discordrat | hxxps://github[.]com/Frenzy-zwaake/DiscordRAT-2[.]0

Analysis

max time kernel
50s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Frenzy-zwaake/DiscordRAT-2.0

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
server_id
1153564868197236846

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5176	Client-built.exe
5292	Client-built.exe
5848	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
39	raw.githubusercontent.com
65	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 974132.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
1100	msedge.exe
1100	msedge.exe
4372	identity_helper.exe
4372	identity_helper.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5176	Client-built.exe
Token: SeDebugPrivilege	5292	Client-built.exe
Token: SeDebugPrivilege	5848	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1656	1100	msedge.exe	82
PID 1100 wrote to memory of 1656	1100	msedge.exe	82
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3932	1100	msedge.exe	83
PID 1100 wrote to memory of 3820	1100	msedge.exe	84
PID 1100 wrote to memory of 3820	1100	msedge.exe	84
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85
PID 1100 wrote to memory of 3628	1100	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Frenzy-zwaake/DiscordRAT-2.0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb97446f8,0x7ffcb9744708,0x7ffcb9744718
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,8781512079206677464,1378522211752938562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5176
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0aca68c38a11ba42d021b0b56c4b3dbc

SHA1
70c076f8ebcaf62238851827f5e512d1d081ca5d

SHA256
dfd0bc8ea1e5e7397a5976c3e583ce8cabc396bf2231e818347581df0361888b

SHA512
c6ab316304916adfb38207903c0111e07043b364239abeb9038d89641e7128a2175e4034a429d736c5f48a030b9dda72645e93272200506b848b8823bd9ffb30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8793d270ecf1f798eabe65f2ec4e55f

SHA1
5159c2cccf76ede90698fd78c9e060288c77e587

SHA256
938f886bea8780b509e450d2b7e8a16cde8f098b4b3ce97f12f9b6235304d909

SHA512
77ad826ae288496335442e100111660b4138bdcaeacdbfca27e4f2aad17d37fab43370c6ce00ddb667433075380d0f2065a38eb91ff10632dc8b9bcbd6465ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbc7a5c1592142f862a1c492d92b9374

SHA1
2a6bbf385f15e3460ff4ac12f54c09930994c0b2

SHA256
291486e67348978907c25cbd4c97763a8c1c53d4b393e2eb6e78c690242ab042

SHA512
712901ba097c1d883a30ec2bc9bcdeaa6e61dd6a0899ee94ce2203944e9739e94e92cdb86954cb848b946c690fd6db9567d6e8abb8a17bb2b305a4742e9afd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc9457e2d8606baa61a482e8a44e2473

SHA1
3958fd25d23aafcf87b1fd396ff28af4d1f4835d

SHA256
b57ca7baf4dcff23f388a9de7ceef55d32820db0305fea14204457f404932380

SHA512
eef7103ed88df8e65b0e1abd6cb99d2d134ff50bbf8d3c1525442f8a5dc7e7dfc65390cfaec07f808c1b207f11fd0bf0ee2559806daa709df880f6f6a5e854f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cbef0e5f69a85ed236d53a1fa669d100

SHA1
b0dfce639d5b93cf5bbc03f632d5db6872e230ce

SHA256
f2b5a5e72f46da1b332f2ddd5a89ef68afb6c1c7c9b6e8a2072ac9e23031a961

SHA512
e7fc5db1ef56307bf7e3ad4b3cd1c68b8d21b8bd6c91d4bcbc8528a8f55c508cc5c40d5ae26a8efd5bffe268c12d2d439021426104ba6e17bf971ff34ce2ab4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c6d922d76372157e952641d2678ace7

SHA1
7fbb002fe673d110b7160b9fe13595e6167be1d0

SHA256
abd51cfb0463613d571714ed708aa937795e622f5b3139ce4378f2b0009d1125

SHA512
9eee7dc1973ae7577d7a3a5fdd3e5a7824406283bfbe7d1b6ddb089664ac4f7839ddc8941c0974e67eb1902a51c50ec31d19c490188e06bc73676f16ab397cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578647.TMP

Filesize
1KB

MD5
3dd0fb2dd151f070ffba799d989a81c3

SHA1
2e727752c8fc9acb3caa0f997732bbc9eccf3c54

SHA256
6399440471c5f073f5582624754e081251e8eecde57a5843789935dcbaab83de

SHA512
fecdfbc1458e5ca8110078730fd0df54d01fee4984c8f9d82d15425d4ed76c7a8cba33f4356fd6eba0abdaf43d7c8c59cb0cf3eb6b35ee398b08d888b20ff64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbdc7abf340317d64023ada3841b23d0

SHA1
0d78e25d4e348db6b8236bfdb9f881bf3c3aee7a

SHA256
7e3aff1c8cdaa727473edf5c0257e99717d6bd8bd73a58e5559bb5b9ec33f9e9

SHA512
7049314a9a6c04179b54510a53c99562b427eff4a38e68a0a794b8273fd5d150d67d623083093b6002c7328677121c70f12583dcc7621fbfabc30cf0a93e8f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b57d44018913dfb78b3eaed0354edc9

SHA1
035987d5cf90ac714497e637f65f1e3f88b5c46a

SHA256
84654cfbb1433915a63ec6d989cf8e9fccc80b4895182bca1610d31c88471795

SHA512
b8546929c45da34fb35453e9eb07136d5d13a8ffacca8586379a07bb8be29e5f800be6cc5615423bc642aed385fa731a2b71d485d68e8dad656c93a3f16b859f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 974132.crdownload

Filesize
78KB

MD5
6c7dfceb22fe0ef78835f29e53ae6b3e

SHA1
c8b290b0ec67a3cadfa6766cf1e630414c1c61c1

SHA256
a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f

SHA512
a506c076fe1b06c873aee2ebad22e953c3e0cf766736fa05f66f60031f7f7184c4d81e033f7787dfd1e007ec1feed88717a900fb76acb9fd42b8294807ef2964

Download Submit
memory/5176-263-0x000002631FAA0000-0x000002631FAB8000-memory.dmp

Filesize
96KB

Download
memory/5176-264-0x000002633A100000-0x000002633A2C2000-memory.dmp

Filesize
1.8MB

Download
memory/5176-266-0x000002633A9F0000-0x000002633AF18000-memory.dmp

Filesize
5.2MB

Download