phemedrone | hxxps://uploadnow[.]io/en/share?utm_source=tNr04f3

Analysis

max time kernel
60s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://uploadnow.io/en/share?utm_source=tNr04f3

Score

10^/10

phemedrone credential_access discovery stealer

Malware Config

Extracted

Family

phemedrone

https://mined.to/gate.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4688	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
3728	msedge.exe
3728	msedge.exe
4292	msedge.exe
4292	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
2992	Resource.exe
2992	Resource.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
3916	Resource.exe
3916	Resource.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	Resource.exe
Token: SeDebugPrivilege	2464	taskmgr.exe
Token: SeSystemProfilePrivilege	2464	taskmgr.exe
Token: SeCreateGlobalPrivilege	2464	taskmgr.exe
Token: SeDebugPrivilege	3916	Resource.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe
2464	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4860	3728	msedge.exe	83
PID 3728 wrote to memory of 4860	3728	msedge.exe	83
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 536	3728	msedge.exe	85
PID 3728 wrote to memory of 1924	3728	msedge.exe	86
PID 3728 wrote to memory of 1924	3728	msedge.exe	86
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87
PID 3728 wrote to memory of 4676	3728	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://uploadnow.io/en/share?utm_source=tNr04f3
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde2f746f8,0x7ffde2f74708,0x7ffde2f74718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,16713576703989525401,12772484205855378242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_ResoureFile.zip\ReadMe.txt.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4688

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2464

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Resource.exe.log

Filesize
1KB

MD5
d7e08a6cf500fe5ab87b41795962ee19

SHA1
dd08782055e3e72f7a8c14ee8a27953825b18c6a

SHA256
e74f68eef03565053effbbfb8a786c8858edea751f40cd8c1030ca673f6ba161

SHA512
d4d694cde80f00642174c564969c228ae69dd31707b8e9cf52b5564b98b34d1c20857fddfeff66b597bab150be18b8166425f6cc1001c6154ba77611f0bec4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b0f12ea-2ca7-4abf-b779-7863f518c3a7.tmp

Filesize
5KB

MD5
cf9a54500caec748092e52c347122e57

SHA1
621dd6a76c28738fd75504166464315ee5d65286

SHA256
fd6f57a2e862252b106534d6a04672a473dda9f51219be85e6c09945e7a83cdb

SHA512
59bb1c730abac4765b705353231a3375fb8e42d43a8f63c80698a80f30ceb44fef460f4f4d0780025c9dc4ebcf0944b19701a9e5fab009cfff79eea9ebe8b00d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1326a0e7523fd8d3177133bf9f5ced36

SHA1
9fda8a9d26fb511521740ec072b32f141a6b4adf

SHA256
5d2d87c6d1322f19dd7cec114c2b3cdac4fde1d54dddb8ae672d1a88a1ea72c1

SHA512
2701a9040a3f799c33297b536dc7d61eea3da2b5bed5cca3b37ffa3a8c785f4b214195d6cfb8741141ba2ab255d99e323fe0a3a07312bcf0ea8f5ffc0cc88621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc9503be805c116790aa23b60ef3d1a3

SHA1
b60718b2cfae21dc83d6d3dd69dd9c09b83eda06

SHA256
80298e2ac746299b01acf0f486bbbad0bd0cb0454a8e3b8b217cfa5ab5b09b40

SHA512
65b18d62f7f0b69b5e6a0dc720a34629b553e653f32dee2cf52b78e720be31f8efd19e3b4e2808493a62048a4cb57cf084d1f0ef3d0041ef9c8e115ea1ef87e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
918b3674a4de3d6ec719fd9d10d53e03

SHA1
a2a1c1da096c7613f3416143d6c9ef6e4a31718f

SHA256
eeb083d690bf2c14ef365c190cd6bd751bacb7644e88575db4f1d87ae866d604

SHA512
5804164256a9d71f0616e653bf06dec040df7ebdfa5803ed10a9c6c8c57d6688f430f9f9b3b1b802ccfaa2eb9dc91bbcc6a6d6cc0a18d06f34d86011010c684f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d2466132e4c2dd0b8da92fd67800112

SHA1
c4543f59abbfbfb71b51f7ed4099eaddf82a7152

SHA256
1da796e1e4f8a2b5475e88942337d99bf9a75dbd81a9d1f10b5d6d8d5823888a

SHA512
e3a51ed4d7aeeac2db7a6dff166e3d3ae152eb083b2acf76db764fa1bc41f13cb1600af3e4b4a49656f9a4cfd277d3b9cb10223dfdbec7c0c44e993035b9f29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
edaf4fded0b2fb274be1cb1ff5a25348

SHA1
918bc203fe796e3f1a76a3095332cb8b70be5e87

SHA256
a01faae2d428fcd61e365118ff7715bddb1f63213332a3895701d16482115abf

SHA512
f59b6ff7f4fdcbcfbf8983f33c5bbcfb25a0d0575d0d0f8dc27e1468f94e937739b0b1228a7a25028b9453eb7f257288ebb4941a7f83774e7dfdd7bb65314416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d1e00d0767809461695e182ef1ec4c5

SHA1
4c0c521c5c5928ad61fac3b5b438878a58367406

SHA256
51fde8f663bc0757e91dddd35f57466f0713a666de9143a42482568b856862cf

SHA512
cec001945483a8feeab4d5425b9fab29bb3e57fc250898da370a3b79606ac64f0fc42f7cda80fbba0ef9b0b825664ddd889786d1cd06cb2515663992f1605c9e

Download Submit
C:\Users\Admin\Downloads\090a85ef-6351-4617-96d6-34491652f04a.tmp

Filesize
138KB

MD5
6174ba506514ec4b51459759c8d0f0cb

SHA1
4c6340680c3ddaeae06d1a8cd34dfbba2de748c5

SHA256
f22347457dcc1547a18a9aa2526dc2d355b4af14ebc468c0ac56ba1f1084041f

SHA512
799ed2e2ed3837604edd51119424dbc749938a207cd414fa5a709f6b2eef7d9c2195e3b1ffb69a59242190dcf123113b21e895fbee0543e7d74f41abc5729df1

Download Submit
memory/2464-381-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-382-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-383-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-393-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-392-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-391-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-390-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-389-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-388-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2464-387-0x000001FDFE080000-0x000001FDFE081000-memory.dmp

Filesize
4KB

Download
memory/2992-376-0x0000017769BD0000-0x0000017769BF8000-memory.dmp

Filesize
160KB

Download