discordrat | hxxps://github[.]com/Sypheran/celex_Cracked

Analysis

max time kernel
145s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Sypheran/celex_Cracked

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
https://discord.com/api/webhooks/1229584095718412288/xn6VeL6MR-0UYTukoXMT_upWre4RbPjx9X0ogcmJHJWLjjpGS6RkT32yqgvMHXCEG_m
server_id
81229584007356878858

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3276	Krampus.exe
3464	Krampus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
57	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 655501.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe
3640	msedge.exe
3640	msedge.exe
1456	identity_helper.exe
1456	identity_helper.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	Krampus.exe
Token: SeDebugPrivilege	3464	Krampus.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4956	3640	msedge.exe	82
PID 3640 wrote to memory of 4956	3640	msedge.exe	82
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 3052	3640	msedge.exe	83
PID 3640 wrote to memory of 1684	3640	msedge.exe	84
PID 3640 wrote to memory of 1684	3640	msedge.exe	84
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85
PID 3640 wrote to memory of 2796	3640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Sypheran/celex_Cracked
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720
- C:\Users\Admin\Downloads\Krampus.exe
  "C:\Users\Admin\Downloads\Krampus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Users\Admin\Downloads\Krampus.exe
  "C:\Users\Admin\Downloads\Krampus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17289605641917342669,2176229550190006749,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
47a9945a796198b3a969294b3b15e054

SHA1
06ea3f4689ea5b94e782d8a922745bed266e7c52

SHA256
01b836ae8bb1afbefdd21c9be1aadfc3b894aae5d6625d45714b49556605caf1

SHA512
f772e547bb41db70ab0b301f4ee2fe53ec98f56cd8af79681f360b165a8ff9b5e6c75812ae17b371d32f5b9d032a4accac2e287b70dbb8808e43ef1c682228f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c8635783ec0ab085081f9ccc0210dfa3

SHA1
f94c18c3ca5346c61802ee0e7e5774aba2189908

SHA256
25ad2b2b7d981b0a97b3da4b6783d862fa5d0697bdd8d190bfab9ffdce28a6b1

SHA512
ec7468bd396b7175b9d869afe765d0f37ebbab86245934acd67b0f8d828e28523ca1651faccfbe91f0e224ac835886bc997a10894f685095880c65e1302b3c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8ddc791ad0135312954ac06dcf42591

SHA1
1e83ca9a0f151c058818a5259789919c0ebc5aa2

SHA256
f14a2ae9e68c58e806ab6d622f33cd47598ad3dde50e9bbf062d5e34c79aa8a1

SHA512
0c90c2d52f9dd7a717ea5efe5d11e1ce65de308e0d54529808185b5d9e7fb12c70a9b62c7915631566f9bb36ca08078f86dc310a3a5113e0e2f2e3106a170a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e41c020145dcbbe418ad10fa6425951f

SHA1
4dfde95d75fec808ccd8a9e1fb30408088533b8e

SHA256
6103242aca15c1fcb48364b306cefc6ca2f43ff5c444bf4882e496a0fa1058c7

SHA512
930a62a6b4444d0af621b6e1dda92916036eb6f20c91dcff88897091c45708c74b91b9f3872b37e781dab56654905ddfb8a4a538775b7cd0c8d48560100f84ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64c16ab206683d24f1c7330a87be0b34

SHA1
0de1ee8456a79c25c001eb84ce57e99e947ff5b1

SHA256
9377c6cdf4c2308449682185178a9b06318c14f6595f36221953904e88d1975d

SHA512
f3202165afd6a22525f35316254a0572cdb7c489ef93ff854c2f620303e2b68edffc26e08eb81942e09cee0dc86726a911944e389f1703f7a330ba7da7b047cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d135096aa7f62c1ad2658b7770edbb6

SHA1
7f8ade9db42bb2d1163a43d1fe7c13b72a97ba4e

SHA256
332f96a2804330b07d3a5c0155108a598e68bda4a02b7c847ff927789a313dae

SHA512
3aae168e25e66be7212e46c2d5bd93545c8caddb575d8dad5629366a76705bbb6fa403f4e9ed57f5b09a1f1f0f62f65e11b6eef274ce335fd274eb111394ebeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c372fbe282511d747ec76e806b9403c

SHA1
a5c430b3ee698fe9c553c1511d5b012fd745e4be

SHA256
f168306fdb9dd7cb3d922a0f403dc73d21dd50ba2ce6993db95d9012c4907052

SHA512
37c39e0a1a678945ce4cc4a5308a3b6f931780e0a1c092f276114fe5cc6a10fc9bf904c8b4c754c6fae8560ba78d80a4f0968821d2f37ea99b233d658798a582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1694649eacd1f8c52b75d5bff1584c6

SHA1
7a8ecdec42537ba4fcfa9852dff96bb0d3f64fa7

SHA256
cc53cfa64a2e007234eb389b2f1620e93ad0dca58cd783f73e52f41c5506b286

SHA512
1b5dfd66f76ea3ec795a5859401e26d51755d30cb9d193e912ff35ca7d7b572055b36672907e97b96d7e409b9769fb125fec16535b7fe6bd9063c487d9cf5e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579a7b.TMP

Filesize
874B

MD5
b19343fcb346203086fda45929ea07ad

SHA1
53992b0f848dc2f2677745175d8ad9458f75ccac

SHA256
062d90167fae649e0424dff5282e29cb2d5e5a07eaef56a13a8b9ef34aa7c6c7

SHA512
f0a1a623c53f0de4ef542f32233c5b311030d1780b72bef1e38550d26c6e49a2d866975ad0756e12a899b6a0fee7e6805c4a9bf09f0b0c1e3e614d8b32fe6278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b9792cb00d5dd39f5805ab3c4d5ca1f

SHA1
4c5be2da254545e67d5d48d78a5cdac990df66a2

SHA256
8af9c8bc6cb1fd5e6d74f7375eceeef439ea0dabcd9ad2539d31ca62c2551eb0

SHA512
f65aecea9dffbdcfeaeb25d8f949e744bbf4ad282e11c10aaed9118d23a5513b50f006cc26d2e7695c5d20a34f97cb0eb60f8b3cb49bb4d40e03b876136ce7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d22e11c18f50acf156e53e2441a8757

SHA1
0e6f04ab6b503fa966b164634305889a1b7a3ac7

SHA256
b89fb726c30b8152237e0a1e040d29144b2b30d1b65dbf8c9304ec473454de86

SHA512
d2715b51a59ca94acbc73c8e78589c0b4e7ba29926810e866543bb409c4c74ae5f5cdbd36c7303119826ab82fa6db7694c94d7ee9fba82edf7a65e5f47fdf545

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 655501.crdownload

Filesize
78KB

MD5
81610f239cfaa955bb5ff844e9bf8294

SHA1
cbc24b2a39b1e6bf1371fea5c007106d6981a8c6

SHA256
648765b8bde07d6361a3fe2b3e4c5a9ef7502a3e0d00a4506fb374cbc7345aa3

SHA512
b26d33a42a9af0b2afc5cd3743e4da456fc774fae4a3984321e27ef5f67518734bf86e3d1fe29ce6aa1397d6399e1b08d286bcab16d01f9c42fe3df132cdd409

Download Submit
memory/3276-265-0x0000028EFF7E0000-0x0000028EFF9A2000-memory.dmp

Filesize
1.8MB

Download
memory/3276-266-0x0000028E98000000-0x0000028E98528000-memory.dmp

Filesize
5.2MB

Download
memory/3276-264-0x0000028EFD110000-0x0000028EFD128000-memory.dmp

Filesize
96KB

Download