ef9e3f4e08e0ca9d2ba97951b3dce68e8ce385c4c05a0ef8aedbe3b59e016367

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef9e3f4e08e0ca9d2ba97951b3dce68e8ce385c4c05a0ef8aedbe3b59e016367.bat
Size 1KB
Sample240524-b89cpshc24
SHA256 ef9e3f4e08e0ca9d2ba97951b3dce68e8ce385c4c05a0ef8aedbe3b59e016367
MD5 2125f3d556ad5c646f7ec80168bdbb15
SHA1 4fc0591f079e142e327c3fc4da0fc98c562342bc
SHA512 f7aae48248ba0eff06103099cf49dc8311aae823141f2ec277486c3c365a8074e092f596269db4f2be563b66a70f1a7d8915c8e9228375a6a06611b32abf31a3
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
5088	msedge.exe
5088	msedge.exe
5076	identity_helper.exe
5076	identity_helper.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1368	1636	cmd.exe	84
PID 1636 wrote to memory of 1368	1636	cmd.exe	84
PID 1368 wrote to memory of 5088	1368	cmd.exe	86
PID 1368 wrote to memory of 5088	1368	cmd.exe	86
PID 5088 wrote to memory of 3520	5088	msedge.exe	88
PID 5088 wrote to memory of 3520	5088	msedge.exe	88
PID 1368 wrote to memory of 4832	1368	cmd.exe	89
PID 1368 wrote to memory of 4832	1368	cmd.exe	89
PID 1368 wrote to memory of 4204	1368	cmd.exe	90
PID 1368 wrote to memory of 4204	1368	cmd.exe	90
PID 1368 wrote to memory of 1084	1368	cmd.exe	91
PID 1368 wrote to memory of 1084	1368	cmd.exe	91
PID 1368 wrote to memory of 1496	1368	cmd.exe	92
PID 1368 wrote to memory of 1496	1368	cmd.exe	92
PID 1368 wrote to memory of 3876	1368	cmd.exe	96
PID 1368 wrote to memory of 3876	1368	cmd.exe	96
PID 1368 wrote to memory of 4060	1368	cmd.exe	98
PID 1368 wrote to memory of 4060	1368	cmd.exe	98
PID 1368 wrote to memory of 2392	1368	cmd.exe	99
PID 1368 wrote to memory of 2392	1368	cmd.exe	99
PID 1368 wrote to memory of 2448	1368	cmd.exe	100
PID 1368 wrote to memory of 2448	1368	cmd.exe	100
PID 1368 wrote to memory of 3976	1368	cmd.exe	101
PID 1368 wrote to memory of 3976	1368	cmd.exe	101
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107
PID 5088 wrote to memory of 4452	5088	msedge.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ef9e3f4e08e0ca9d2ba97951b3dce68e8ce385c4c05a0ef8aedbe3b59e016367.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\ef9e3f4e08e0ca9d2ba97951b3dce68e8ce385c4c05a0ef8aedbe3b59e016367.bat" MY_FLAG
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://valuable-gazette-shock-medication.trycloudflare.com/SCANNED.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc36f346f8,0x7ffc36f34708,0x7ffc36f34718
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,1546372840001036275,15473664275632648315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4556
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\kam.cmd""
    3⤵
    PID:4832
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\las.cmd""
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\zap.cmd""
    3⤵
    PID:1084
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\sample.cmd""
    3⤵
    PID:1496
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\xff.cmd""
    3⤵
    PID:3876
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\time.cmd""
    3⤵
    PID:4060
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\upload.cmd""
    3⤵
    PID:2392
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\update.cmd""
    3⤵
    PID:2448
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\Pictures\info.cmd""
    3⤵
    PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac565f93e71d1b771f14451964f1733b5cc83837a3b0914dd8ca00a361f85063
MD5 f91a8b383d72ffc0b9d6d74a30f8ec4c
SHA1 0ac5f0d4f379edd877d5fc2275725a03b3c3db23
SHA512 29917ccc34a6fc1e28ca5c2c42fcdb19ae8aee3afe0866bfea9aa8a3192c9064b2dbe3fbd70a63ad73610e5ad68c3de0a142b9ce494272d168f14fb672b2592e
SSDEEP 96:nJAkjpKL1hT3wpvWMoiVmdeHplwt6acTUWQyV+VDCziEwb:nJAk1KLPrGWMXp3XTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f818fa40b4ecbd840fe0941b3efb5afd6e6d31a242321e428454585d82eae547
MD5 6d569d2b808ed95390028e32407da11c
SHA1 e39aa6658e69781a73fb7928f432e57b9aa6cabc
SHA512 d48e7a8044c36e5b5edc27047d3999325ab5255ae5f322e0bb3346d12e27bedbe598148618ed3ac1a44d43338b54d2041d15f306c27d11af87b1762b6b846af4
SSDEEP 96:nJAkapKL1BT3wpvWMoiVmdeHplwt6acTUWQyV+VD7AiEwb:nJAkwKLjrGWMXp3XTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 182977289c324693a32eae78d968ee69404b78818d7e3441c9359efcb49153f8
MD5 acc97a650f7b2539883ba5d0641d59bc
SHA1 be375fe87aefa21c515c3ee18058b79c5b742d52
SHA512 9b2238f68a7c47ed06cd0575fd77ff703f483f3237b8593e91332b4fa8a2df5c8462333224694a732160f4e58c0b7fe75abf5c23b473f19da4a8d1498675a3fd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8INe2RUV2ZW3z2OMDCRHqP:A9iIxuERzA83h09RZxY841WaOMWRHqlp
MD5 SHA1 SHA512 SSDEEP

Submit Download