agenttesla | hxxps://github[.]com/extatent/Phoenix-Nuker

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/extatent/Phoenix-Nuker

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/5940-282-0x00000183B7B80000-0x00000183B7D92000-memory.dmp	family_agenttesla

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
36	camo.githubusercontent.com
205	discord.com
207	discord.com

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Phoenix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Phoenix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Phoenix.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
1408	msedge.exe
1408	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
2900	msedge.exe
2900	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5940	Phoenix.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2312	1408	msedge.exe	88
PID 1408 wrote to memory of 2312	1408	msedge.exe	88
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 3044	1408	msedge.exe	89
PID 1408 wrote to memory of 4420	1408	msedge.exe	90
PID 1408 wrote to memory of 4420	1408	msedge.exe	90
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91
PID 1408 wrote to memory of 3696	1408	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/extatent/Phoenix-Nuker
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c5446f8,0x7ffc9c544708,0x7ffc9c544718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8752764191876750659,4977360326373430874,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Users\Admin\Downloads\Phoenix\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix\Phoenix.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dsc.gg/phoenix-nuker
  2⤵
  PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc9c5446f8,0x7ffc9c544708,0x7ffc9c544718
    3⤵
    PID:6072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
124a10239d008fbd3f940b5945e4f3e5

SHA1
82123f1678314cfeacdc4b1e83e3164f96c8175d

SHA256
21cd4b56bb9b010b58fe9dc6e028120c30c61a6080d172bf214d3aa6fe9cabb6

SHA512
de35d976aa7730b740d91228be81ac85bcfb5c4c722b6bdcad05dfe5bb49706fce4176df84bb99f0269e50cb16428d7bc5659a9998234e845ebb2358c038812c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
120fd0a7989df7bbbc20c17f2d5d6191

SHA1
08211e8e3711783284970f4637071b26b1e1c8fe

SHA256
afa7bfe8ec928f6bd15d0ebea3ff1fb78f3aa09ae9e0c2e1ca2596fe6a56d4d8

SHA512
9790c0d2e4dd86bffa8b9b326c5c312cf78dbf529392c7d98e2d6abb6b7f62cc1de71ad768f8f4175bb6c294876eb91ec9424970b35564bb28b146044185020f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
34a72154ed9746a609b29d25ad8d6469

SHA1
ee1fc6413972b90af4973bc1c158c47011e757b5

SHA256
629a1e55ae58d7e9e13caf2aabc58ad73415b514df679a5e15ac561b1b549f10

SHA512
2789dcc6843a73666ed06d51a7bfb8e92dd7c0a82062dc0d252d883e4c943fc229932fdb1410e9d40d7a7dd965623f3df582640a0952adf7feb7e05a68e37d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f105f892b5eb87e7418213ddf30f671

SHA1
0dbb899ba2fa9771d6675ef9f93d9c1c320cb7ee

SHA256
3d029afb5d87557316f24e9dcb3ac49028242bb7caaa92ed4f0b44388e65bfc3

SHA512
815bf4e47efcfb824b5ff755a18aba53e97532c74a164b26ce4a72b8c19d7b6859b0450142a6d7cef3395d5b6af10dfe9e065cd0ef51069a459e0be892bef300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea3078877ef665d825a308e719f46a5f

SHA1
562b42e31fc13782d2ffc360df20a6ac12e874c3

SHA256
4372095ab828da81b191804bad603bb000581ea89c6b7a1306bc8c9d2153c0a8

SHA512
096d853e6b8466c4f5724406083ac914cf8708e26af7675128ae64a446ff087d0230d6e8055d8b66350f7040026a469591e914b0f70a2be0ef949986d2226ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
819ec46a6f9ba02b80c45656ab54f488

SHA1
1100139ebd90f757c5e99857c5c53416967cc0d3

SHA256
7e0ea36a6d5ea3a5b1bed8bfe81ca4a19485354fe8f3878a43fa3283d8959606

SHA512
fac82c15f9668d3151b7d88f4402e176de72827210a7a031619ad3264207aa1781947b3d1c14c6dfe75e4eda9afadf27b8e50d26e71142c2b527c759efc25ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51651952f1bf93ead6909fb2c0e09823

SHA1
34b075c1cbecec8b74748c1e21649c974c5e5fbc

SHA256
f3d9f61144c1ea1623b71757cd6ebae2b1d1842c2900941c1af09243fcb3f1d1

SHA512
ad7670290ff149fd242991c33e8bfef70bab8f4772846b90cd8e7fef3b87531c38db2f54e491ba49e78d750f94e8b313f7df894b1f59aa80dad3b9ea25b7855b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a7ca886419049bde0e07877313daa6ae

SHA1
4b796fab3bcd86e1b0c260ad457feb425b4c620c

SHA256
b37a33d8f54f62f81d69f3ec802c7f77a62631d3949dab47d0501b53e10ed4ef

SHA512
67052c6c78a5693c8af90548d05c5bb2daeda46caa48ba624e75aa1e7cab6d29e9f4e0afcd3081db7a07888681639cafa796c0457c1f9ffd79dbf11c3607de14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
408139446ed4f0036835f79a61bf691b

SHA1
af5ab175b64b8a74d84c3284929979b498f0ac92

SHA256
fd119aaed5a6e0a58d60f0913b89683dd478dee42d1f51a85181de8f0154fd80

SHA512
81e83a280a148590e9816a1e19b079e8fd4998c758325cf1280958294853b85f997147eeb1b49af861a9b5b8969c4d648081536488fdda68d79af0517936f2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ed6d.TMP

Filesize
1KB

MD5
85fc924a8ce89d0ddf1e4ea21f6a26a4

SHA1
e7e7aa1a6c7f280f4e1e78529bed8d6ad27e2459

SHA256
8a0f49dbd65a9e58d2d09879c65b4a79ab86fe009337a6eb5c025c8454c974f4

SHA512
f21ea97816664a515dddc079ef2db5752c4f2298060f3113027032f9fb84ac4b5bcc38e42e3c127a59ca264932c358caf5662ba855c715b8ee4b286a7600172b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f507f07568ba1c46de5f5326b700d5a7

SHA1
ba6af148bfd00c2b8328abbcc9e489e8d6ba4538

SHA256
2e575dc277b66232515c6f710096c21c5620eba8fe2c2f59a7a2120da6e66597

SHA512
769f4fa7e32e62a2cdb800d7adca0f69fa03851d0a027d74ab2c1a74a667f337acbe384cf30c5072e7c730d5dd230e770de38f71dae0d7497e707f2fe617a840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6a36bce6a83dc15f86d20269517cf072

SHA1
ce154ebf487d3db822ffff8db81ab08da64c9de6

SHA256
751665972e8deb85eb0682e33e9ba891a5c1c8eca5316a5bfc13187d3e57251c

SHA512
b3bf3e9199da85423caacea997956428a5ddc3f62fe127b6b33f3cbd7f6958532b13cbffdb09483b4fc4d9aaaf5d6898de68d55007498c93061f2525874d836d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
47fc3c52434eb62da991f784d4ef5e50

SHA1
3bffb09f6322dcf36339cb329ff9a01048d320a9

SHA256
63de632c28accdca1b974b03c71ab5c301fe7b8bc4147cf5a333dff058b68c53

SHA512
209783609113d257860b8b10a311708ab3444de21056434d8bbe0e87ab857fc92823c0688889bac365ce2181da82c88be83c955c43b5e776a89b29e4435a8ac7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 640425.crdownload

Filesize
4.8MB

MD5
e02610619e7d819e78f43ede2d4bc840

SHA1
fcb2ad77cfe155398d7621487eee239bd63972ad

SHA256
035f44cce07f951f0c65f1431efbdb466cde75e78335fdb9914c78a9343875c2

SHA512
3f0bf6b8250f5d5646decfaccfe9cca0d05778e676e67e296d74e134e0a9825315ac7013aa9016d00b98e38e576ae43ef7bc677f05814db0f3a978bfd67b63ff

Download Submit
memory/5940-279-0x00007FFC87710000-0x00007FFC881D1000-memory.dmp

Filesize
10.8MB

Download
memory/5940-283-0x000001839F040000-0x000001839F05A000-memory.dmp

Filesize
104KB

Download
memory/5940-284-0x00000183B7DA0000-0x00000183B7E52000-memory.dmp

Filesize
712KB

Download
memory/5940-285-0x00000183B7800000-0x00000183B7876000-memory.dmp

Filesize
472KB

Download
memory/5940-286-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-287-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-288-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-282-0x00000183B7B80000-0x00000183B7D92000-memory.dmp

Filesize
2.1MB

Download
memory/5940-281-0x00000183B78B0000-0x00000183B795E000-memory.dmp

Filesize
696KB

Download
memory/5940-280-0x000001839F010000-0x000001839F011000-memory.dmp

Filesize
4KB

Download
memory/5940-326-0x00007FFC87710000-0x00007FFC881D1000-memory.dmp

Filesize
10.8MB

Download
memory/5940-327-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-328-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-329-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download
memory/5940-278-0x000001839CA10000-0x000001839D39C000-memory.dmp

Filesize
9.5MB

Download
memory/5940-341-0x00000183B77F0000-0x00000183B7800000-memory.dmp

Filesize
64KB

Download