asyncrat | hxxps://github[.]com/blacktopservices/Nuclear-rat

Analysis

max time kernel
47s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/blacktopservices/Nuclear-rat

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000c000000023bb4-181.dat	family_asyncrat

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4252	NuclearRat.exe.1.8.exe
4336	NuclearRat.exe.1.8.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 647776.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
3456	msedge.exe
3456	msedge.exe
316	identity_helper.exe
316	identity_helper.exe
1312	msedge.exe
1312	msedge.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	taskmgr.exe
Token: SeSystemProfilePrivilege	1924	taskmgr.exe
Token: SeCreateGlobalPrivilege	1924	taskmgr.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe
1924	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 4528	3456	msedge.exe	82
PID 3456 wrote to memory of 4528	3456	msedge.exe	82
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4784	3456	msedge.exe	83
PID 3456 wrote to memory of 4964	3456	msedge.exe	84
PID 3456 wrote to memory of 4964	3456	msedge.exe	84
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85
PID 3456 wrote to memory of 4268	3456	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/blacktopservices/Nuclear-rat
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff952c546f8,0x7ff952c54708,0x7ff952c54718
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,9166618380211892801,1415672365780339112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Users\Admin\Downloads\NuclearRat.exe.1.8.exe
  "C:\Users\Admin\Downloads\NuclearRat.exe.1.8.exe"
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Users\Admin\Downloads\NuclearRat.exe.1.8.exe
  "C:\Users\Admin\Downloads\NuclearRat.exe.1.8.exe"
  2⤵
  - Executes dropped EXE
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4346a9a3d4abe36113486724c1612842

SHA1
a23830a095913858869814521592c787016a9c7b

SHA256
8e9a2c44ee577037c99e780d9170f7ea3349b1812a7aee6815243f8f209cbe6f

SHA512
5c48f0f39f7e3ad3bc4cf914e186d5e9bf37044a11333276206304457956e72e1756a482fd567503f400d8b0926d8fd4186824336e682a2235704cbd0770cdce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
950f6b3be4fb042207b8fc389ae4a1a8

SHA1
1d19275875152acc65143ed01535261616eacf43

SHA256
8beddb2427d4963167bb7698bc1fb028d8fd357ce0e1ea206ce7bb9a2097ade6

SHA512
37e0d68a26ba5fcc95dbdadb7c7d4bc0b4e5f02472585da16e2f1f0139579fc1c8f40818e63264425e12e37737440ea06ffe6c504519157db60a5cd549d17f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6db9343f3d00774b6f2429023f648c41

SHA1
bda38fa0902b673dd7e6a84935662396b8a27382

SHA256
a06da943e980a43c69905cfc4eb1863279c454e8af74dec1e9c4c8e73e054050

SHA512
135d075646d69249d25844cea3b4e1e83a027f122b04c8a18a826cacddb9581ebd8d1564d9a37933e53641d1167e3a65b073ea94c6e0f21bb3daf759bc94210d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4360a00a181b9eb97bae6f24b9f79c2

SHA1
df3b44e5b4955b9216d2dc63cf5ce979504922e0

SHA256
9213bffd9f9f0248fe414a952a442dbd3ab57fd22732ae2f72b202f6c251c9dd

SHA512
44bc05cbac194805c7ba08341a3fc769a88690cff872dd0d18f76eade2f6951494bfca79df9fc34645c94b2484eff9bae7face1950b638b5f6e81988a5259488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3010d5df9b82eff3dfa6d28cc9c6037b

SHA1
7382e050e0cb53af87c5a3be6be872b50523a400

SHA256
bfd2bfe6a4aef64a116d446dcc445710e838a40f839588ba3024940a2a9796fa

SHA512
4bf90995599107a8b3fc4dd96fb0b92a83db092d93a712b7219d4ac10624872b2b475a114cad29a2ec36c68c28723808dba70378c95b3c2617e958ac65ded6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77805df95e105a78207b1b9d954bbe0f

SHA1
7452c6af6f66226f7d320a92138bc53fcee77d07

SHA256
cca3e9ca3b7d756a309c5375c3b6c42c8b98258042d83e25f18b506a26b0e1da

SHA512
68c332c34c8ee94bcb5157063922549adc479e697aa0b292f181a34efd7c7c8f4031303eac7b0d9d6d7c437892497aba27d859bfe0b548e69d76b2c5d7b88518

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 647776.crdownload

Filesize
76KB

MD5
eec7a5928ec96c9f2733d328aa3d30fc

SHA1
4f9d8ace1f5407ee6c5ba4e2947b53a12cb0721a

SHA256
a1155e2b51e2f8baeed2992b17329108cddc45faf19ac0024cd5efd002f030ad

SHA512
25e340a57913f01474919d0cff6b0785cc53614ec9e215f99505e6347fa0060ed8f40337233bf9e2b1f28cf26c43813d3e1e4aa08f222df9294552a7aac23275

Download Submit
memory/1924-236-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-230-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-232-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-231-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-237-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-238-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-242-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-241-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-240-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/1924-239-0x0000025589990000-0x0000025589991000-memory.dmp

Filesize
4KB

Download
memory/4252-204-0x0000000000E80000-0x0000000000E98000-memory.dmp

Filesize
96KB

Download