phemedrone | hxxps://mega[.]nz/file/5b1iVaZT#rbLX2xFGDfc1aQGgEhKBFkGt3wEtagSZBNVq0_7tXb0

Analysis

max time kernel
149s
max time network
143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-12-2024 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/5b1iVaZT#rbLX2xFGDfc1aQGgEhKBFkGt3wEtagSZBNVq0_7tXb0

Score

10^/10

phemedrone credential_access discovery stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7668501460:AAH2A5oRhWUqF_EWSrJaaRppA9RgQdU2iUc/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 2 IoCs

pid	Process
6048	Bootstrapper.exe
5388	cfg.exe

Loads dropped DLL 1 IoCs

pid	Process
5388	cfg.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
80	raw.githubusercontent.com
81	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5388 set thread context of 5044	5388	cfg.exe	125

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\601282fc-474b-48ea-890c-901b162b568b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241226185853.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4572	6048	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 742517.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
4476	msedge.exe
4476	msedge.exe
388	identity_helper.exe
388	identity_helper.exe
5752	msedge.exe
5752	msedge.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe
5044	vbc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	2384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2384	AUDIODG.EXE
Token: SeDebugPrivilege	6048	Bootstrapper.exe
Token: SeDebugPrivilege	5044	vbc.exe
Token: SeDebugPrivilege	2792	taskmgr.exe
Token: SeSystemProfilePrivilege	2792	taskmgr.exe
Token: SeCreateGlobalPrivilege	2792	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe
2792	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 656	4476	msedge.exe	81
PID 4476 wrote to memory of 656	4476	msedge.exe	81
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 4028	4476	msedge.exe	82
PID 4476 wrote to memory of 3472	4476	msedge.exe	83
PID 4476 wrote to memory of 3472	4476	msedge.exe	83
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84
PID 4476 wrote to memory of 4128	4476	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/5b1iVaZT#rbLX2xFGDfc1aQGgEhKBFkGt3wEtagSZBNVq0_7tXb0
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc6dee46f8,0x7ffc6dee4708,0x7ffc6dee4718
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff770045460,0x7ff770045470,0x7ff770045480
    3⤵
    PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8478079709883575923,2293120844508088841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x244
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5940

C:\Users\Admin\Downloads\Bootstrapper.exe
"C:\Users\Admin\Downloads\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6048
- C:\Users\Admin\AppData\Local\Temp\cfg.exe
  "C:\Users\Admin\AppData\Local\Temp\cfg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:5388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 2940
  2⤵
  - Program crash
  PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6048 -ip 6048
1⤵
PID:3884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8978379b8b4dac705f196c82cddb401

SHA1
873169c69e4aaa8c3e1da1c95f3fc6b005f63112

SHA256
83528bc9af5e037e40f14bece26788301e4555a6164b31e6010d93d7d18f0afa

SHA512
2d73194d03ea51d4154ee9556950dee1e666720c4b53fe671cf2e7647889d480c2941757d6b9b4c60a29a6799478450136f4847b0bec5d4b6aa630d9ca856308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c8c74ab5c035388c9f8ca42d04225ed8

SHA1
1bb47394d88b472e3f163c39261a20b7a4aa3dc0

SHA256
ea821d15371cdfef9f4c01c71fbe39f9db7bfd61e6a83e09b14886c5756cd9d9

SHA512
88922af80d561b3cf10963160d245044554f9011e4aec4fd40c740b06e5e87e9bc16ed309e296f549d9244b6cc93f627d6dd010eb2d325b38cbb1d43d8b95157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
b30fb4f09aab06fe1af7c0511dd4bc53

SHA1
01aa65542387a161ed2e1a64766b01a19a66e2c7

SHA256
648431b773b84a194bbcfc18449a39ace891930c27b3687abfe2813cc2306616

SHA512
7b4837ff9dcb24cb963b93754b57f2926b11058285949d37eff8e7932bdc9222dfbb058db99b125bcf286fcd293d9fc2dce9b83d5f77300fe97860e617ecd3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
dff481a393f8c1101f42568a5df80fb2

SHA1
b27b791e5377c5840292e91603ebb721cc2f252e

SHA256
be5bf987ab6fb497f36bb4b7aeb0d77e12987783d4fd8be7f2c72c733d5175a7

SHA512
08071044b34262393cb50175fa519e63afdaaeb6ac4f87da71697e540cb10ee5a7c24834d99c5ea5b25d14070b5fcda4e819eb1f7722885f9d7dde96cf38db30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
53f53587761a0c94a7ad7a83bb89098a

SHA1
57ec5013c137e3d23cd99e577280df619a0954d1

SHA256
98b7c0d7b32a9e168f24e1b67eabe8f3eea2f2f3dc6b452f6651ba7d2ea7e8b7

SHA512
27df82f1918bdd05cab5ab414eed90692582c625bb78b42e4ff05c06a6981690a50580a93acf7dfb11a28c849350cac63409d27ef7b2fac16e675bf8b7f1daf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe589371.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e07fc735489d58c25df17e8422b4c3fa

SHA1
a10f4daf79752fabd625c9531aba12be56970404

SHA256
ff7ff6e115668d212ac45b15fed959c41c28df1b669f33a160de6cc22c51df36

SHA512
655ad09ce8a8ade5a1dd2aa0e18732263ff6fe6b03f021e83f2bea032fbf93faf8f27d0bd6240f08bd6a5f77c47a54c2fb8c1b2d640e0b69ad545e2e097733d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ec8b8c005608f5bb08be7679e43a432

SHA1
df83ea8032f59cd6b3c192e51526d3b4ec058373

SHA256
1449fce145c49aecc5021bf3778d9bd353cd5cf523e6f0d35138d8d3407b630d

SHA512
625f7a158a5c12117f6ce06a89986b821fef4170a0776c7886511e3bb47268d81fb74153e13d9c2a43db477123a5d9f4c3cd345d6f740c57326e4819c67d87c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2fae0382a7adcb2d48538c17f3a1565e

SHA1
354ed74cc0f98255b24a210d5bfa7bb221ad2813

SHA256
511507d1e68399d99800f9b17061032c6ba6edc1c251ad3a405dde8ce34bb005

SHA512
5ac764f51b1e525bb2fcaf318a0f940c2d7ad00c1fcf78740db1806b01847d3f888846f23100cb9c5383d646d41c8a0cabce7b4a2c4d4d3656d855d0d112b3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
671cfbd0275770e681ef4ede37140969

SHA1
ac145dd046e86ab6aff6340664c509c4fd5f1746

SHA256
dfafdb318c177ff96d9b85ed518f229398c3f5161f0ca48ff427516292b9d823

SHA512
d76a8d3a91d1e5e84b35cfa815736c1d0bd7252381f4e540a8d7102385224167b995f698559c95fa18ed3a50e14a58fb0a96bcedb57d4770df50f98c6d331faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
55182d891d98ec9d988cec04bac8752d

SHA1
e18a06e1498ff69c1c2697df7e195cf922a92e01

SHA256
08dc082566b36f693f93e341a5eb4e93a95d5bfed35b952f5ddcf4a5d51e963d

SHA512
35b9bf0c05da26bcebb4e259deca27c84e28521aff5a27af8205624581d1b0a7da6350ee7de0a2329c9cbc1d8cf205c1487638196232cbe794aaa91b0d86d0f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1bfaf9e2b5d75c489ff302e9a72eab1c

SHA1
bf84479fcaf253e09c73bd0a5ac16daf93f7cb7a

SHA256
c2088e63ac1af60c2580800b0e9835aae1459200c9d7d71754bba856f7e154d7

SHA512
22cae1ed1c6ca9925bc1d0ba342a2345355340cfac244f104d32b1f759c8d6aeeedde398b323fa3007833b89c66849c106477b0f72c40d525856254a3cb88321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e1d4.TMP

Filesize
48B

MD5
e96339a30f9497f5f3d34b92fbacbb51

SHA1
9566c0bd0715992590030e1bc309bd874458f848

SHA256
9d1fe963663e0b8278c4464baa70af72f823b3d39a4cd2b06266c47adbdc844a

SHA512
fb0f701040ddcb53f320bf64529a40f6cd17efa91c75a21a16ee761979c285c5251a285fb828039539f6798549efd0995979256e292abc9053230f03f3fa9de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data

Filesize
4KB

MD5
47d51beea86408c240b4251384386ab7

SHA1
5b858e835e716717946d89d787f3a189ae9c426d

SHA256
28b7183dcf3ea002187959d15d308f01749257ac84d5265ebfd90f4745ceaf64

SHA512
e36ca1161a7a225caed4e30c886e95b8a8ec3ba4a73618048a93a6ba4341cac47f97ed103df6e6d33088da5517d1efd42f16386b0b1614dd5208e2d0756f0821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
62262271313f02f47eb5de7cc342c984

SHA1
5a82225c10a1da72df2e435d1bc71a3b1f9a4c3d

SHA256
890dbb8332abefa1c153c54bb1bf5ccb1b83677137f0d75fb9cf0bfd5e4a9db0

SHA512
35a5b1c7641dcfdb834fbcf10a516fc7fc2e05dc69a6aa77e8bc2ff325b21bf0d3a6dd1e6c5a5dd6cb75ff60adf1c0e03f237679146c7211836398b7bb323e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
5505a4ac25e14b5eff881a7ee51380f4

SHA1
b884a01cefb2388127b25a8e7a682ba044355c11

SHA256
92ff9b3582b88208926496c13c4b7e3d3e9d75a47deaf1326f3e1bddf7027414

SHA512
65ca7c94b7b5dc5f23ab3f2a2dc0a1bcd0f496031f725652ab8e3ffbf86d2042e97301e82c57ded9084f356ce845af50f3d0c48e61dd2216e5507bedbfd62cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
55dc6e25dbd2320c2012046cd45a42af

SHA1
19b613903912ce08bafe3caaf730ded14b94dc69

SHA256
d28e47ce7738eb92d054d0040a93ef26a03fafffb0f72bd3b0aae1041fd23969

SHA512
9dd0af3910c7249742360dfef10f15114d86fe80c9f4a055340e3114f3244debd93841a10bcae9a9c3888f4f73de6d5077333e84a4dd1ce2af3e9270c7e5eb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a62ae91b8b9537cce6c6be8253f54cc

SHA1
b01ee4f97f6f4f812659a78bd84a4999dc6c653e

SHA256
7a074b9737acac83b6eba6fe9ebff458084e3c7e37bdc9ac8184b447586c7b4a

SHA512
184fdb99520f98fff4c7ac4da739bbae024f91d40e34c48eb155fc2fda3304153cbecadf56aed50913994469e81e4c8623608ab489de8a379023a107573d7a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1c4a38814a3eaaebd6dd9d2993cf1781

SHA1
bd711eb4f1ff32307abbc6bb5e7e0035acebb757

SHA256
47bb6e99c890948fcf0838e1de1c76ae54ce7af5403d9127d52c713a22fd0ef2

SHA512
483d6f7014e102a6c9e07f2a4cc33bae1af9747e2de49dcccc2c90f6a23202f7d19b03b66534f2952c50c77ed685747798a24d7028de466878576b9dbdfa833d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cfg.exe

Filesize
320KB

MD5
4f0990ea72c03f3911be671cbceb7fda

SHA1
d07332f930099c4af178e4c4adcdf166decdce91

SHA256
b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290

SHA512
903b441d433b39fb8b2d3cfd658261ad2c62d51e5171b0d1cfc37d058a27c946209b2fc1d9ca4ab3ef369753339a6c6d3845e95249d3b77a08caa2099c40e63a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9ba0d87e28203b1d31374ba97de93945

SHA1
f73e7c6f2947a2ecbe09f9cfd639f5301a4dc261

SHA256
fc0fc13de77f157d64d3a61cb104ad26a3295165044e59109adcb19292ac1a4b

SHA512
d74583fa12700cc24042e1f198cd146c720af25556022e2ec0d854cc8158049c8033d47f471c24a233b79e72ac72e70f5889d7f20fb0a696a5ad590496bf0d2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9e088c77580daa479365ecbb97547389

SHA1
3c4cfc88f22a833b2e68ce87e319ed2015717b3d

SHA256
8526eca9b9a3a0a61c0db0b5d515aa6a25e450503221c2e21de8a85c023d88a3

SHA512
ef565f4820a955ef34caa6a031d883ee26b4ba47a14acedcd30a4d80800d4a6f57e0a4592fbb2c293b5bea954e45ba2c5e3868c5ee87bf358d414d309ca624da

Download Submit
C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
308KB

MD5
0120de6a2b5003af22160995d1abafd4

SHA1
18e60d75526bc9edce26479d1f46fdf8c2e2a353

SHA256
f2ccaa6bcffb8c63d0455c9511225b6c5e8c55c1d8076e42f115b553bdf2479d

SHA512
967b3a6d884c1839e6ed7ac4e31b0842b89026bf53b315f4233277996e5de97d5813e7deb409eb19bf19fb99df7695c3573eb89301aed7314f8acd43b5dcd27a

Download Submit
C:\Users\Admin\Downloads\Bootstrapper.exe

Filesize
208KB

MD5
a528edc512d8a5359d4f3729df3da2aa

SHA1
1453b1b879429c8e17f795ed7f7d181658fc883c

SHA256
636e06dee0e3ba0c630b5dbe5d8c3ec1839f067098aaf9a3c083a2123c425099

SHA512
009dff6f5c19cd73b313d77bf770efebf8d69d8c85c17fb4b4556d80f70d04727719687e1c808c7d127a8f5a2d9debaa88ea5e9a4bf768033cb60af81b1b933e

Download Submit
memory/2792-781-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-775-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-782-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-783-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-780-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-784-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-779-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-785-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-773-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/2792-774-0x0000020057B80000-0x0000020057B81000-memory.dmp

Filesize
4KB

Download
memory/5044-429-0x00000000008F0000-0x0000000000918000-memory.dmp

Filesize
160KB

Download
memory/5044-772-0x0000000006C70000-0x0000000007216000-memory.dmp

Filesize
5.6MB

Download
memory/5044-771-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/5044-770-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/5044-427-0x00000000008F0000-0x0000000000927000-memory.dmp

Filesize
220KB

Download
memory/5388-420-0x00000000004C0000-0x0000000000516000-memory.dmp

Filesize
344KB

Download
memory/6048-396-0x000000000A490000-0x000000000A49E000-memory.dmp

Filesize
56KB

Download
memory/6048-384-0x0000000000800000-0x000000000083A000-memory.dmp

Filesize
232KB

Download
memory/6048-394-0x00000000071E0000-0x00000000071E8000-memory.dmp

Filesize
32KB

Download
memory/6048-395-0x000000000AF40000-0x000000000AF78000-memory.dmp

Filesize
224KB

Download