discordrat | c1a1acf65df9a9307207c05d2b4e46e0b6a206993e7ffeab1e37a0229bfa58cc

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot_clientbuild_5v.exe
Size

78KB
MD5

272c0bb50fd35244680dcd9a7a3746c9
SHA1

11b364658d8ae8c712f32fddd06c25ca1af98360
SHA256

c1a1acf65df9a9307207c05d2b4e46e0b6a206993e7ffeab1e37a0229bfa58cc
SHA512

47c8e5274a1bb9e4725827703a55c59a776760876cf69899e162ab96bc1e316945bdfec9d679eecc7e1bffdac0c7219fdf8fc4e50ca75a9a668cff9077fc9a3b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMzY3MTgwOTA5ODk4MTQxNw.GRWNiT.2JZS07h5O6T2Rs6Vp3X_fJos21mrDUst92T6J0
server_id
1212597579477426226

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
17	discord.com
60	discord.com
108	raw.githubusercontent.com
112	discord.com
123	discord.com
124	discord.com
18	discord.com
33	discord.com
45	discord.com
46	discord.com
109	raw.githubusercontent.com
110	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3600	msedge.exe
3600	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	bot_clientbuild_5v.exe
Token: 33	5060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5060	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3600	3460	bot_clientbuild_5v.exe	97
PID 3460 wrote to memory of 3600	3460	bot_clientbuild_5v.exe	97
PID 3600 wrote to memory of 4984	3600	msedge.exe	98
PID 3600 wrote to memory of 4984	3600	msedge.exe	98
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 940	3600	msedge.exe	99
PID 3600 wrote to memory of 3812	3600	msedge.exe	100
PID 3600 wrote to memory of 3812	3600	msedge.exe	100
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101
PID 3600 wrote to memory of 2800	3600	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\bot_clientbuild_5v.exe
"C:\Users\Admin\AppData\Local\Temp\bot_clientbuild_5v.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa05b46f8,0x7ffaa05b4708,0x7ffaa05b4718
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3960 /prefetch:8
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,2878583740153167575,10734908217516252722,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
7953b6f77357ccfa34cb4ac8d48a6207

SHA1
62bc698b908f8cf398e63ffa6f8db651bb1e2af3

SHA256
87f202da38f88a889295b0a26de2e0d9194eba444785545e53503cb485227c58

SHA512
401db7871a8727c9417d7b7b8ce4f36a4e36bf92f515566f9563145b4c9a27b6131e1543b5e0aab62fc05efdd13c5c6bf63ced54842d7e7249a8b0c37251cd89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73d700e519fe39859ae1e672151d3a6c

SHA1
36811365d00f58760db7904c084c38d6b40bc4f9

SHA256
6fac7d9c56ad9a34325e3352584f210d0123f3ee274a7ff9e2c6ce358d9bf441

SHA512
875e6e9be777dd7169998c24f0b502a1a35a0c5a8a4ac5b7a84a678a8fb3be25eb18d08ec32920cc803088ec5d3aea02778206843baeb1576dee3fbe150333e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
359de104109ca9bbb48f1ba90fc54a10

SHA1
0d13765d2db491724a1c09cff942398e9e5c5178

SHA256
37b8f16cce3979a278aa01a49f4e38dff912b57259d4602bd1995241e7a4c673

SHA512
737c77951cd8f1f1962815cc6b9ac93a7c79b989c84bf55f7d3cee44e891823b59ba9b840f4883b97d86fe2a11d3bfcaf2686da618a7301da1c2032e1bcd68b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2eac7fc0fffec9d159c980b4318af35d

SHA1
9f3651845ed339aba3dabd512aea8fe5952a9dbc

SHA256
44f2f234f7c8c84c8d1b46e7f4994724387ebca4b5ded8ac2c3d75fedd8222d1

SHA512
75d1fefebbcd9b2aba4422f794c729bdab4ab4c59853a9f80e27b059c9bf119f218348a709064eb3519285fbb38f2ab3b5679694ec80d60ffb799f79a9b5b4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1828d7c8a5518604be9a99fced972a6

SHA1
0909565f05c5604d3828143cbbd6703204ebdfb1

SHA256
64fc6b02d642d75bcccb41e8536e682f6519648ed7c3911ea3c3afe7d4966681

SHA512
37fc66f5a2216aec90426ee4c01ac4b19481c4071a75cf60b67431bb95f7a023951df09206018de1fbe0bce17d2f853f3d154da8e20a6769aa0371fc17e41131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c69b155cedf14aaa9e8491d7aca36464

SHA1
d3907756419c591868799b3cc9a7e5874a5370e2

SHA256
241b225ed3bf8910cb9c4728b0c6c8fa88ae7f737b3231953af2471ff9f056f1

SHA512
31ca0bcbd8603dc6f2853611189f40c5e3ac5b5d60fc94bd91e5f9e3a6622690ee3fdcb67c8ec380110cddd9e8c60fc932d6845c0e3dd30009427f1a7c8c3736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
177ce565ee85bf2e92c9de78a52b4cb8

SHA1
7ed0321a75b3d634f9258657dc1e0f46b7b569be

SHA256
b4cfb221414222826a17b14ca3dca52379e26b59ff6d016580ff711e375abe48

SHA512
5e72c52598df03f1e0a049c805c3eb35d9f048bcf7967ed8d13036063981b974104791c2e90b2900e0cee9ae4d58c37f7b2b817d5af8967f9abd7a07f3a7b0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d26cc804-38de-4c69-bfd8-7ab11a7f021b\index-dir\the-real-index

Filesize
2KB

MD5
d1736ffeeffc7b02ab6c97821fc5361f

SHA1
2530267254bcbacbaa44fba36c835e01d3deec09

SHA256
9126af36dc26a9e0afc8dbbc9e2a3b6ae9f91dd86d0d3f3e9f5b93b910e9798e

SHA512
63e406bf74851938bbdd1d39972aede088b760b336db399eb027c01f84ec75a41ebc996ada662a366d1aac9a70517048d2cf157256b778656953ab58f3ea798d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d26cc804-38de-4c69-bfd8-7ab11a7f021b\index-dir\the-real-index~RFe5847d2.TMP

Filesize
48B

MD5
bec8549b71f8fb2914d7b7d1cf13aa02

SHA1
47251a7588643ef6fd4ffe9ea6d7912c6d1767d0

SHA256
9412fcc9db46f1d2509c59c8bd11a81885fb75f15aac84f1901c298bc6c770d1

SHA512
e81357ee7a5993e5a3fa84a43623ab18985b910d9b252afe26653804a5cca245f6d0bbe84bed5b4540bbebdb5868b837c7415dcc148b381476cf8a60cf2f5c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9d3ee14e3ac129cbf8d56211c296253b

SHA1
32100a70dd4d2e05a9998b11b35031248419a147

SHA256
c470559697e129a0acc3d4ce6bb50b6ab509588d192db9c4e207c3ceaf3126ff

SHA512
02007f567c71cfecc6433a5475ae816c43636f35fe537d093fef5775de37e2319ad1678dfe44ab5835bf0eac588cad8dccfd9550a73f24b93a362cf10c83f191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
56578db08c2865dc8dd93d6825b7b67c

SHA1
84c5cea3f8d5130f25ace0b57adb230962827d98

SHA256
35030f855b8532fe96ce7a1ab6238d90d6c8b0c21b23c73ede24bdfd7e0c24e0

SHA512
d263fb45d8965cccaf1fb2195a410025bd514db6c2fa2900b30e028479c6c6626a95c468344ad969d5eed3da3e559ef35b402b586926c895e69f23ae499e70c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
36476b532ee21a9c0cb1c069cc19593e

SHA1
e0bf473b2fd6f32dbd8fb8d7269d3ff549e8a051

SHA256
3788ca2a3718bdad7a3a2df8158ef38c61f31104fa77fabab20deaa18ef7be43

SHA512
a02546fad2e3a4a0e34f9c4b226b4bf92298586b3a5e7981d3b5297974abecae02f308d82ef9a931bb2e32afb59d7dcb856d0dc4d9d3d187dfa2de5757dd75eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
1594a61fc1573b3390c76f376e9b5964

SHA1
54ea19ad90504e1da84b7f94d0cdf3944c761ee5

SHA256
75d10b144d4b67e0161be4d0810657dd0d5d77f350528df6c3fe2686ca3700ee

SHA512
9201d3e56a7a3ae1088f0a5779332de35c7c7f6ce8f84386ae94ef854228ef8f097c17d58d6f7760875fec99357cc4296b9b092548bb4720cb4fc12d06432f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
95b6dbbda7de66704010863bdbd11588

SHA1
9fadb1126a1b4ff038dfce95fb239da028832079

SHA256
780daaafa8dc64bcfb86c629d1025b61ba2acb39749d94d6a1a509d3af1ca5e0

SHA512
94387e6a6c47fa9ca6c2a26745cc6046c9db477711e0e3f8857ac6a5e1dc61bfe7daa9f2a1507db3690f34ec96744e7745c1206b315bf957073b7579faa844e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9d8d6930c0bb677e3aa17ef1eec21841

SHA1
72bd9f32e7e7dc2f2e7a547da6ded55767ffe3f7

SHA256
d0a336f8cb69336762bc5219d69834b713a6be46e39d8edd192cdc01011092dd

SHA512
b9fa31dcb48d0046ef3fa5f3c792384a2afbe53782b491e233e0396d1fe6969aec20592d5c545203bacdb99e43475aef569f1a95c37e33fcacfeeea8059b783c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58435d.TMP

Filesize
48B

MD5
ee05bdfe19fd37da4c1f76dbe424ce10

SHA1
2acafe5ea05bb505bf894e32ce1093a4ea5ec1f2

SHA256
558d2d3b9dbe7985f0d7b304ee8bee1b7f64a3c54bcddfc6b1be507deb1097a7

SHA512
bb24dc3b3c8cb4daf8f7ff19cc9b61a4d24c93cceea32af0a25b020cb7612d5bc9b11b4e2f54054d3f7bc4f7cb85f1cd9f60d92a7c414c4aac8bffac37a60657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c4bc5287164b4be5a130cfe89fedbfe2

SHA1
3b7381ff008cbf742857f47cdbbe303b1e272582

SHA256
9f0bc9eec1f085a901d392b2a3ff0325a34d6e5dbdc142cb2f227fb90d5ea74a

SHA512
0c36850536f3a992fc947cfb3251d6d77899dee7a5d1c228f3230973fdf13818668c27a6b0902c78ca6a727951f78fc82a13aa1691c33d458a833e1ea5141caf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
502e3348de721cbd369776389ea89da1

SHA1
9a5cdb7bee61f815a8d3c87a5c8106ac7e30be28

SHA256
8160a2ae50dc7b66900c0ee67479c7470b7b6d7f9a2d73e5749d424a65f233c5

SHA512
52b93dedaa6df0a2114437bdb7cb54a1eccefc61013a9722765fb5a4351985270ee9c30ad8f809e13de7c2ed89acc1ebd44f5c9b657e551323dc611d627af78f

Download Submit
memory/3460-251-0x000001F5D08B0000-0x000001F5D08CE000-memory.dmp

Filesize
120KB

Download
memory/3460-250-0x000001F5B7BA0000-0x000001F5B7BB2000-memory.dmp

Filesize
72KB

Download
memory/3460-249-0x000001F5D0930000-0x000001F5D09A6000-memory.dmp

Filesize
472KB

Download
memory/3460-0-0x000001F5B5F50000-0x000001F5B5F68000-memory.dmp

Filesize
96KB

Download
memory/3460-6-0x000001F5B7BE0000-0x000001F5B7BF0000-memory.dmp

Filesize
64KB

Download
memory/3460-5-0x00007FFAA6D00000-0x00007FFAA77C1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-4-0x000001F5D0DE0000-0x000001F5D1308000-memory.dmp

Filesize
5.2MB

Download
memory/3460-3-0x000001F5B7BE0000-0x000001F5B7BF0000-memory.dmp

Filesize
64KB

Download
memory/3460-2-0x00007FFAA6D00000-0x00007FFAA77C1000-memory.dmp

Filesize
10.8MB

Download
memory/3460-1-0x000001F5D05E0000-0x000001F5D07A2000-memory.dmp

Filesize
1.8MB

Download