mercurialgrabber | hxxps://github[.]com/xsplitst/RGF

Analysis

max time kernel
43s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
01-05-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/xsplitst/RGF

Score

10^/10

mercurialgrabber evasion stealer

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/975244014364270683/FZnH_sfT1E7Axl_7pfCffp86xK6BWVM_UXXb74CN2p4kpHxH_6kuQsuzlglxNPVfnIm6

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

RBF.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions RBF.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

RBF.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools RBF.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RBF.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RBF.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 discord.com
31 discord.com
32 discord.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip4.seeip.org
18 ip-api.com
29 ip4.seeip.org

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	RBF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	RBF.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RBF.exe

flow	ioc
4	discord.com
31	discord.com
32	discord.com

flow	ioc
16	ip4.seeip.org
18	ip-api.com
29	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RBF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RBF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RBF.exe

Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

RBF.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S RBF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	RBF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RBF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RBF.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

RBF.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	RBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	RBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	RBF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	RBF.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\RGF-main.zip:Zone.Identifier msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\RGF-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2856	msedge.exe
2856	msedge.exe
5024	msedge.exe
5024	msedge.exe
4064	msedge.exe
4064	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

5024 msedge.exe
5024 msedge.exe
5024 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RBF.exe

description pid process

Token: SeDebugPrivilege 580 RBF.exe

description	pid	process
Token: SeDebugPrivilege	580	RBF.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

msedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

msedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5024 wrote to memory of 3460	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3460	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2864	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2856	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2856	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3608	5024	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/xsplitst/RGF
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe07e33cb8,0x7ffe07e33cc8,0x7ffe07e33cd8
2⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
2⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16516299093010426173,12916891027944943634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1032

C:\Users\Admin\Desktop\RGF-main\RBF.exe
"C:\Users\Admin\Desktop\RGF-main\RBF.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RoBrute-master\requirements.txt
1⤵
PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
a6cb4267a59cab44fe58579c1e095844

SHA1
af5f06cf1832ace03b8326f97e56673217a4ebc0

SHA256
62dc4924b1e55cb97bee5dd1f59fdc4bdd52243450f6ee1490f25c59dd2c9d81

SHA512
5d86907b37015510efe37dfe83670380fa1b8540ec1259200ba0ca01bb6a613ce64d8c54f93c27cd402015df4ac71c33813d032be61f1f6d2685387af2792700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
573B

MD5
a6d346f58cbec0a6e4015327b25f1537

SHA1
750056e65a8b1c20b1a6051f5adcdf35821a6ac1

SHA256
1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

SHA512
74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
70138d8409b60024d89623b3c3e65c5f

SHA1
5c3282d2d837a217d1249fa3f56be9ee18999df2

SHA256
179aeaf325288f4604e21999e4be196c6b877186b06d91a1e5387082301644dd

SHA512
9dda8221874ba9d9ffc4cf0023cbbb25517a0574424061f94cba5da2dbedddcf96ae79e235f126b3ce19ed3f67bd3c8edfc80d7d90346e87901dcb007943a51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6dfa0d6f2fdf6c87f5fc4845324f4d4e

SHA1
8f6649a5607af7b93e4a1871107bd1c496a07a3c

SHA256
e86b56d807456749dfab05e49249595b3329b2f73beede55092979af15ffa64b

SHA512
5e6e8a67dcc3a8f0acd6def4e92d67dd1e34093f2644ce4cc97b479c63301c133c9727a5f3d68a6995acf290e1b634fca56e9675ba0865ca9013dc2b986fc6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5285d1d9c5bc16dbace7e6a11ab6a3e9

SHA1
e775580baad60bccbbff722d160f591824a67e70

SHA256
1f55b606f336f414542aa2cb801a0537da50ae23c61d18958609ecfaefe859b8

SHA512
a7dcc5d4e9222ff96ad7fa067bdacef5259b9c6c7e40d66d14f90261de4bcb8f025e0d505caae626bc9928a5cd219535ad467708b223f7b2dd2826247d8fec2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
840bc41b9eb72c5d19d8820a599cecda

SHA1
fca2dce7578645da06cb01a8e670df6bca82dacf

SHA256
1b14e9191246f7384eb7bd151751e40662fe01f0d4cc4569302ebadcccc4dff3

SHA512
738d514020b74fcd0bc09209952af7c04f44604e97ba638e3645dc86dd653cb4f15c2c633fe1bf1e9606c241bbfd4cbcc331ecf8a962505c1e0ba99cf76f37e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4c521b5608d9a2964b51fa7b0ec2cae2

SHA1
f40ab8c8f3f3a4c84993872c98e2851f057d9ced

SHA256
f6faf1f00419b698060eb054129ba2a441e55cbdb7de90c57ec0b730ae0427b6

SHA512
5bd91677c7a10a457244eb44928b150cc1d57c7dfe716222501f003a3bc633c1b2ed66da8e80608bc1455e415d9902e56480161ada702a0b65dfc6b373cce38e

Download Submit
C:\Users\Admin\Downloads\RGF-main.zip
Filesize
54KB

MD5
7bcc565dfb0ce789f9a984870a64414c

SHA1
7918e05800b7d02be5aa3670259709fde7f5c268

SHA256
33461d788a33b88bed3d489826f9fb766cae421f322b81c5eb861718a1dea7bb

SHA512
0490c139cd781e827fa35e55d21d887990febb2ab158baac005755ae1825904cf8f2971a10e75e135fa350c40ac841815ddeb2fd5c9da2d7b350e9c509f027b0

Download Submit
C:\Users\Admin\Downloads\RGF-main.zip:Zone.Identifier
Filesize
141B

MD5
41d49b09e778e0d06acdd589802e24f9

SHA1
c607649d4694697fe3c00189c49cb5b65a332ad1

SHA256
2ce855dfca046a8c190960a568ddd65cec9b1d86b9a375fc9b25e6968377b796

SHA512
782b1aade1fbe8811652441f8f7ed22f44e1b21002ffcaa2e288e35a69d046fd8c460bd4200b31785c2a76fdac271f629e1e2217818af49d1e238cf61dcb7588

Download Submit
\??\pipe\LOCAL\crashpad_5024_NDJOLWKKSXRSYDQG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/580-295-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download