discordrat | a5bc70cf93aa47edf14165c016bd6a61da1171133dc7951c67b1461321d6ab63

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

5b15da23c0cd1d4b2f9d3cf7e97c66b9
SHA1

497124f7098aa603a93ab454f2a543532375fc7e
SHA256

a5bc70cf93aa47edf14165c016bd6a61da1171133dc7951c67b1461321d6ab63
SHA512

2ebe94f3fdfd2f4f85efe5655c49093f9ea1740d52abbdb75ba770f03eb19db4de2f0615da65b604a63a32c2e52d0fc3c9a747de52264146cbd1b2b58f62681e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIC:5Zv5PDwbjNrmAE+FIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5NjkxMDQ5Mzg3NzY4NjQwMw.GpBG7T.4yoz45TeRMvrDOT9SFSRsnsnYO8NRMIQccrqz0
server_id
1260379272208453672

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3576	msedge.exe
3576	msedge.exe
2740	identity_helper.exe
2740	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	Client-built.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4704	3576	msedge.exe	89
PID 3576 wrote to memory of 4704	3576	msedge.exe	89
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 2756	3576	msedge.exe	90
PID 3576 wrote to memory of 3844	3576	msedge.exe	91
PID 3576 wrote to memory of 3844	3576	msedge.exe	91
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92
PID 3576 wrote to memory of 2656	3576	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff120c46f8,0x7fff120c4708,0x7fff120c4718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,13626144612884371086,655287372315278368,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ea9058a-cfad-4e46-b348-9f6380c002f7.tmp

Filesize
11KB

MD5
437a79b1b30132b42d2a5126fe407795

SHA1
fa3b2964b4aad4b8fbdb461576210afc4926204e

SHA256
8e623c19a7405d2aa4bf07aea6694cace48970d2138462fcf28046622889a029

SHA512
0463cfce534696b610d7531f1ed85b222deb16f33eb42726ebef53cc9e2db719b37544ca330a4c98d4c2835285482ab2d3533e0c840a29316898080c0642cddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
53318dfa527008a807d830698e51a817

SHA1
a550b3d1642f0d2c57c6faa170c724d1161a57b2

SHA256
a3359249c67a4699cb104151b77704ad3a6fbbab47bddbe0fcdaedbe7825a066

SHA512
5fdf770d9bb2fdf2319eebff83fccac58547df12c287d19ef616984946c5ec13e07e9cbfef08ce13801391e76113b7b9c38d577250181d4c654be2aca914823b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
902c27fb9172ea0ce50bd71a01d99b7e

SHA1
0f69593f62c282e93e69d0e0c851bcd7d80d0eef

SHA256
8a98ccbd2fbf8400df18e5b027b9ac5db549f6fba041fd675cb899a29be52ab2

SHA512
ffe6601e7ba4a16428155e009570d5d422280da2e7c8b51231f752b619e7c0a4a1f0d3b9d82655587253b01bb58eb87c4c034e0b308a482f1f16ea8714d0a579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
273a31d77db489ec35243731e9568876

SHA1
234b0e3a048642ce60c67aa7bc947ab5f4f6e8c3

SHA256
a24d0d20e32a97ddd4c28c455719ee34432dd59fc10b6708cdefa89e963c3d73

SHA512
31d66c419eb495df49c0b796a0e4cfddb441754a6a3e4e780188ece4ceb1c49464af51773b506c8a01dae9747e271be3da4c8b71d6a2f1044ac79709a3d4ff37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37b8b0dcf9892644b4a545504921c569

SHA1
5ecbcc5f0b0f6570e6e23edfb989377e7c96cc95

SHA256
4d709b43c8d69fc5f8ec150ad991b28f6991bd92f07535a8d024d467a251422e

SHA512
c87a1a482a27e013f076dfde9bafe112903cdb03ba9dc514037716ee4658939b2b29a8108020a3845e5185deb5a350e1a99ee2173650c72e7e2bd5342f736a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19539d0feb0387c1a85f7246dacfb4a5

SHA1
0c6a5209a86088889cd76dee0ba682121f914d00

SHA256
29f7860c645f373226e20c281a6e677d68159e2ac6cc22f69c4794e31ae001c0

SHA512
cf0b19f6a582195d0c60acf4eea32d4c7433c4bef8ef298577924f4d71b7248802a02e2a9a1e0c533f19d8d043ff8db308a47720c5aa8d039d2888787cf796e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0b1e2acaf3ef9d511a7b69645ee5607

SHA1
8b046619cac679cd403b2272ae5dcc6ae0b36d81

SHA256
db7eabb4a7dfccf1a59fe51f40199439ef3fcf30ebc887dec318fc1f0b2747ff

SHA512
1966ef1cc1948e0391d876327f9a2286ed0ab62504431d4c524014b9d4050367aaa32abec0e2c5a5134e0ac21e22549c5664928bc792054f6eb3f2cb22e17423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
memory/2388-5-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Filesize
10.8MB

Download
memory/2388-4-0x000001D34D020000-0x000001D34D548000-memory.dmp

Filesize
5.2MB

Download
memory/2388-3-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp

Filesize
10.8MB

Download
memory/2388-0-0x000001D332070000-0x000001D332088000-memory.dmp

Filesize
96KB

Download
memory/2388-2-0x000001D34C730000-0x000001D34C8F2000-memory.dmp

Filesize
1.8MB

Download
memory/2388-1-0x00007FFF22B93000-0x00007FFF22B95000-memory.dmp

Filesize
8KB

Download