ.exe 1812 MEMZ.exe 1812 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 4476 MEMZ.exe 4476 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 1384 MEMZ.exe 2028 MEMZ.exe 1384 MEMZ.exe 2028 MEMZ.exe 2028 MEMZ.exe 1384 MEMZ.exe 2028 MEMZ.exe 1384 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 1812 MEMZ.exe 4476 MEMZ.exe 4476 MEMZ.exe 1384 MEMZ.exe 1384 MEMZ.exe 2028 MEMZ.exe 2028 MEMZ.exe 4476 MEMZ.exe 4476 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 4476 MEMZ.exe 4476 MEMZ.exe 2028 MEMZ.exe 2028 MEMZ.exe 1384 MEMZ.exe 1384 MEMZ.exe 2028 MEMZ.exe 4476 MEMZ.exe 4476 MEMZ.exe 2028 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 1812 MEMZ.exe 1812 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 2028 MEMZ.exe 2028 MEMZ.exe 4476 MEMZ.exe 1384 MEMZ.exe 4476 MEMZ.exe 1384 MEMZ.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe 2344 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1812 2320 MEMZ.exe 78 PID 2320 wrote to memory of 1812 2320 MEMZ.exe 78 PID 2320 wrote to memory of 1812 2320 MEMZ.exe 78 PID 2320 wrote to memory of 5044 2320 MEMZ.exe 79 PID 2320 wrote to memory of 5044 2320 MEMZ.exe 79 PID 2320 wrote to memory of 5044 2320 MEMZ.exe 79 PID 2320 wrote to memory of 4476 2320 MEMZ.exe 80 PID 2320 wrote to memory of 4476 2320 MEMZ.exe 80 PID 2320 wrote to memory of 4476 2320 MEMZ.exe 80 PID 2320 wrote to memory of 1384 2320 MEMZ.exe 81 PID 2320 wrote to memory of 1384 2320 MEMZ.exe 81 PID 2320 wrote to memory of 1384 2320 MEMZ.exe 81 PID 2320 wrote to memory of 2028 2320 MEMZ.exe 82 PID 2320 wrote to memory of 2028 2320 MEMZ.exe 82 PID 2320 wrote to memory of 2028 2320 MEMZ.exe 82 PID 2320 wrote to memory of 3132 2320 MEMZ.exe 83 PID 2320 wrote to memory of 3132 2320 MEMZ.exe 83 PID 2320 wrote to memory of 3132 2320 MEMZ.exe 83 PID 3132 wrote to memory of 2192 3132 MEMZ.exe 86 PID 3132 wrote to memory of 2192 3132 MEMZ.exe 86 PID 3132 wrote to memory of 2192 3132 MEMZ.exe 86 PID 3132 wrote to memory of 2344 3132 MEMZ.exe 87 PID 3132 wrote to memory of 2344 3132 MEMZ.exe 87 PID 2344 wrote to memory of 5000 2344 msedge.exe 88 PID 2344 wrote to memory of 5000 2344 msedge.exe 88 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89 PID 2344 wrote to memory of 2140 2344 msedge.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd60553cb8,0x7ffd60553cc8,0x7ffd60553cd84⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:24⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:34⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:84⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:14⤵PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:14⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:14⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:14⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:84⤵PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1744,13700961240759815767,15032049410609335181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:84⤵PID:776
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
- MD5 3b1e59e67b947d63336fe9c8a1a5cebc
- SHA1 5dc7146555c05d8eb1c9680b1b5c98537dd19b91
- SHA512 2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
- MD5 0e10a8550dceecf34b33a98b85d5fa0b
- SHA1 357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
- SHA512 fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
- Size 194KB
- SHA256 845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6
- MD5 f5b4137b040ec6bd884feee514f7c176
- SHA1 7897677377a9ced759be35a66fdee34b391ab0ff
- SHA512 813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40
- SSDEEP 6144:e7sHFbHCRoslPSywl9fGm+a8pvt6/UVxuxNsPgu0xQN0:ewlbiisRlwl9fGva8dtQUVxu/Huz0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 81fc3e4d3559d1c8350956a4db8af50eb7cd1faa44baa1a6f45326e7749cc350
- MD5 ba1acd802f410407651ac7cf4ec6087c
- SHA1 fd3f8f0e08a871b5744be08d0a9beff7f2e18d84
- SHA512 68556f9fc1ab65bff15c2784a27e0c63c18368f7676153636060b279b8fc0ff539d4944a249acee24b17e31020ecd2a01d54df3ff90b837a67430559526c59a4
- SSDEEP 96:nLk3DUTskkGwSv0MoiVmdHI1VJHuTM0WQyV+VpziX3wI3:nLk3DsskTv0MAI1vHuTMLx93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 8d9112c6b91852019c2363fcea49ddec4aa46287acea7b883f5a4e57358bd245
- MD5 1d2c647139de47ab7bd22598e69e8131
- SHA1 f340e10c77cb2832e0a4e36571bbaf97d67ff4da
- SHA512 84b0aa6719c5a9ab0aa77c3e158646729b44c3bdf607415e23060f567e3105eb76ab46ddfe4cd1016e8cb81ad8107ee23f14e9f6bea797f08f26b20a3549597c
- SSDEEP 96:nLk3DqTskyGwSv0MoiVmd2uE1jI1tJHuTM0WQyV+VpAiX3wI3:nLk3DCskZv0M/uEhI13HuTMLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 7ac5cd46e2906a613aaa99b08cfc0e428204e0552ce148ececaf6b1d777f8454
- MD5 715b9b412470ef474e4cdf4611b3e8b8
- SHA1 b6450b6daa70183652633c4f5542a5e009bd0b11
- SHA512 9a6c48b12e4096aeaae3b5bfcd83065f2fde939bbacbb15fa5c7f6479ee7adb2e39321b7ff35b4ab252ec044cfdaca38ad5692fada6f36a20b57bc755806f522
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG/G0Qm9e2RUm9EVRxheP+E7Ej:M9iIxuERzA83h09RZxASGNZX9Exhe+E2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\note.txt
- Size 218B
- SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
- MD5 afa6955439b8d516721231029fb9ca1b
- SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
- SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
- MD5 SHA1 SHA512