phemedrone | hxxp://www[.]mediafire[.]com/file/v04wcs9dlfq5ke0/VanishRaider-main[.]rar/file

Resubmissions

28/02/2025, 14:45

250228-r44veszyat 3

28/02/2025, 13:17

250228-qje5ws1jv7 10

28/02/2025, 12:52

250228-p4e5yszrt5 10

28/02/2025, 12:32

250228-pqra3ayyhz 10

Analysis

max time kernel
35s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2025, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.mediafire.com/file/v04wcs9dlfq5ke0/VanishRaider-main.rar/file

Score

10^/10

phemedrone credential_access discovery spyware stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Executes dropped EXE 1 IoCs

pid	Process
4560	vanish.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
3624	msedge.exe
3624	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
5176	msedge.exe
5176	msedge.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe
4560	vanish.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	6040	7zG.exe
Token: 35	6040	7zG.exe
Token: SeSecurityPrivilege	6040	7zG.exe
Token: SeSecurityPrivilege	6040	7zG.exe
Token: SeDebugPrivilege	4560	vanish.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
6040	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4116	3624	msedge.exe	86
PID 3624 wrote to memory of 4116	3624	msedge.exe	86
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 3288	3624	msedge.exe	87
PID 3624 wrote to memory of 5092	3624	msedge.exe	88
PID 3624 wrote to memory of 5092	3624	msedge.exe	88
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89
PID 3624 wrote to memory of 4628	3624	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://www.mediafire.com/file/v04wcs9dlfq5ke0/VanishRaider-main.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba65746f8,0x7ffba6574708,0x7ffba6574718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6758462214749208582,5599266129530631999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:6140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5956

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VanishRaider-main\" -ad -an -ai#7zMap917:96:7zEvent12007
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6040

C:\Users\Admin\Downloads\VanishRaider-main\VanishRaider-main\vanish.exe
"C:\Users\Admin\Downloads\VanishRaider-main\VanishRaider-main\vanish.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
1KB

MD5
c6150925cfea5941ddc7ff2a0a506692

SHA1
9e99a48a9960b14926bb7f3b02e22da2b0ab7280

SHA256
28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

SHA512
b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

Filesize
276B

MD5
92aa1c86a1ef935d89d48d620310d271

SHA1
d50aa832fd5b21fc22f825a26325b18e0449f576

SHA256
4fb6089ba0ab058a81c1a278723ba79e60ccee994e640408bb6518f655bd0688

SHA512
59d4289140995ef1fcf2c432f7b8e62bc9c229f8603dfe88f605606a4a3b1761c6f33502a1ce880d96d478aedce533ea52895a87583de29a96be6e03840e8774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5edf606e-10c5-44a3-8ec4-33d769b694dd.tmp

Filesize
10KB

MD5
c4bae97177d41bc14d49d7159cc96f96

SHA1
c27cebcb3a3240fb4a1529e0e4ab8328bfd6eda4

SHA256
4898adeeae79838b4979717527c476e6976f263bf157478adb9ba2da5e9b9464

SHA512
af6e86715d68ac886574b53a3fdd25aed7f8d965b0868a7c49a485d74de30d8dfb3d02ab95714566437ff658273da4bbe3e9481a2cc4e795c6df96fd64abfbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b5cfebecbfd715cf1c2e86aaba6753c

SHA1
c2d783bdd82fcfb68e8d566bcd34ead327ed7c13

SHA256
6fca1fe2a780fb27f0493353a73b9ae02e9671b51a50b07566a322abe3b25cbf

SHA512
b6ba779a8bb083a12f7f100c4c338d5902f2e2762654f70fb578dae4c0dccba1c7eec4cb0b5cbc1d8567fbb02624a077fe9f60573dbd12b78da4e5ae618a751f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a690d53f0215760186aa07b114ac4561

SHA1
601015b3d5837e99e481db0dcdb0ea33fa80cefc

SHA256
8ee92ce70ce780b9af998d760d7226892a37c4a7ca5bddfaaaa5da016dbedd93

SHA512
935db7966c0c541b2894b83af14586dfffe138a2a18dc60bfd9d076fb724410841b5536261a090ce57525f8a7dc25e4bc3b133fce61569beebf4efb126607a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
979a83b0618818ea604ec9aa0e0c866f

SHA1
3f3ba9011580e769a4ec1192f5a5fc040a1bea07

SHA256
7cf849666fdc2e0e348ae31833ac7473333fd20d029b4c57b0d30a74095556ed

SHA512
3da654896a21dcd2fccccc1989339cac07905e47c582ddb06c07ced460a7f5ed4dd83035eaa5e3f382e9134d46eea86339e94df7f580873572d3ba0519ba276c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
35a4b0bd3ce2f37d2eca2e42a7fdadd6

SHA1
8469fba92cc79ead6b666a8359b2761ecbc5d682

SHA256
85169429a171ae8c839ce02387136f1df7f51d4cdf13892aafc72980cbe7053a

SHA512
4681cb58c576be0ea70e2bb721fd6550ed38a9039715f88938516fe773a045e56a6d7e49e1160485a62f1f740c317e3cc0edf018fe10efb317249c3784a971be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3dc25e9aa882771db1c77638c7a06c1

SHA1
c0b924d05a37297687c09736c9645145cb125db9

SHA256
d59bd9a0ec1fa8c5ec2eb9374313322e8cd05bd7187de273737e7f0a32ef92cc

SHA512
0bd980445f4becdb7688321ef03669cf37e049e25d76acd684632322c63a34a7d209f93ede33463872b952cc31fcaf667abaa5a88e84cd1f4b4552c9086d9313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9ac7d64ba533facf33c12b2972d57175

SHA1
0ebaf3c94cc3e9b9b02d7547a09bb717a947fdb3

SHA256
3a40027ca447bdbc4a277cc817c600cb359e26ff350c7bacf4c87e8b35f556a2

SHA512
96c4f83e1963bc4f6367b8916a97c8185cdbd9e33dcc89a541f1688103296226c017c84e3e41fbaff1ed197563871183f620562a02f1f0bcdee117247a878e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
8917920fe5744a08288c3a881e64bf99

SHA1
b3b46bfecffe2382a8bf089efd75db9ddfa058cc

SHA256
081ef17242185c8b20c64f6501b80dcd7656699869649beaca790d982210a7d7

SHA512
cf58d178c4d7ab46723e610a9518d4f181e7690e066d887bd1247ad6f8d4680e38a0d32dfce8d2b89ff5788781448e033ad0a52c30f1594a800d733e6b573106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9a1c5c1683b073fcd75735c61692bf9e

SHA1
4683363cccfcb7414471a3c3add1dd98b1d99694

SHA256
10759a56c72b3cc3cefa69fea8234eb31074e0c4a4f09ab23d87522dbdde1584

SHA512
2f62387744af046c1b7cbaa9c4fdaac3e8842465cc7b0d56f4b4758022534d64ddbd25a51b4904c882ceb865fabbb0dab37adcd660b33de04fc5bf0da7fc2836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
f847fe0141b21b0089601d4717f89e90

SHA1
8b7b0859c8e5cd1111f8ecfd889a8bbf104e2ddb

SHA256
8be089f85b8eddeeb89198dcb7fb0627920872872e361a730c0863e326e8260a

SHA512
e9ba534801f4e4723379d57f9a08dcdda5fddb1488be5c7e085d3999fb34f86e4f70cc12907c64ee3eb8f0268b09447565c3f5f93a01ef16149518e4c1fdf1f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
698a18710fcc46b030cfe6b42f3000a2

SHA1
8a228dd68035726fa1dc0ec5e3b265075fe2c0ea

SHA256
cf1d55d1270edd641877c713f4ed4f7a3fc18c4b71594049c5f0adf20ab1104d

SHA512
486b08fed550f2693a664ba96a380c0fa29063bf3b4b585acbcac49be937b4e3d4b9d17fdf47659f278eb1458627574e073e73ab08b347e8878ba340377ea2ce

Download Submit
C:\Users\Admin\Downloads\VanishRaider-main.rar

Filesize
61KB

MD5
3d15d9b5d05223d0b812f1f51eb05ecb

SHA1
7f0f19e7128f546193685be6efe39a2ec61d8175

SHA256
c39552926a046eca64dab7cafbc9002ae22d592cba749fa03b6416b4a299431d

SHA512
7c65b4fddf10687c119718d136e45c570c4a5f9bb2ddbb23731813b5975d79a91ec062d7722909ede8ced4ac5a6fdb654ca9f1780546f50400f5de095f088ef1

Download Submit
C:\Users\Admin\Downloads\VanishRaider-main\VanishRaider-main\vanish.exe

Filesize
137KB

MD5
ac59764dee7fcebe61b0a9d70f87c1e1

SHA1
4faba8946b946a6eeb121561417ae13e4ec8c606

SHA256
c6487e1da77c82d40628312680ad43343cff5b92462ffeeffed30f46b23625ab

SHA512
b71f1dbc069ee6612b0d6a136d77080f919958e7a6bcdf65260e04ac5efc484042aca0716dda8199970bf7f2d0f4864a4888e3b0dcfd1ef858c615f839c3ac65

Download Submit
memory/4560-239-0x00000281FF300000-0x00000281FF328000-memory.dmp

Filesize
160KB

Download