discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1255165018316476447/1255558363354501170/3CXLoader_[.]exe?ex=667d9158&is=667c3fd8&hm=950231c069ba69496d01d28eb6622c69dee3fc05e6d4b730213ed456c6c07cd1&

Analysis

max time kernel
90s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 16:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1255165018316476447/1255558363354501170/3CXLoader_.exe?ex=667d9158&is=667c3fd8&hm=950231c069ba69496d01d28eb6622c69dee3fc05e6d4b730213ed456c6c07cd1&

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NTM0ODAzMTI3NzEwOTMyOA.GFA2V2.Xn7ioNW4QOiq2qIR5-q8URTs5_7FhbdVLeLF14
server_id
1255347532347736107

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
340	3CXLoader.exe
2028	3CXLoader.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
21	discord.com
23	discord.com
39	discord.com
19	discord.com
45	discord.com
46	raw.githubusercontent.com
49	discord.com
2	discord.com
2	raw.githubusercontent.com
22	discord.com
24	discord.com
40	discord.com
44	discord.com
42	raw.githubusercontent.com
47	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 559249.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\3CXLoader.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
1356	msedge.exe
1356	msedge.exe
844	msedge.exe
844	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
4476	msedge.exe
4476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	3CXLoader.exe
Token: 33	1128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1128	AUDIODG.EXE
Token: SeShutdownPrivilege	2028	3CXLoader.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3488	1356	msedge.exe	80
PID 1356 wrote to memory of 3488	1356	msedge.exe	80
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 5012	1356	msedge.exe	81
PID 1356 wrote to memory of 2536	1356	msedge.exe	82
PID 1356 wrote to memory of 2536	1356	msedge.exe	82
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83
PID 1356 wrote to memory of 2040	1356	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1255165018316476447/1255558363354501170/3CXLoader_.exe?ex=667d9158&is=667c3fd8&hm=950231c069ba69496d01d28eb6622c69dee3fc05e6d4b730213ed456c6c07cd1&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb09dc3cb8,0x7ffb09dc3cc8,0x7ffb09dc3cd8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,11683291205332540464,15996491098951840987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1868

C:\Users\Admin\Downloads\3CXLoader.exe
"C:\Users\Admin\Downloads\3CXLoader.exe"
1⤵
- Executes dropped EXE
PID:340
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dfecbb576ee9795c5284da8a2a3c7f5

SHA1
f1f0a6a97850aca2b4ab267a017564af02f24948

SHA256
dca6901942fa748fc01339192c0738a06847d8497c9c61298f1e5df1f8352fb0

SHA512
d664cc261113427810dd0b2d32763ddd08611a528fe6b285782d6b8ac03304b72a90fe7f3f7142e825ab8d948d5c9cf52f420546f3796b2ac23f3d00f3c17389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6486ee9e961a437dadb68ff1544d18a8

SHA1
05f4daccca0bc1ce73fe71ad2325ba5dadd3df25

SHA256
9a98b4686c9e90672a548c873943b3027fb111f7992263111d912318429f5834

SHA512
ee3659f68a46f37f340f98b85a7aa289e700c5ced2a4f0104673bb5f18cc82d1e9b838ec0278407213c6ed2073998e7aad78a7a39390b7e460c8e26dfa91d0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d838a621c82122eea01339e9044ed1d1

SHA1
abdb810c5a9d738a3c1a28cfe68760107bf1cbce

SHA256
950e37c8bd4f3491d0ed9cd506ea3191e37df0a79d08dd24ebfd68bab4f00b84

SHA512
4cef03ebceffb76cfbbe3037e7571407da14587dc61f7f8ed7b2dcbc4158f91acba030d39579ee578df1d21f4b46e0716beb07c8a642426a1d58d42943695d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3bfa6f8aa16feea360c75e32c066f051

SHA1
d1dbe4f8f6c196a5540d4c0c2b10c3a2684c18c0

SHA256
7533815c1947b4992562b8b7fd41f5008bff2d1fdcc98385323d605e6cec6107

SHA512
da29980863386dd9463f61b5637c7e19f91bc6d99eb34f5b6fb353b06d7fabf1fa7bd41a78696d28cb660af677d092e84046cea7950e2e49152f92efa25bbfc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fc3eb7f57338482c5a75a2cf0bd6e07

SHA1
63f15c7c48e073846b161bf89f5383d6f7641cf4

SHA256
9766731baff17534d12efe8e57e19aedd01b404bec0fdfc810f5e6f53c026780

SHA512
9999aa7e501966ffa3aae5e45d841788d1740823cc0591fdd4d653bfe20cfbc81014333ba68d9ec0279185a51241fdb875f7e976d75157c57818b1c4069f874c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b69b6f70853a80d94af0a2a58216462

SHA1
a53574165c7bd2dcfede833eee0440c812eea976

SHA256
4e74b8cafcaf1d96b4b2892d3adb3de73a39d203c017accd5bcc95c32b255fb3

SHA512
243962be2b906329c3a9ad085d1bcc510c1e5fe57a84cc3d4eef185a2cecc555f943e40506c2cfffe37a7c2d103a4cd00ab51f8291eebbb8dae0fc34a21b5ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2694f45229abc0d00fcd66cd901d5cef

SHA1
a15163940ccb03756d9971a6454e69d852826c50

SHA256
a7bccd963fb14f761c3f7ca2cc1931172af8f9e149d838d57deee06292af4a44

SHA512
b9db51fb03d23ce367a073023d43a9ea025190cd2a61fe6a406825e2dbd0b6c88dcc3af5384b8b227f00334840c67f6f3d43d4a87dac3e5963b91c2695cb11a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe

Filesize
78KB

MD5
59c231f52b80f128a8f5ef1216980c82

SHA1
710bfdbca2cc26a856619808121e23160fae874f

SHA256
e8452a2ffae08315c802c2ac4de41ea328de6fed942890e0682d261e89391502

SHA512
93024af146d4586ada9410ba59f49811454fad40bf61349e99c5b4920449d5fcea3c70ba6a7df53b80464d61efcca708c22847f27f02be4ede4b97ce1678c5f1

Download Submit
C:\Users\Admin\Downloads\3CXLoader.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 559249.crdownload

Filesize
481KB

MD5
ca937feb56a6a559bb76486481090a29

SHA1
ede94604285d5a3ea756ea50db5fe6b6b05d7187

SHA256
0c4b30258b007efee05b7f39fe6af886a8d1b1c987eb19db54c16bd7082abfdb

SHA512
61eb2830116a4f69f7a895a3754fedc74f089f3ba3bfd05dbd9aa922693c09a45ceca751f9eebbee296fe26cbb2dc01f32ac08d66c02693520a9eaad5e9a0437

Download Submit
memory/2028-84-0x000001C7CE920000-0x000001C7CE938000-memory.dmp

Filesize
96KB

Download
memory/2028-86-0x000001C7E98D0000-0x000001C7E9DF8000-memory.dmp

Filesize
5.2MB

Download
memory/2028-114-0x000001C7EB850000-0x000001C7EB8FA000-memory.dmp

Filesize
680KB

Download
memory/2028-133-0x000001C7EBA90000-0x000001C7EBB06000-memory.dmp

Filesize
472KB

Download
memory/2028-134-0x000001C7E8E60000-0x000001C7E8E72000-memory.dmp

Filesize
72KB

Download
memory/2028-135-0x000001C7EB7A0000-0x000001C7EB7BE000-memory.dmp

Filesize
120KB

Download
memory/2028-85-0x000001C7E8F80000-0x000001C7E9142000-memory.dmp

Filesize
1.8MB

Download
memory/2028-159-0x000001C7E93A0000-0x000001C7E966A000-memory.dmp

Filesize
2.8MB

Download