discordrat | hxxps://github[.]com/Azer14530/Discord-Token-Logger-v1/tree/main/Discord%20Token%20Logger

Analysis

max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Azer14530/Discord-Token-Logger-v1/tree/main/Discord%20Token%20Logger

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwMTcxMTcxNzM5MTAyMDAzMg.GFEkdn._uH4uIuYoULhWwjSm4-qMK5ErSzsRws2cjlsHo
server_id
1201711717391020032

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
3552	Builder.exe
3948	Discord Logger.exe
1648	Discord Logger.exe
3544	Discord Logger.exe
5160	Builder.exe
5232	Builder.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 780338.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 77566.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5064	msedge.exe
5064	msedge.exe
776	identity_helper.exe
776	identity_helper.exe
4928	msedge.exe
4928	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	Builder.exe
Token: SeDebugPrivilege	3948	Discord Logger.exe
Token: SeDebugPrivilege	1648	Discord Logger.exe
Token: SeDebugPrivilege	3544	Discord Logger.exe
Token: SeDebugPrivilege	5160	Builder.exe
Token: SeDebugPrivilege	5232	Builder.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2460	5064	msedge.exe	86
PID 5064 wrote to memory of 2460	5064	msedge.exe	86
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 1432	5064	msedge.exe	87
PID 5064 wrote to memory of 5096	5064	msedge.exe	88
PID 5064 wrote to memory of 5096	5064	msedge.exe	88
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89
PID 5064 wrote to memory of 1552	5064	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Azer14530/Discord-Token-Logger-v1/tree/main/Discord%20Token%20Logger
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb327746f8,0x7ffb32774708,0x7ffb32774718
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Users\Admin\Downloads\Builder.exe
  "C:\Users\Admin\Downloads\Builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,9003427398068036651,5478426006459324952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Users\Admin\Downloads\Discord Logger.exe
  "C:\Users\Admin\Downloads\Discord Logger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Users\Admin\Downloads\Discord Logger.exe
  "C:\Users\Admin\Downloads\Discord Logger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Users\Admin\Downloads\Discord Logger.exe
  "C:\Users\Admin\Downloads\Discord Logger.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Users\Admin\Downloads\Builder.exe
  "C:\Users\Admin\Downloads\Builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Users\Admin\Downloads\Builder.exe
  "C:\Users\Admin\Downloads\Builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9066a194c561ac21fff825d265ef5086

SHA1
8606ea3533681b44094ef29970b000c7f614f339

SHA256
410bc872df8d293caf5325748808909c15c64b9a69fab05f72c48397ec8e35f8

SHA512
de82538e4814d233c6b6a2bdfb3675c64acd516ab52580cf1906b7fc38bf29e225e51135d19adee98334f285b5bc14afdb90a3fd9259874d9cea0e039a2146fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b24c863b84dee8d538a1e7ab6297ab33

SHA1
574b2218034fed52f2d0f14e21edd1506c8050f7

SHA256
ddf9da5bfac4a1046ceb0c15a67aa35cbf7384c77a34bf48eb454a702d8f7cd9

SHA512
194bfb621de49587ebbf8ea9be1feb4003f4da46e29bf4e4ead871b943ace4885e73b007b0c6b000c10e5b8c5f3c04c7c8c50b7e8f1d040ed5b865a3a19881e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f72ba52d232a63b89ee4bcd2a3f38fcb

SHA1
71b615204b7b6e1ccce3bbca4b613351427e24a2

SHA256
602bdcb97f04e916014838b1916bf81780803a751f86f5d2e40ad88f4715735c

SHA512
5f4995f474e438d76ccccd4103dd919860051e57fe68d42b6acaab3124ffd688b0675bb0d4221bfcdea5cac28ea17d27d686b83300a34a0456d2c9f29a936d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bb2c36ed446ff488d7ff333d303bd40

SHA1
268ffbafa0acd2541b08f1525e07f476042b1db1

SHA256
9d82647e2232cf1c354d173bc52da3fddc8d8d20859eb5fdd8e32f6c01991165

SHA512
5d7e3caee23fe9f631719e7f8ac8bc03c3c2510b2a08c3eb85db591f2337e406dbd9dc3fa27aba6983423ad126b48ee2491bae994161bbed1d61f0e7c0ded945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
caeb749999a168a517d9997adccc4c98

SHA1
35bab76fc651d7269ad4157686b4682ecc40bd71

SHA256
c5d738e93a389fc939462cdaf392a4e18425425d3ebcf34bf98429a24f4ea5e5

SHA512
f32b96ee7acc9cbd1889ec9f28c81cc82f5b19b1586890168733ec6d207759e56a761ab3ed064144df8c5e6d64255635ec4e6d46c42e9ee9608c2e34ba1f4d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9c4f3461c5c092d4332f426ecfbebc66

SHA1
6ca32ac99722fe1dd1d2ed44dc3f6ee072811368

SHA256
292e968627f5a293dee2efa7ccef600e001fcda041bc8dd139bdc1b8344e6cb4

SHA512
cc5239efaf7ffb4d261d94dc1e6283e8f1eeccff170ea1accd16a2d87ec8d344c1561a09a5c45383da28b42c788a67186ad7593db304f5d42ecbca6f11460f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c776.TMP

Filesize
874B

MD5
96514472de51f76b30195c02e46f1b0c

SHA1
2bddff092d0a86128b90fd3ff41cf8362ca5a991

SHA256
ca6b22e87ceff6069c926729b38644db53553b51ef3e96af8bbeddeeae8a88e3

SHA512
04c361d1f6fb7bbed5eae6e338860c726135811c0c328adaefda5f32457033d86728073154821e6e9c362d490560edd499be5dfc93b89b45bcb48dba1469474f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37fc5ba26cd35811d1e1cc6c453c4a3c

SHA1
2f6f3ce64e461f015931222505daaa61191b0fad

SHA256
c64d14d89a69a80a7aa164b57e495c7da52e8a92756d83c7162900e491e1ab76

SHA512
47ed4c29fec2b6eb143a4fbed3d34b836fd62c88ec078b3111d55af1965995dc33749279fc6fb162c2e9219cf3e642bf8fa3c304490fedc554a6f6839c025e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab6454088d5c9a94715d2165562b7ca7

SHA1
69d8fe1e99eeb15ef0601681b237cb23594fa64f

SHA256
4976c389247beb900b50e93467f41ad4ca1d19e7ac5b291bda5265ac59975cd9

SHA512
6bb74bbe3096bf1eb9cbfbaf30bc21901444f6ff70ed0f011624d630cf7404f41862858fae6ed814aecce46a9fc02de9294ac79df11f9889714f1332bf2c610f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d92017ad57755175a029780f5fe46bee

SHA1
370da3c6a063c9ea7153ea021257bc047abfeb27

SHA256
f61c419d0c7fbc88083502d31e73e2c56e23043e94084e3f493ff6ee50d249bf

SHA512
712a497f83d94b4b382804b28886b0862985fe6d76ce87d69859b30b3152d11357252e7d97416aafc24eef08e48beb2a64f5652c65571e5088a5f30329830f7b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 780338.crdownload

Filesize
78KB

MD5
15a468c00617cf581ebe066f62d7ad6f

SHA1
860785d409edcc27d83e4c24cc752fd5d828fe28

SHA256
834b1af7c5217536ee4835a55b7da4144f4184090b8ca1a6661c962379e8c798

SHA512
a4e2c71cf45f6111e9c4e1c2a8cb2a8590189783307de1e4d46133ebdf5a97087042ccc133150ac0c9ea075accde396e6f1bab58bcded5fd8ecb08da7d8e250b

Download Submit
memory/3552-191-0x0000017D37F30000-0x0000017D380F2000-memory.dmp

Filesize
1.8MB

Download
memory/3552-197-0x0000017D392B0000-0x0000017D397D8000-memory.dmp

Filesize
5.2MB

Download
memory/3552-190-0x0000017D1D7E0000-0x0000017D1D7F8000-memory.dmp

Filesize
96KB

Download