fantom | hxxp://github[.]com

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://github.com

Score

10^/10

fantom evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>DntQZnN20xkaVMZZUVKPBSTP76+6Tg3hrAk6PTa57VYCB6ehNduc1q29BGd1IoFnp8HyyNl3iqTIa4u+bM+O9OK6RqdBAlNlck31flK6sb8Csh7YxqeMQsN6PpBteKS61bIq205QBQzeFdDcC0WTI17UWPqI+G/k3l/ghim+Ld/FGIesd27LsHPvURWam7d6Mdh+O0Xgf6YpOc9YoZCjPdhJ/Eyzxvni46yBPrURstkQ6nB1AMiDUXFpDQHD2MiMd8HhJRhjEgX6lOADodhEFQuWlnceJsKsMVA6rCXArCQIjU5vQgTN0Kii4fgrCB94++3hYUu0RT9M3eyRKyTaog==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
3760	WindowsUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
64	raw.githubusercontent.com
65	raw.githubusercontent.com
73	camo.githubusercontent.com
91	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.deps.json	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.NETCore.App.runtimeconfig.json	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	Fantom.exe
File created	C:\Program Files\dotnet\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\MeasureDisable.jfif	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\Ole DB\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\host\fxr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	Fantom.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
4448	msedge.exe
4448	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe
5408	msedge.exe
5408	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6132	Fantom.exe
6132	Fantom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6132	Fantom.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1560	4448	msedge.exe	47
PID 4448 wrote to memory of 1560	4448	msedge.exe	47
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 2296 wrote to memory of 1588	2296	firefox.exe	88
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 4556	4448	msedge.exe	89
PID 4448 wrote to memory of 2988	4448	msedge.exe	90
PID 4448 wrote to memory of 2988	4448	msedge.exe	90
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91
PID 4448 wrote to memory of 3576	4448	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae47846f8,0x7ffae4784708,0x7ffae4784718
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15803347990811585766,7889563178463209126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:6100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.0.1591350208\1421678577" -parentBuildID 20221007134813 -prefsHandle 1832 -prefMapHandle 1824 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f494abb3-7a06-4512-867b-9f146fceb4a1} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1924 18da8208858 gpu
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.1.674044741\107450710" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4270445-3457-4e0c-b5d2-c928d3504613} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2364 18d9a772b58 socket
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.2.592851132\1606432281" -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6968bb3c-ce10-436f-b52f-1a810328bf49} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3188 18daabfa058 tab
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.3.1621187134\1436668374" -childID 2 -isForBrowser -prefsHandle 3156 -prefMapHandle 3272 -prefsLen 20929 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1284cc74-ef95-42e0-ac83-bf64f2189b41} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3524 18d9a769358 tab
    3⤵
    PID:1456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.5.1978327645\2095756014" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3844 -prefsLen 20929 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6629c081-e2c0-4bd0-ac3e-9c201069e819} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3828 18dab813058 tab
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.4.337957501\1538060647" -childID 3 -isForBrowser -prefsHandle 2916 -prefMapHandle 3176 -prefsLen 20929 -prefMapSize 233444 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec8375bb-4cb7-4f9d-b88b-f12fa564c15e} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3656 18dab811e58 tab
    3⤵
    PID:3292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
53ad92ed2e9dd80dbedef45b5ea437ff

SHA1
2158d06fbf3b9efc12d8fbeda2906c8dec8a0208

SHA256
5284eb9466af8f2a40e3cab6aae0dc5817a8babe720d50bc793ad10b23ca41d9

SHA512
166e31dbe2e908542e1ee53060c82ab1542a407c74b889499671b94d40974d66b46c9abfa76a16add3f15b94fcd957374916728f4c0b1e4dadbb7ca41fe992a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
24KB

MD5
657ed1b9ac0c74717ea560e6c23eae3e

SHA1
6d20c145f3aff13693c61aaac2efbc93066476ef

SHA256
ff95275ab9f5eadda334244325d601245c05592144758c1015d67554af125570

SHA512
60b6682071ade61ae76eed2fe8fa702963c04261bd179c29eed391184d40dc376136d3346b3809b05c44fb59f31b0e9ab95f1e6b19e735234d1f0613720e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
43KB

MD5
b161187f34dcfde4147e0c42c92475c1

SHA1
f19b8b57cc9867dc4e0dd1c705399214a10402c3

SHA256
3e22ac55ec9df69d4aea3a27c7f655a20be74bc39704546f5f5f3bb44026b6bd

SHA512
fd80cc9e022366eeb19be86ae51c5d0b277eac9563cacdfa10d7f76f19a681732e9dc0c6d164411238e5631f1037a3cb102131631fcd02fe1a4107cb5c8779e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
49KB

MD5
4b4947c20d0989be322a003596b94bdc

SHA1
f24db7a83eb52ecbd99c35c2af513e85a5a06dda

SHA256
96f697d16fbe496e4575cd5f655c0edb07b3f737c2f03de8c9dda54e635b3180

SHA512
2a3443e18051b7c830517143482bf6bffd54725935e37ee58d6464fac52d3ce29c6a85fc842b306feaa49e424ba6086942fc3f0fea8bb28e7495070a38ce2e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
28KB

MD5
bcf8a9566c19c82f4bdb43f53a912bab

SHA1
aedbcfb45eed11b7ad362b53ff32bacec9f932ee

SHA256
52c97dd2602b4d9ac70b61c3dd9b0f9869c5c211e2a4b52e94eda5e150349ae7

SHA512
cfec8603b3eecc261735ddb3d9f292f47e5e34761d73c33b8a1fa1efcf8e07b9b5595a28eac3b238842cf1f63a155b0376840f42ab22ad3186390bcfbc62adfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
63KB

MD5
1570abcb0b7f274a02f4aa39a18aff63

SHA1
87d392d2f1c89a2ab2672e495d1198b34e81fceb

SHA256
cfcea4b88ddd288925d0a6b6a2b62f44b27160c6f55d5dcfaf293a3eb45f53f9

SHA512
5aece76ee3a8a734404be76f2feffa30d4bc1c618a3ff4c8ca8244e6ccee2886599a095b6578be10d8da2810934e8e255658c90c22da35f0354617c9ad08b2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
153KB

MD5
2f3c7b5f9221520efbdb40dc21658819

SHA1
df12f010d51fe1214d9aca86b0b95fa5832af5fd

SHA256
3ba36c441b5843537507d844eca311044121e3bb7a5a60492a71828c183b9e99

SHA512
d9ed3dccd44e05a7fde2b48c8428057345022a3bcea32b5bdd42b1595e7d6d55f2018a2d444e82380b887726377ab68fa119027c24ac1dadc50d7918cc123d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
bc4836b104a72b46dcfc30b7164850f8

SHA1
390981a02ebaac911f5119d0fbca40838387b005

SHA256
0e0b0894faf2fc17d516cb2de5955e1f3ae4d5a8f149a5ab43c4e4c367a85929

SHA512
e96421dd2903edea7745971364f8913c2d6754138f516e97c758556a2c6a276ba198cdfa86eb26fe24a39259faff073d47ef995a82667fa7dee7b84f1c76c2b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
27KB

MD5
253c9c80f4cc0a210b53c03bb96280d7

SHA1
0e9ff12fa7c27cf9f2555483664a6189e7cb318c

SHA256
4212d1a0a6f2c31753368b0ad556f90d2eead2177caed493699d243ad20553a8

SHA512
b59c616446bcedcafba37c9c459aef5d15aeddde8fb71ef8ced9188839b7c62f148220985469a7d830201f2d53864fdadfe24c7572fdb5257ed9fffee187acb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
76KB

MD5
cd0924ccdda73b4e581e2d4f7640fddf

SHA1
7a1f5c7056d7ea2acb9928355a72ceb1255dedd1

SHA256
7afa29da6fc922b1e78413ece9cf9accc282316262ae4395de029bd81902ae5f

SHA512
2e7ab4df6b0ca0812a6deb6ef6b6acd5654277bd8142cbed44095e3ffc3f3a874d36d924cede7ecee43b0a8b3e9459c7c97b8207bbab2ab90356fc52015e8a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8b529d0c7b28997a740d555da03bb067

SHA1
e0a22c88c6783826940afb2663decc9a3cf5e024

SHA256
97988435cf0c582dc3e9a6255bdaf084ad7c34a435d049aaf936f9216ef130eb

SHA512
f4de6208a6f2c9a9a98eed8e428aa11f023f16bd081ecf59b408623888c5fd3d03577641a68d969ff2d660b1d609e3964521aca5b77283ebd9e35c38f14bbfde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99c19f5005aa213029b369bac34c3eae

SHA1
17172b411b79576a6b54374edfe3d50a60ee5755

SHA256
3b730608d24879bfd8af226c477dfabb239d79949f435899cb713a14b89c6f80

SHA512
8605ee8f64c683c1c56f0898be4c9d485084f88117f7c60b32a8cf05c5b7c08c7fc8b823b90ec4ffadc01f6dcadb6d2cb80ca006ddbf0f9fc6bfdb9e6a25d9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65c534c615cf97cc98ca3002bcd00761

SHA1
d6be12fbdbe7a4e7730f3b3115b28dcb364aa4c6

SHA256
1b495aebe5277d58cdb2802d32ca7927177e698025eb815f803ac4453caf02ce

SHA512
e6bda02df0ab5a0d83b1257e779fc16de2a13ae953542915716e70232ffa1b551c212831256b4627035389725a8b9c5552266c094e8bb986dae56c85dec516f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
144a5fbb37ef6c2ab96e12b85a8b14cf

SHA1
0aa65f110e85b53f54cb68dae05e3d56bf391fb0

SHA256
ba165cc26418992894c536487e333bc4eb5a3ba38950fedcfd89e3e3b4d4253e

SHA512
58f45d81b22b105f3504217950822d546c58822bd9d30d541d5740b14326404ebb4ac64d3cd5e2ddcc7aa8e71d70228edef4bcab6661b16c489f257c4ab6fb1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8e585f4064a3c767031489adadbb504

SHA1
8ead10a4e63a248ad51908b66ed4f2be8ee2d784

SHA256
b1b801c5678b4c4dbd99e933e97638cc2655b7d4f2b8b443bac01499d1d90b27

SHA512
c544e3f2e7d04fb8796ac07be633f5dc43ae81001f41cf2f75c23685b8c2b128c0fdb14d6f20b3c49dbf1c88d97a5c6804f9151f72acc9e9e03c976df2750f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aadbd8357e4df78cc078364d152411a3

SHA1
e33f0a6f68f69b0b41b4e5f907be559d64a97755

SHA256
55a8feb7975552e40025f05aa40ef17a4b6a3e1d930ba0807841e39fe2762689

SHA512
25a92c030ed98630b28977a2816cb39d8e0b5be9a543cbfe6225c34f43fb76f0b28d0bcd658e3bdaf227df12bf5f6aaa9e4529181391c027f08951a5f7452557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7205c9786a32a74b4814ecc1b495ff55

SHA1
7fc39d7a8094b174ce44776aa7d0ca6ab4738e68

SHA256
e48dedef3fcb75120f61481164ef28f28ecfd18670adcfef06bf53c1df2d3b64

SHA512
9ade2adc2842e43a3d45166fbb46b4e3445e01e688dbacd7ba69b9293379914439206322d5569458286d8ef964ecdf13e674f24b46a91a1e046bde203a177504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b8bc8925ee8f84614b4e259f94a3e04

SHA1
927120574e801bb64541258679ca77c72940e585

SHA256
1c2b1d96f467dbfab5f1ccafc0e07d5fd1732f93b437e40acf266449faf71ffb

SHA512
4a63f7c6a47f632121a2137b1500f111ab9f901d56b74f2254e39e64e304877b6d4a849f735c7083225c11124f52009093690799d4675b191a3cdbee4e224bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9404c802e5bd23a51054604649b38392

SHA1
eef335afb57eafc1a9ab744d97c911dac938eb0a

SHA256
94e17967f1c7cc2f9a79ef4c805429597cd461d2a6cd846fc38d4765bc81003e

SHA512
3b3d2808a9cfc9336d38c3a3ae307bad80880531f51c1ab647359271b5058f442dc6e0936ddcc175b867030b7c9ddf400a6b7eed6afa8fb7cc110d450a3db874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
572d15ee7640b08d831e133320d3fde6

SHA1
043b6a933eb942a67efc8723f6f70d64cd992359

SHA256
f0259de3ca9d543b63684fd77100d1b978287732bad76367f1e36a0816f4debd

SHA512
16b88098865a568075a9d3de0173b3d5dda949a6a09acd6e241e9d77094bc3194ea6eba8acb1b020f39e0b869e4a13742780613990e838fc4dabf4feadb688eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d87852929250125fea874323f85c000b

SHA1
2f5bd10b72cb102d6515f9d85f2f2e3f4092ba75

SHA256
abb300d61cf114db383169615789505898d8c3fc4515fee4cb09c3b0d3eb0806

SHA512
ea657090f403976d48c3fc1c95e04d8bd419b83bef5f5c86891f3ddf6ced13261bdc64ef4bb4e0ecdb18c88b1b8930357063598f4205e1535697821a34735104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4a9370f068be3849f3696b8c48a0080

SHA1
3679219d58585f3e3dd8db78646d367a6257f319

SHA256
09c7ea47702020b9da64244a66b9ed7064dacf0d44131181d661151bead6577a

SHA512
7df2d7daa82a9c59ae11b47e87a5afd8316ddaac62cd00bfd0dd55ce515b46d7bfde11effbbf3584c454cf4c771afe76ba409bb6d77c66dc34ab05129d1c9167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c7d9f27ade1884d14ea583694f149be7

SHA1
28bc44f499e52cab4893da9f247cf9140f6e6955

SHA256
7f4ab75cf7f318257d5d4793a7e07415920f5bcadd9a384cd6aae9771b539d4b

SHA512
7e6249be5ed3aab5e466262da29ef141aa78b0cb5b8726ff788f9a4fc33287074d926ccfbb2ab176aab6766a6119b347bdbc3af4c906e713a73872d01b800325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ed646e3e950690c1d573adeccd6795c

SHA1
eb3d5c2ccf0a82a70ccb1b2b827a0d3299118c4d

SHA256
20f86031cad01f86b9d3959113ad9408363655023fcd724fa1d03204770db433

SHA512
5065e40b3096beb8c561025bd78af5dda169bf1a02e75c55a0d8cdcbe73929ac416e6afe1c7847bc9df7f56b17a71ddde489d5d8a99844a5d3cfb69a9f5b3433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fafa.TMP

Filesize
539B

MD5
fe4e7486f3172c756eb917c95403c6ae

SHA1
1aa2eee11a029af8e65a4ac49a6e8e32ece6a1da

SHA256
00734ead472bf73c87969a819658eac098790f071673df6650ef60f062fda904

SHA512
d108572297ae5720820b9369ab6ae48573cc01c86c901100b801423f0968ec28159fdfd37e2f24d3bbdc41bf47e5d60a12ebfc54a98043693cbc4ee9f875e4ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
322db4ee91afaee35e0e7dcbc010f53b

SHA1
afa5b267a17ceaf1bc57c19e1aef79fa2bbabe51

SHA256
5090aaf55bb1f752f6347bdfd78832bfce3c874019078bd179159868a00abff2

SHA512
ba58b7e3332f80ee4b157029e8804ce60def5fed0802b1ddb1a866fd25e47d7650569c72e9af410cce41a753c4357dbf5d6d460803c69c69a5e711dc6cc1f512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cfa144b6fa4ec0d41c81369c046db96d

SHA1
17d366130b5d79a25a1a156b9c2f882b8fc91ccb

SHA256
356827fb45528414dfa60b4e702e2bebfd7892bc03e528e96cee9c983f29ac4c

SHA512
37b608c25a16200bdca10dab90764fadb950e760e32dd60e0138c605bba6873b09345548f41740bb199024f2866e64d43cc9b2d50ebf5f10134c0f8984e35335

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
271B

MD5
697d52343c032e1ec00374671f098bdf

SHA1
45f4a2ce70474fcf0640bdf2e789e5a4075670d6

SHA256
7de2c2b379316a7061e3d1144909e1adaa9268d377104325bb98fdfeeee742d3

SHA512
2351a9e2d95211e45bfa8224e962039f46136a3616e2860112674336dfb91df6084f6e610d575bfda9059fdd880dcf8a0947863621ebd23c3ade28ad97641ae5

Download Submit
C:\Users\Admin\Downloads\Fantom.zip

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
memory/3760-827-0x00007FFAD04F0000-0x00007FFAD0FB1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-815-0x0000000000760000-0x000000000076C000-memory.dmp

Filesize
48KB

Download
memory/3760-828-0x000000001B660000-0x000000001B670000-memory.dmp

Filesize
64KB

Download
memory/6132-637-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-728-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/6132-635-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-633-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-639-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-629-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-641-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-649-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-651-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-653-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-647-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-665-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-663-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-667-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-661-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-659-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-657-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-655-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-645-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-643-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-627-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-625-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-623-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-631-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-729-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/6132-730-0x0000000004C90000-0x0000000005234000-memory.dmp

Filesize
5.6MB

Download
memory/6132-731-0x0000000004B70000-0x0000000004C02000-memory.dmp

Filesize
584KB

Download
memory/6132-732-0x0000000005380000-0x000000000538A000-memory.dmp

Filesize
40KB

Download
memory/6132-743-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/6132-749-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/6132-759-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/6132-621-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-605-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-786-0x00000000060F0000-0x00000000060FE000-memory.dmp

Filesize
56KB

Download
memory/6132-619-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-607-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-617-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-609-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-615-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-611-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-613-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-604-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/6132-603-0x0000000004AB0000-0x0000000004AE2000-memory.dmp

Filesize
200KB

Download
memory/6132-602-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/6132-601-0x0000000002420000-0x0000000002452000-memory.dmp

Filesize
200KB

Download
memory/6132-600-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/6132-599-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download