discordrat | hxxps://github[.]com/Wyskooo/Token-Grabber-Webhook-Discord

Analysis

max time kernel
71s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Wyskooo/Token-Grabber-Webhook-Discord

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4972	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
81	discord.com
85	discord.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
80	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 878046.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
1508	msedge.exe
1508	msedge.exe
3292	identity_helper.exe
3292	identity_helper.exe
1592	msedge.exe
1592	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	Discord rat.exe
Token: SeDebugPrivilege	4972	setup.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4468	1508	msedge.exe	82
PID 1508 wrote to memory of 4468	1508	msedge.exe	82
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 3384	1508	msedge.exe	83
PID 1508 wrote to memory of 2024	1508	msedge.exe	84
PID 1508 wrote to memory of 2024	1508	msedge.exe	84
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85
PID 1508 wrote to memory of 3668	1508	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Wyskooo/Token-Grabber-Webhook-Discord
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc4c46f8,0x7ff9cc4c4708,0x7ff9cc4c4718
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,17551481726304867494,14053907621015411833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Users\Admin\Downloads\setup.exe
  "C:\Users\Admin\Downloads\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Users\Admin\Downloads\Ven1-Grabber-main\Ven1-Grabber-main\release\builder.exe
"C:\Users\Admin\Downloads\Ven1-Grabber-main\Ven1-Grabber-main\release\builder.exe"
1⤵
PID:4736

C:\Users\Admin\Downloads\Ven1-Grabber-main\Ven1-Grabber-main\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\Ven1-Grabber-main\Ven1-Grabber-main\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
edbd46c9a64c70cf745e23b529db6cb7

SHA1
f68d3321a3f64c56fc199170addb6d42d03157dc

SHA256
fcdf2980918d1836b80010d5e7278961f0ded85c31f84ff394034201b455c8fb

SHA512
9238da668c247007c20a945c56b21be0432f73a5b6e7ce65551a0d8d8eb61b24feb66c739a046051bffefeade2e16baa05b0333d7151bf98e253bf16a7c687e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
656B

MD5
ac27a11f3095537a1e078e9fac232c9c

SHA1
7a9074ea261898bcce24fac68b7daae4bcf6d119

SHA256
417a6fe8bc11e853ff08b8aaedcaa1d9a47e87c1857621451f00a5e686260f63

SHA512
6abe4de0fc487f72b245293517257aa56a7cf15d7920c9a37b309abbd0aa7aceaf8aa104176f3ff713eb7b7ce919ad051548f00f36468e20436519670e221825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf836f9e2782f825715879687ab26110

SHA1
1cd25951538d5082c0f72d385bd4615e36b9b5b1

SHA256
167a0e1c18b264493f45bd083cf105e7fb6a06d90922553b1099434ad79b21c4

SHA512
6b186a82aab4942d9a0bdcbbd5a5a8d920aa78ec361ab1a99cd7c1e24c9df36758a2cb59053054ca39d944dec8ffd91258c9d3688f8b772375c150d587788503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ac79516194cbebad401871c4adfc938

SHA1
3acfef649cad245f377c73fb0429712225d4afd9

SHA256
c83de48caa0304da5c3a36300ab53fec411f34c92c5cc514cffbd467d3d095ff

SHA512
e9ef1fda80c8d0b199d8fc60f49433c894862f3fa6e641f1ed01f02efb91fd48eb85f837cb04f6c4f62933339e4f129f802ab06ced31ee9ad086d12d3e4105ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44e2d4b47bbf80671fc99a986628f4ec

SHA1
ab8feb6a684ae98878f4feb385074cd50b0d2ecd

SHA256
c248a2e6a5305c0cf6e0f7ee5141dee3e6feb0f83821d2ba99e525cc33781394

SHA512
9a9c045b81a4cd391cd8cad6695bc23f92a7479213b7254807d9766cd629946065494b3cafe2c203350352eccecb353ca41e3b67cde0a08ed62104f4479adff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06f5f9297b00b19dd2d77b0739bfcbf9

SHA1
50dc625a4bf61f99bc4cb06e2c56f6d483948149

SHA256
62135c86bbf688e7bba4f393d563967f29f16a35e5cc692c4e95ff038e247219

SHA512
01bb0abd7e3c0f459516014825671b68d2f6a3618b87a73f7a50515eeb7475ffe1d961a2d3b3c6be122d2f1d34d2cf870b6736d882ea2b81632afd482d3e89c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa7fd81c1f85f747a306c94df4bef803

SHA1
37c71a78c7e6fd6c2f994dbb9fa9354b3eb52d36

SHA256
b8de6e9d64e22999c6f747032eb17c310b901bb8a796a6ad20566fbff5759129

SHA512
0628a9a81e356cd92c12566eb8d8a5603b776a16d7c970cb055de4d739f125f6b0adfacbaca908e39d81f1a98321adc7061303f4c7137eec424d6baf0f7a7912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d32c6e0b88b6426ac4db7e4a8180c45a

SHA1
032d267122f28277b28ef628fb2775644cceda4e

SHA256
c989fb187d08ef621a62b69e644318b7f4553ade21cbaec51d1976c6a2b63dd7

SHA512
56d08442c3e757279f6f808a9a7f0e66e446820110cc3f09ae02256c0cdf350906d09697b929f4cabd7c1f3d6056d9d72bbc525f6b8b8389f126a953e415cbd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579933.TMP

Filesize
1KB

MD5
1738e604dbdf7174cb364f02b6487752

SHA1
70482d9a232c788854b3d59e6f9fcaa7aaa56a9d

SHA256
3101f6229512e9f3c0fcd023d8a1ef15072f4e42c12395358dfc2cbf34def7f1

SHA512
8d08e718b56ed7500d65e9409c4428c00fc31fda18a7de6b8de67beaf0e2ab10bd7d3ad89a65a759230746b301d4954b40932e6a5414142d30a7586040b8936d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f46d93f943a5917b53cdc9e4a9d72ab

SHA1
b7fcabafeec92c2cc520325198636352c8abbfe7

SHA256
1bd891622bd100293bfbd0e82d4d4a0eaa6599a2409c0f27828c3d997f695c07

SHA512
1cae9199000c667c06a55f146fba5e35337cb82fa26906f9d59392de38de96bc2b74ebb6ce42bb0ec5964f88676de8f9b49f0aac73a967ca6502d93e1bed1334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2cad05575dfa079c455a82e5ba69f20

SHA1
744bd533ad82dfd6f1c135ce169df88f16b35ea3

SHA256
a5de4c52b24e4e1d551e576f836fa5702823db9ac20c260d01f25ddd580fab90

SHA512
9bc93f613c82510152427bed7d9500564826a89b7222fac9ade855feee54e13591ab6b953b151de1b5d8f3c1072d6dfbbb97fa2454030cb594b9fa35a7542ff2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 878046.crdownload

Filesize
78KB

MD5
9b5e862c8e697c2d5d60f248647eecca

SHA1
a4c505154a42a49fd2728a2975da495d86bdfbc0

SHA256
f5db7bf99fd192a159bba933944ec95493d0e897f9cd5a4915f63d2cab904567

SHA512
9d22c1bed2a8a4b7378d7bdbb9b283ec1749b593231fc240c107f7de18a3f4d9881a6cdc74fb5d70ea922e46247f71b89f3a925086caa9a379f6bb54d58bd510

Download Submit
C:\Users\Admin\Downloads\Ven1-Grabber-main.zip

Filesize
448KB

MD5
dcbaa236eb5c83addc0ac84e9976964e

SHA1
908bafeeebae60c8a71d23c38c46dce0ed156c0e

SHA256
f2a537ce9f942fdd0020bd72568b4252f735dce75a9d9e0fc77af51ca0a69d01

SHA512
2a8879173177de0fb383fb528f61fed6b4635d9817244adab455d806c1330da180af7660580af029746cd76daf23db6089790c90f94e772003c1f7b462d03a5d

Download Submit
memory/3228-445-0x00000254FF400000-0x00000254FF418000-memory.dmp

Filesize
96KB

Download
memory/3228-446-0x00000254FFA20000-0x00000254FFBE2000-memory.dmp

Filesize
1.8MB

Download
memory/3228-447-0x000002549A870000-0x000002549AD98000-memory.dmp

Filesize
5.2MB

Download
memory/4736-440-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/4736-441-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/4736-442-0x0000000005990000-0x0000000005A22000-memory.dmp

Filesize
584KB

Download
memory/4736-443-0x0000000005940000-0x000000000594A000-memory.dmp

Filesize
40KB

Download
memory/4972-465-0x0000024DF88B0000-0x0000024DF88C8000-memory.dmp

Filesize
96KB

Download