vidar | hxxp://147[.]45[.]44[.]104/revada/66f00ee5b1ba6_cry[.]exe

Resubmissions

19-10-2024 20:21

241019-y49t1ayepr 10

19-10-2024 20:21

241019-y44mzswhlg 8

19-10-2024 20:11

241019-yyfnzaybmn 8

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://147.45.44.104/revada/66f00ee5b1ba6_cry.exe

Score

10^/10

vidar 91ac6183dbe67a7c09b11e88fb5493b8 credential_access discovery stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

91ac6183dbe67a7c09b11e88fb5493b8

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 10 IoCs

stealer

resource	yara_rule
behavioral1/memory/400-127-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/400-129-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/400-147-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/400-146-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3792-163-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/3792-164-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/4848-180-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/4848-181-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5308-219-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/5308-220-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1560	66f00ee5b1ba6_cry.exe
5256	66f00ee5b1ba6_cry.exe
5628	66f00ee5b1ba6_cry.exe
3716	66f00ee5b1ba6_cry.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 400	1560	66f00ee5b1ba6_cry.exe	134
PID 5256 set thread context of 3792	5256	66f00ee5b1ba6_cry.exe	137
PID 5628 set thread context of 4848	5628	66f00ee5b1ba6_cry.exe	145
PID 3716 set thread context of 5308	3716	66f00ee5b1ba6_cry.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f00ee5b1ba6_cry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f00ee5b1ba6_cry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f00ee5b1ba6_cry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f00ee5b1ba6_cry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2600	timeout.exe
2332	timeout.exe
6012	timeout.exe
5212	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 917701.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
116	msedge.exe
116	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
3252	msedge.exe
3252	msedge.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
1560	66f00ee5b1ba6_cry.exe
1560	66f00ee5b1ba6_cry.exe
400	MSBuild.exe
400	MSBuild.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
400	MSBuild.exe
400	MSBuild.exe
5256	66f00ee5b1ba6_cry.exe
400	MSBuild.exe
5256	66f00ee5b1ba6_cry.exe
400	MSBuild.exe
3792	MSBuild.exe
3792	MSBuild.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
3792	MSBuild.exe
3792	MSBuild.exe
3792	MSBuild.exe
3792	MSBuild.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5684	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	66f00ee5b1ba6_cry.exe
Token: SeDebugPrivilege	5256	66f00ee5b1ba6_cry.exe
Token: SeDebugPrivilege	5628	66f00ee5b1ba6_cry.exe
Token: SeDebugPrivilege	5684	taskmgr.exe
Token: SeSystemProfilePrivilege	5684	taskmgr.exe
Token: SeCreateGlobalPrivilege	5684	taskmgr.exe
Token: SeDebugPrivilege	3716	66f00ee5b1ba6_cry.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe
5684	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2944	116	msedge.exe	85
PID 116 wrote to memory of 2944	116	msedge.exe	85
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 3724	116	msedge.exe	86
PID 116 wrote to memory of 836	116	msedge.exe	87
PID 116 wrote to memory of 836	116	msedge.exe	87
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88
PID 116 wrote to memory of 4400	116	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://147.45.44.104/revada/66f00ee5b1ba6_cry.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc27df46f8,0x7ffc27df4708,0x7ffc27df4718
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe
  "C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\EHDAAECAEBKJ" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:4580
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2688
- C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe
  "C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\DGHJECAFIDAF" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8333257803420883838,201824142682748087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5480 /prefetch:2
  2⤵
  PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5520

C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe
"C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\DGHJECAFIDAF" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5212

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5684

C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe
"C:\Users\Admin\Downloads\66f00ee5b1ba6_cry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\HCGCAAKJDHJJ" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4000
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
2KB

MD5
8177cf7ef52479d825bb63e15cc64d5e

SHA1
db6987c2577e95bcd7d9993a2f229ceabbd9a617

SHA256
f8359f5acd1be62c2c4e57764829825576bae19cdbd6d3b293bd0fc464ecc20c

SHA512
c436825172df8cad1d23b0ee3af27392f1cbe06176a490c8120880135936a39eb1503bb9b1a6a0c723c85f844e5ed8f67f9b36eb341b459b03e472181e0d1cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3D1101CFA1A79AF305FD7C55E37649_A8EAC700FEE71EDD327E06BEAA0C7F96

Filesize
2KB

MD5
83c8b77cdabdec66118e68451ecdcd46

SHA1
be662a7d66ffc22f3e9aef52c4e9a7c346f2c8d8

SHA256
4d95de575eba16375b536e3445b862c6e419251a8ab2f964791e3ad04ff2a1fc

SHA512
4774ebbd99f4adfee768d35d88e97bb3e1b57f5d686728498b09077ccdbeb373f89bb373aec2fb20eab99d864cfa21933ca359176b8965ff41de11dac8dcfa53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
568fab507ed618f614b19eab021b82bb

SHA1
283c4475026852498cea4674bc7396ac14fc937d

SHA256
f721563f0433edf22895a1dbbb10939d5184a24b435491d35ce7f364ac2e159a

SHA512
e5c76b6525201d8f01f80bcf5baab7ded27c5111489413fdcd9da2b7b173765fad2d373c7f4d0fa93c3c325d82692f88effedcc8ebef7e0227d2065cedbdfe5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
c30f9151334510614caf8ea2c9521e3b

SHA1
1f9b46a2e1c720d5ee6077bf876bd9cfdae3920e

SHA256
f19622ddae96d6708bf0a17b5d89c43725694af7aa290be53eae93895d94e97c

SHA512
ecb0419a6ab520b7d6415dad496864ae027902c77a1686b6a40ff79a66e1754794df73e7f95b1da98aacc9b62e4184b6cc8984829111986ab91be31d11d41123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
a7aa2601431c271c962b243be1b17a5e

SHA1
a0f4c6cac54c9fc26e34e0b7e08200b8fdf47b48

SHA256
f175c83ae075671c84ae6498b8b966e4f99566b644b35e8aec73d491c18460ec

SHA512
7c14f549091278a9bd048c9e148831948f57fd985872d1c5eb25538757c497b84fdc71a2edbc28b47eb684ae3f9ba564ad5537e5391e8a00dfeb3b9ac24448de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3D1101CFA1A79AF305FD7C55E37649_A8EAC700FEE71EDD327E06BEAA0C7F96

Filesize
474B

MD5
65d3064dbaa66eb2dacd1fc9f0ddb0f9

SHA1
de325373c3cf59d721c7b9decc630569c803587c

SHA256
ade50423bdbed52eabd0fe4f65ff219e4fb25c323654ff8c892a339d8590a37b

SHA512
ea2d8f90cc8160be9691453ac12f85aaf44b1da9da16b8b7be355340323dd9c6538383160097bc42f4a5669c5c7fb1d8a5f78103c40ed6584d095c4fbb621a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
180740e9a195709f4b4e0ab0a7aee35f

SHA1
0677f8e3f4f9099efc547004d720767deab814b5

SHA256
41db538347f42ed7bfc22cb17905cc379b13df7da622721d7b7e43e76d6cf623

SHA512
857a2b7b3df39a10e0e72e1290532f1f1a1058a5f323d904bb73e4d2669c0037456dc813acb73a704f31880a7f888213f11a5fcc5fadcc152224b7cb0027bb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
47c86d4ff468158e38b9c360becae26a

SHA1
cef7edda1d060ad543f558c3e1de746997e3d54c

SHA256
99c760c8313caca86a4e6a218a987800d0fb0e9a7d7c25fdcce1e6a1bf605eaa

SHA512
df1e530e4f7dc3e6b5c1d16787561296c1d811cc3c86933b6efb921bbcb2de97f09a527265923027a45a5646c312450b09f1381131267353eac34a6b2127045e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66f00ee5b1ba6_cry.exe.log

Filesize
323B

MD5
288c2dfaef4744587ed9babe65464432

SHA1
28da9bc6b0411d2eb02f5e68187ccc5b5d040cae

SHA256
ac74e39389d05bc95d40efc9cc7f4726281809d360ab117f92685d3779a85af9

SHA512
48530d4bff93f816ddaa5aab1127d4ae6868a86bcf47eed6c1558e0ae9b6cb70a23fa6aca0dfd24b701cd2ab5075c8c0e100d40c94b08ea32123ec2866388b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\234e3fe7-6cbb-407c-82dc-a0e43cb7f40a.tmp

Filesize
6KB

MD5
90cd8b43a299a16aa7179ff329fb10ed

SHA1
c42a039d2aecd21d4ddcafe78b5eebcf17f748f8

SHA256
d4755296e63b500b49eab09de0d80c911636561f3a426c619d1908bfcfb7dae7

SHA512
741f164f8ee25e2259dbbdf380168d8e37c201b887c87ff9a8f911372f45d5ede81b1ac4f35a46c13cb00d2fd8a83fed136e3763afa49346c72a25756d8e4729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69a339e827237beb81f8d622c6eb4206

SHA1
9cb5b89a069129427aba6325fcbb7f37ad9d57db

SHA256
f83ca1ab59cdb715437d3132d456f10ef9dd96beb3ebb6a8407a20717a71003e

SHA512
dce33fbf12bf03c37bfcca01a20c745b4bd7597a031717b60167c41ffd311ea182a1c9fb1a1d7e88ecdeb5baa734788f99f300a56aac6979952a68989c7982e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6a00a17847c47bcda3143c1da54774c

SHA1
4424b5321c71ce945bc713de1435cbc9f279a209

SHA256
f9e9682de2c09bb1e4edf4b0972f62aefbecfe172485f21a7838b5f5e3f206e7

SHA512
37d44f88b063e74fdbe590c4a39d12abcaa6f1ddb6045698616f7e73852938e7aec6e7ce83316cb68cd5fe000035641d5c7a3279759f8f6727351c4975776679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cff3d184e0677fa1a3590e362a1c5843

SHA1
573f8d2a09aa559501a3cbc4709b391427c3ef7a

SHA256
982b344b855d416c9a62a11b982471e2ebab3875983b16511ca33479fce1386b

SHA512
1335072f3cd35853b15200b00b9b03f2ea0019b839f03da3d7766104082b02cec6ddbf1c1b5d729ab97beb948a03f9a8d70f6a769ebdd93d2c49111b82406004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf4c7df8c0eb7d6b31ceeb15bff6c172

SHA1
ee812476b7e3f6b4274fc3acc5983e8e8afd88ca

SHA256
f990a55a879ee3d0d5a5c6986a22d5029becad946da887816ab3caceec71743b

SHA512
6c1cdd4529d87d22ae6eed75e9d518cbc9b01866d405860a4329ad2eb6582bf59d23a239c42c1186e0f5a846011bdab646cf773eb11c950b405e9386753b363b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5fff7590220c593f2b2caf90de679657

SHA1
4f31b9cf33b357bd917ee2301ea1d06ac43c31ef

SHA256
3aabaebf48cfde8bdb57103055b5537237dd3bfe608c9082286373cc6291be0f

SHA512
f2e06e00b2c8c07ba521f5492b5d12e4bd7b7d1042ab3adb4d130176783192e6160dd5928f226a4cb4aed5395d7bc74b076f65f20addaa55af8e0a7029d9c308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\76561199780418869[1].htm

Filesize
34KB

MD5
07dc74de13c8dd1758962923f8c9ec30

SHA1
f11db3279c26f98efce03f18fc5199affb19b320

SHA256
8c016e0e62ce1ceb6daf0badf6250af53e8edad7b7f031c4f11034b801f2a0f7

SHA512
5d6cd174cb3170596bb7b8ae5e1a2f5e17cef90c2985f96c2fa18eba093be684bc81213c6fe1627ce270cc457c4196bfa26850d1140f6eaee3adccc09c2abdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\76561199780418869[1].htm

Filesize
34KB

MD5
fadd83debb76c8926a63c1d3baf6e9f3

SHA1
9fdd17d78b16b7361f609b9984d8124d4b821da0

SHA256
c3aa90ae5b472e39e5dd320eea7b1facc2b668152881f266c0a05603e71f5b64

SHA512
4c53524ed95237c6f51d8350c37c7d76bf18efda3b8a1adea0483ef2985bb997ee4f91b2421aed7edb29324c8e93b39834da1ec7fac3d9d5f515b1cbb8ce2e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\76561199780418869[1].htm

Filesize
34KB

MD5
33aa83e7ee1fb03e0656544c4a1b7f89

SHA1
eda1abef54e856e0e6a72c56f26924d0d42a7947

SHA256
7497eddfdc5fedfa0929cc5f80ede1cc54c1dc73899861c0e5b1e8846e4502e9

SHA512
019f117a3eac4406e41475611c1dbcba817ad80729b618b1d0b30607bfe23ac95aa07d0044282c0a6dd6424189be4b3a579aa6c0ce38423674a835794f463ba8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 917701.crdownload

Filesize
3.5MB

MD5
0ce7cf7cb9d41ae3d473c334443c7293

SHA1
c3be94cd8c7b4122bcd74c3cd9c3bcea15170c24

SHA256
f093c3d6caae966180b506123ceba03a980cee862c6d27ccf1cbc31a4803ad8c

SHA512
a09d2be3e7693ccf1f1b6c95a61b5aa2f2b0f3565175fcc326da746a5982a45934dc6923b2837361c33b1c25ae6629e21a4e889a9d3faa96f93d332d7219d6bd

Download Submit
memory/400-129-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/400-146-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/400-147-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/400-127-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1560-125-0x0000000005BA0000-0x0000000005CBE000-memory.dmp

Filesize
1.1MB

Download
memory/1560-126-0x0000000003130000-0x0000000003152000-memory.dmp

Filesize
136KB

Download
memory/1560-124-0x0000000005A70000-0x0000000005B9A000-memory.dmp

Filesize
1.2MB

Download
memory/1560-69-0x0000000000AB0000-0x0000000000E2E000-memory.dmp

Filesize
3.5MB

Download
memory/1560-70-0x00000000056F0000-0x000000000578C000-memory.dmp

Filesize
624KB

Download
memory/3716-212-0x0000000004DD0000-0x0000000004DF2000-memory.dmp

Filesize
136KB

Download
memory/3792-163-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/3792-164-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/4848-181-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/4848-180-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5256-145-0x00000000057B0000-0x00000000057D2000-memory.dmp

Filesize
136KB

Download
memory/5308-220-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5308-219-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/5684-99-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-91-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-93-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-92-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-103-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-100-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-102-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-101-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-98-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download
memory/5684-97-0x000001EB94BB0000-0x000001EB94BB1000-memory.dmp

Filesize
4KB

Download