revengerat | 3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446

Analysis

max time kernel
67s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
Size

1.4MB
MD5

5673c04d81969a6603184069b6846213
SHA1

49fdd9c69f1c281d94486029dfaa5108dfc168bf
SHA256

3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446
SHA512

c381630f7c9c72ca538679bef37b9e966ec2f906bd5eb36a42069e3742ddd57bd958d867ede257edc3244e40fa3a6c65c10cddd07dddfd89cc2085eef13291cb
SSDEEP

24576:rq5TfcdHj4fmb9Ve9u2qTPIMeYyBMLlQjzCEzKJ9TtLzCwn1jAh0zQJ9TtDRli:rUTsamC9uxKjY5x1jAF5i

Score

10^/10

revengerat stealer trojan upx

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000a000000023ba6-6.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Executes dropped EXE 1 IoCs

pid	Process
2180	dmr_72.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-0-0x0000000000720000-0x0000000000A1D000-memory.dmp	upx
behavioral2/memory/4616-19-0x0000000000720000-0x0000000000A1D000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4616-19-0x0000000000720000-0x0000000000A1D000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
1284	msedge.exe
1284	msedge.exe
4400	msedge.exe
4400	msedge.exe
2024	identity_helper.exe
2024	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	dmr_72.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2180	dmr_72.exe
2180	dmr_72.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2180	4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe	84
PID 4616 wrote to memory of 2180	4616	3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe	84
PID 2180 wrote to memory of 4400	2180	dmr_72.exe	90
PID 2180 wrote to memory of 4400	2180	dmr_72.exe	90
PID 4400 wrote to memory of 3184	4400	msedge.exe	91
PID 4400 wrote to memory of 3184	4400	msedge.exe	91
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 3496	4400	msedge.exe	92
PID 4400 wrote to memory of 1284	4400	msedge.exe	93
PID 4400 wrote to memory of 1284	4400	msedge.exe	93
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94
PID 4400 wrote to memory of 2448	4400	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe
"C:\Users\Admin\AppData\Local\Temp\3a6e2de5b3de6e67229b11f6d74a4f9af70ccec85c2573a905df5a1f84a35446.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
  "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54417509 -chipderedesign -a80c61fa351a416282afb39d6c109d6c - -BLUB2 -ruesepaxzzsxavvp -4616
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.chip.de/secured-installer-support/feedback?t=&cid=&pid=&pg=57656C636F6D65&data=26536574757049443D26436C69656E7449443D26436F6E74656E7449443D26506172746E657249443D26536F7572636549443D267374724F533D3635373237323646373232303639364532303637363537343530363137323631364436353734363537323733343636463732344437333637343236463738323833303239264455423D26737472416E746976697275733D36353732373236463732323036393645323036373635373435303631373236313644363537343635373237333436364637323444373336373432364637383238333132392665784D73673D353436383635323037323635364436463734363532303645363136443635323036333646373536433634323036453646373432303632363532303732363537333646364337363635363433413230323736313730363932453633363836393730324437333635363337353732363536343244363436463737364536433646363136343245363436353237264572726F72506C6163653D34373635373434383734373437303537363536323532363537313735363537333734
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ffbc61f46f8,0x7ffbc61f4708,0x7ffbc61f4718
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,18022505338865994910,457266996811918047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea0dba87141745cbfe14d75ccd465418

SHA1
43a22dcb0f39427211f13b2aee0bcc7a18059dba

SHA256
13660ccef6c23e9f70c8c418b3d26764d2a04a307de171666966a95588a9e0c6

SHA512
d8764ef8a812a25e25af85ecc46a2633b0491c7fa7ecbe90a1d2a68bfe9d8c4ba71e6697c6d2c9abd4d5b1634dca51041e7b92293be1a23ce565b1626fae3c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fb0192200eccf6112c6ef7fd911bbc3

SHA1
f4c48564c556ec911c2ae98a5dec72663a8ee1b8

SHA256
0b302428af04840ba7a1a1a6175216a4ea965d75ad22632c49902328e32910a0

SHA512
f36e03bbc9aead567effa6665fadc7c5d9af00782f6f8c091a3a38a90b4f7eba1edd2e87b9146fd93d28953e77c6995d766b18d880107e853c3881cb4b80c45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
355ceb350c130840258e7ceeab207488

SHA1
eafdec4f0f7a7a9285fa8a1f576a694918a87684

SHA256
ea9e21e25d8e388afad796a3ed4fc5cf7c057b4ba8afdd0e8f9caf64a4f3ea07

SHA512
35626b72dfbe348faa29be6a28f3ec4aa52e6daccc259e2730a63f6937d8cd26d28e86c57711ca37e01b1c1a586c6f0331a8ac18b14e668796552eb5375a7d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
62b707d564973b3e24e5d529d7a7d24f

SHA1
4c0ab3f996ed430a25dc49025b0c087fcefa6aca

SHA256
e3b943e86ca7f39bc8d1f0f807f4c06d849d726be0adf86535b4cc97af2f323c

SHA512
874a975974d1522bc37224c815c8f5863d6156fe80f4e239705916213ab8b9222aed54f9088acc139bf5baf70ed382cf51019913936af1ccf07724360725ca7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe

Filesize
508KB

MD5
da9e9a98a7cf8da14f9e3c9973328fb7

SHA1
42e37cbfa37877d247ebd37d9553cb6224d6bee6

SHA256
c1116053bbac19ab273dc120c2984c235d116cdcc9e3ac437951b55465fd7063

SHA512
ce98f1984a3db301df7c1078dc6014fc1a03a1643c5635ef59775ee8019fbae4e07c16e99ec3d1998f45947d57493ada96e5116c359a590b14573833eec17343

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMR\ruesepaxzzsxavvp.dat

Filesize
161B

MD5
c800879c1c73dbbb198fc42669646aa7

SHA1
ab63307099961d43ebb2b64809b7f39d030bab7b

SHA256
4c4dd62b579e43dc1c4cf859299df3023409492281f173bc5c3d2cc00bb782d7

SHA512
0bc20e0c61f46a6c8eb0d8c276edc1f1901ac2f2800199d78490ba0b3c096e4cbf08a175ee19f663d7c13d56e7b6852f32478ea6c85f7829f6fd2880023213df

Download Submit
memory/2180-21-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2180-20-0x00007FFBCE620000-0x00007FFBCF0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2180-29-0x00007FFBCE620000-0x00007FFBCF0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2180-17-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2180-18-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2180-16-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/2180-14-0x00007FFBCE620000-0x00007FFBCF0E1000-memory.dmp

Filesize
10.8MB

Download
memory/2180-13-0x0000000000C80000-0x0000000000D04000-memory.dmp

Filesize
528KB

Download
memory/4616-19-0x0000000000720000-0x0000000000A1D000-memory.dmp

Filesize
3.0MB

Download
memory/4616-0-0x0000000000720000-0x0000000000A1D000-memory.dmp

Filesize
3.0MB

Download