discordrat | hxxps://github[.]com/Efvui/Roblox-Byfron-bypass-2[.]0

Analysis

max time kernel
75s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Efvui/Roblox-Byfron-bypass-2.0

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5NjQ0NDIxNjYwNDIyOTc1Mg.GAQiOw.xo8e08bBfFkDUxlLLRugsvRASgE9-4CT3fKNyU
server_id
1196444579126321222

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4420	Client-built.exe
4568	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
73	raw.githubusercontent.com
74	raw.githubusercontent.com
80	discord.com
81	discord.com
88	discord.com
93	discord.com
95	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 217994.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
2252	msedge.exe
2252	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	Client-built.exe
Token: SeDebugPrivilege	4568	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3240	2252	msedge.exe	82
PID 2252 wrote to memory of 3240	2252	msedge.exe	82
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 3064	2252	msedge.exe	83
PID 2252 wrote to memory of 1824	2252	msedge.exe	84
PID 2252 wrote to memory of 1824	2252	msedge.exe	84
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85
PID 2252 wrote to memory of 1500	2252	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Efvui/Roblox-Byfron-bypass-2.0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8958546f8,0x7ff895854708,0x7ff895854718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,8252527252819456476,16620747749218958518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4400

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
99ed8f655f98d00035039604c5ccbbe0

SHA1
39211bbf413a2e0015a038a6bd8b0cda3171da7b

SHA256
a989f0e889b6a0ac35094ca1d28fcc613862de8edc78c8a6aedc1854b916d213

SHA512
b8019a7ccc0aed2cf6e9089e3eb48abc193244d8858472cf878bf4a2f83e9e3437ec58dac5fda2cc7dd68359fa41a738569e5405f7a071a3ed368d9572995b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
9c72f46dedd632b33d88ce93d6f81cb2

SHA1
1afde1d17f6bea0f47dc2d3e284f50a20d95abb3

SHA256
2fedf9a697d2c21a6ab691ef5c50059d7172947632224b3bc0479abff91fb7a8

SHA512
c00e3ab7b8726c9661799ca20ab8a78220e6318969f9dfabc955656b5dd1fb02aef5edec10c01ddfecfb5f5358e81adbe31c532e7a6b282e3343f68509d9b64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
516c9e5aca507e03059f9bd263c98b0e

SHA1
9026330d3ad1ef8c19fe2dec187e8820a41146f6

SHA256
b6c8e22eefe68672d5d28d1c47762ceaecafa298b7b506a1b567a29c6f858af3

SHA512
2ea5c004bdf8277dc03606c5d61f627daa6feda7fe007c4a59208c3bee1fc6f72b8d58b85baa67dc583c428901c947d5f8446fe0b4393d697bd4985332f75942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
809439b90af19f178531604916b83695

SHA1
c1d415737c43d7eed97459213b138f531a2ddf12

SHA256
68ca3c94581bbdb3d43dcd56e68d1787f58c5e33100b15845a46c7e98e87a748

SHA512
e10829b1a48fa885c6a61324b8650d16de745db7abcb3082c9fba3ecb55d47f658186ff305076c18e6f26e7f1f143e7dffc1ee1027b89e23a4db314893c6d2e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d86f39f25959d1593e68bac7a734144

SHA1
ae0d0f7379bbf076f18db7b7201df4b6fd91b27e

SHA256
1a5c6dfd5bb47a5f143ed427011d960299a4a8f015b42bc1759cb91e57f227bd

SHA512
ceb12d8bfd0fd7ea61a7ad8a4643d654d147bdc0775caa70abe34b0bca95b0a0a2645d290027fffa1eb20c5cf15e57bd1c76b40060d0e7e9aac5690119459471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d41c84f38e261efe4cb5d106f6a276a3

SHA1
c990e5bf8110a860538e08eac3f06703ef63b587

SHA256
35325686c15462e14ebac34ccb323fc2063eb59e638a915d5de95b0f76f16767

SHA512
1c7c128c1f5b80e454b7715cd59bb9f768b103f268a77c8efedb5ebeb24a9fdd3ba0286b91d35144e3fcdcff18bcd9d6fcc4982b926e31174e9a8ef58c27e2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc4dcce4bb9bad9575a625b83e1c477b

SHA1
0ae7c5ccd688a6a97b5bc6781e18a3af50b734b4

SHA256
f6cf56c181be9347681efe471d79e2bb1845af59101bf36445155c8c6b34ae6a

SHA512
d7b0a9704023fdfc405695bc12204c0b5d8fe4627f9fb7f2e28900b389958a68aed7f11cc36418ff8b2212facdc726d678c4a4c1c9b6de6779e03a772761c2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
70ade6e4dc2feb5602b86f1442528e7e

SHA1
432719e02ec8e5bab369f44ac7f3cd96c6487f44

SHA256
4ce333044a05b801c9c60833ee744b8b8f732a9522b9b603ed3ab7cffe8ae046

SHA512
9a935414107cea78fdbca01101aa066ed59bdb92e5bbcc6f82ebf96ec02a072b17913ef5e414f645cfc4bc906399fac7cec7d224f73cff714047717e15e6694a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
bf3dc94f6220f35c082be328fb17cf34

SHA1
c522a5f5936a6361795f894d2e4fad97b742b57a

SHA256
d51002692a84be1d472dcb78d77183892f9ea6d17eb24c4b1e7a6c351608c6a4

SHA512
fab4e39a9444a63b4540eae2584aac5a9f3602858b1c36c2dae282c58ae36f549e5a571039fbb176419c0e08dd2cd0054ea6bc8b7ee972f9eb2b04bccf7f08b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a016574176ac05940056c096180357e

SHA1
3ba953dde9a1e0a69f1301528b21e49501588491

SHA256
11740863b80ad31e42dc6ad559309006d9a98bb92696dc3ed8ad7d55b83d874a

SHA512
55ef043636835fd470e638d310edc1276216dcda17ff603a53f7f627a54633b13008c450bddcf8522fbe8a5910a845b911ab4c5806dfeb026c9d22c5d1e6d03d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a3c2.TMP

Filesize
371B

MD5
2b3fd445f8e1ddc72589db911a3aadda

SHA1
ce93a18249d8c89866d7a8b46c75b0dd9204a1bd

SHA256
c0b0566ae707d78086e63525c5a271e3be52b74898049844407c1c93ea932034

SHA512
82ba83a1960979c93f238d297ce4b953d3575587c2865a016efd43c4bd24254b3c1af5a712a598a696d7bdf23909b3647bc7d79a6f61bec499e6e79d558082b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1a973cac85488bb4d66de6d00a6ce70e

SHA1
4413fdc7bf739eaea7485cbddd33fddc6ad06f60

SHA256
16b67cac7af3b6d7a51fb9f60d1bde3a1649d9662f784e2e5f41864c2a5fbb36

SHA512
c2f1d92ef21d0852d9fa7c2cfcc2ee5f57d448c2cfa534dc472e922cced09a3cba5ea3b47d7a26a68b5cedd8ce6c857b3f6de096c1efb8018fef860f694c4f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82f9692dfc4cb5ceae69ee1a997ec13c

SHA1
c9f4d236e50586c3a4238b7f15cc99cd1e1bdc5f

SHA256
c10e56175237f14af5e86ef295b67f0d93cf1beefb4374ac6b4736797ae6c783

SHA512
17399b7ac2d9dd5b959e3d5603675bd878c7ae42167583ba73cf75cccd9f82fb093b2c8e02bb757fa39e295587c7bb686abb06b4baacef124834a39974f17947

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 217994.crdownload

Filesize
78KB

MD5
159b1d2dd9f341f8f25505804299d912

SHA1
e1bb11f0ee64a7c65aa713bfb9951f698a94e065

SHA256
db3dd4436db0daa834a29b31782f0d1dc872130e503ae407a1ce7c0863d149ae

SHA512
0fe8c241dd12826977303fe53f8badd9b5ecdc22c82d53a24323a660b1ea04e5741874c9043733b66fe88c9569d221fb70893cb692694ac1f9b0a49bfd4a36f3

Download Submit
memory/4420-263-0x00000249ACAF0000-0x00000249AD018000-memory.dmp

Filesize
5.2MB

Download
memory/4420-256-0x00000249AC2B0000-0x00000249AC472000-memory.dmp

Filesize
1.8MB

Download
memory/4420-255-0x0000024991C60000-0x0000024991C78000-memory.dmp

Filesize
96KB

Download