discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/download/2[.]0/release[.]zip

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4284	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4956	msedge.exe
4956	msedge.exe
5092	identity_helper.exe
5092	identity_helper.exe
4128	msedge.exe
4128	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5948	OpenWith.exe
4284	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	Discord rat.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4524	builder.exe
4284	vlc.exe
4284	vlc.exe
4284	vlc.exe
4284	vlc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4284	vlc.exe
4284	vlc.exe
4284	vlc.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
4284	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4540	4956	msedge.exe	88
PID 4956 wrote to memory of 4540	4956	msedge.exe	88
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 908	4956	msedge.exe	89
PID 4956 wrote to memory of 4828	4956	msedge.exe	90
PID 4956 wrote to memory of 4828	4956	msedge.exe	90
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91
PID 4956 wrote to memory of 2108	4956	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c8a446f8,0x7ff9c8a44708,0x7ff9c8a44718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6839496599622150172,17849068410565521299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4524

C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5948
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Temp2_release.zip\dnlib.dll"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4267b32553239769bdc63b90527a46f6

SHA1
bffc31207f3e4ab793b549f8c452357421d45225

SHA256
0ba820c409b682e82b7627101938e2dd109062239205a38e8f63fe2c0ebd9101

SHA512
7309581c63155d5b3fc17c207e8c02649d430d75f32f0f75dce4e4e15322ba1507bbcbf2cd5aba0a2fd17fd75f80277ba58da85c0e97d4d9b11398341be9ea26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
733082cc9faea732290e3cab53260469

SHA1
df8f4565c7f84b91474dcb40fd61cdcb17a7de82

SHA256
540400e472fab8b3111b557bbc786567d80e1d66ae27093be214b10c7172566e

SHA512
72e33cfd3ea8c6fc86dec3ce052d1dcbee553fa1244858d0e95ed9a73c98b08bb020d10b9b67deaf01f404c119a00ba967aeb150245542a08f8b7baaff1840c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38e119f65d8b1d5e344541d969d0d925

SHA1
f4253986a00c520e6ac511446355644be275b158

SHA256
4e922f6946ef904909f6678c04f8a8a8a69ef887a921a6d4d34fcf078c0bb5d7

SHA512
2ad9a0e68cebc23b61f7b20d6e383ea40a731930dd27bd379c5c8e6dab18b8628198ef4a5378abf5400ee93c8c17ce66b5af0b289bf3440747914b473fe87b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
638ccefb81541ef87feea02007c41e4e

SHA1
ef7fada35097cfa2cfc3390c05479b9ca3db8c57

SHA256
826c98da8c5f09ea2c05f60448c19b7516abef5013a95f43b94ae2455be179d6

SHA512
e03aa2246fc5e1191c6faf6e3e5d69a20f144967339832ebdf98cefbb1e4fa8109bf2d3974142bba0433e545ba798aec21c8aee9d2e24b8c9b243e35325925b0

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/2616-90-0x00007FF9B34C0000-0x00007FF9B3F81000-memory.dmp

Filesize
10.8MB

Download
memory/2616-111-0x0000021269FC0000-0x0000021269FD0000-memory.dmp

Filesize
64KB

Download
memory/2616-110-0x00007FF9B34C0000-0x00007FF9B3F81000-memory.dmp

Filesize
10.8MB

Download
memory/2616-92-0x000002126A500000-0x000002126AA28000-memory.dmp

Filesize
5.2MB

Download
memory/2616-91-0x0000021269FC0000-0x0000021269FD0000-memory.dmp

Filesize
64KB

Download
memory/2616-88-0x000002124F540000-0x000002124F558000-memory.dmp

Filesize
96KB

Download
memory/2616-89-0x0000021269C10000-0x0000021269DD2000-memory.dmp

Filesize
1.8MB

Download
memory/4284-147-0x00007FF7B4B20000-0x00007FF7B4C18000-memory.dmp

Filesize
992KB

Download
memory/4284-148-0x00007FF9C8C80000-0x00007FF9C8CB4000-memory.dmp

Filesize
208KB

Download
memory/4284-150-0x00007FF9A9340000-0x00007FF9AA3F0000-memory.dmp

Filesize
16.7MB

Download
memory/4284-151-0x00007FF9B0540000-0x00007FF9B064E000-memory.dmp

Filesize
1.1MB

Download
memory/4284-149-0x00007FF9ADBC0000-0x00007FF9ADE76000-memory.dmp

Filesize
2.7MB

Download
memory/4524-103-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4524-84-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/4524-83-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4524-82-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/4524-85-0x0000000004F00000-0x0000000004F92000-memory.dmp

Filesize
584KB

Download
memory/4524-87-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/4524-102-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4524-86-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4524-152-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4524-155-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download