discordrat | hxxps://github[.]com/LuNarrrr12312/LuNarrJBDuper

Analysis

max time kernel
36s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/LuNarrrr12312/LuNarrJBDuper

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxNjc1NTM0Mjg4OTcxMzcwNQ.GgoR-h.BIoJnlUNlhb0KDcyJ9vUxlnk-8cdlAxARwkSf0
server_id
1216754832312897577

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
4988	msedge.exe
4988	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe
4184	msedge.exe
4184	msedge.exe
5432	msedge.exe
5432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5600	Jailbreak Duper By LuNarr.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2908	4988	msedge.exe	84
PID 4988 wrote to memory of 2908	4988	msedge.exe	84
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3616	4988	msedge.exe	85
PID 4988 wrote to memory of 3780	4988	msedge.exe	86
PID 4988 wrote to memory of 3780	4988	msedge.exe	86
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87
PID 4988 wrote to memory of 1264	4988	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/LuNarrrr12312/LuNarrJBDuper
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff122746f8,0x7fff12274708,0x7fff12274718
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,109597195797662996,6080843785573123905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\Temp1_Jailbreak Duper.zip\Jailbreak Duper\Jailbreak Duper By LuNarr.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Jailbreak Duper.zip\Jailbreak Duper\Jailbreak Duper By LuNarr.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
294c0b3413d06ff6af5162226b155e4b

SHA1
23b104130627960a5bf781a6644d176ecf4f1f07

SHA256
afede0ab98b2a2777a601749876bbfda979c7e027219bc1cbca3c2bbd38d6958

SHA512
1a25306bdfd5849c7bcf2a7eef7dc2da6c15c6f072ec9a7716aeb98698d2666fb37975d5f41f95d5dc24507ec929d4cd9ccce339230512b3e262b2645f4fdf4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b013c0e8713e3ac43a03b03da69e54a2

SHA1
c645bf958c22954b37aca90b25804ca351f9ed46

SHA256
625f01c330985b289cde5b7ac80505c8aef6d1f377947e586c1d5ed10a287a3f

SHA512
6408ee9f34f375bd07ea7608c4a60daa9d81d4c2522d06309db8d84944426536659359bb04486a02c26202cea536584a0522ba8df9aa4712c89b00301bbfa075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc043064e4c9e42e2b5d211657a8a87a

SHA1
b3688cc7a198c4989ff7393abd0723ee247d6a33

SHA256
33765bba6b699a8ed3e1bf8561256a7c7d9bd99e59f727e2b3ce0c0b6fbe119f

SHA512
05019af25bf5fd7979abf7fd6525c91b0e895425d57f515696f0a924200bc37f0a9927877ea001b5575668aea93a07f9df1bea2bb0329505605e8c686e0685f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4edb558f55743f44b0b9d959c35ea73

SHA1
8d94c572f8a9bd1d1ad39950fd012e362b7da8fa

SHA256
8aadb409b22a51bfe5196960fb106fa568d4bd73a8d023c73a1ff6e87352844e

SHA512
0a0b01063672747a14f5769daf5bd107cfc59be4a3e37e677cbbc70507899d289136eb1c04b236801bd209dfe99f45e0d23a5ca234ac91e14103b4ccfac06177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
559e735ef8792ce9010a858ad2e49e7a

SHA1
9b6838894166e21bc4c2da841d6a0de17c31ba77

SHA256
7530838b5f0aba88429fab6e776668402e90a0901ba7ff14ad29e188aecfe918

SHA512
ff7c0aba1a6a480aee7791cf702769b24bad9c526850f7de671ae1b5bc8c1540a5c5480409ecb5204778eb2bca51edbbaeda1e43b5eeedeab815a68809438b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580143.TMP

Filesize
874B

MD5
c6d186f667d8e4b2b8f956ab2d70a1d4

SHA1
28ca30a45935bdb77ecfae69a3cfd214b8046836

SHA256
2cb24fbb0bb483c2017d0445a130c5ce7af8b02ecccc27413274da12466fb1db

SHA512
971a1d8e8991a716b21e5f45ecde1372dc9e9109ba9cf602c1f7722f7383dc837a419515aab0a7b39013514b3eb20f87307fd44ad17d0d3c79b4eb32e6eaf044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf3e412016e57aa81279bf978d100971

SHA1
bded624e6edc6a13138f5b067bc57e6a6bfa6911

SHA256
1c5027a1b7248f2b2d8b20fcbb0739bb033b3f98a9da309270bcae62095958f6

SHA512
c9fe3fe1b78dcf5a7c3b42fbd5d3386f2a325cdc5b8a29d7754330b5a69347476aba0f635859dc74b1f78593ca218287307804eb1369b7935815c319f2cc0fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc948b71070a613ce8dc15c0515e5fe6

SHA1
abafdbf8e19cb7e6f08ae9877583c7782ed4aa8f

SHA256
a1534cc1d407cd40bc1cff380e2ce5f7cfb29f3082f34a43ead1f0fda4c4ddcf

SHA512
5b6d2408f01700f5ef31d1c4cd536d64a5cb83761873ca14ddd174337fbfb5bc4eb5fff34691e181af9b4f436a032320c609d5db10541849e7c4c347454c52d5

Download Submit
C:\Users\Admin\Downloads\Jailbreak Duper.zip

Filesize
28KB

MD5
b16034d8a9f0ff93d3c9115760b3b243

SHA1
b70dfcfb0af46e360126ef768bc81f2c3bf22934

SHA256
2f73b571a2269c7631f71e5c21b24e60722db8d7b2a154ec4d276012b91b4307

SHA512
b6f231db55b3b8d92d6bbd18a879421c1f1e4902e2027c654fe35df4239084cbf7da1af6b7dfaf2beca9627a8ce4b42004527330bf07a77e1e3b18eec919d10a

Download Submit
memory/5600-238-0x000001223C040000-0x000001223C202000-memory.dmp

Filesize
1.8MB

Download
memory/5600-237-0x00000122219B0000-0x00000122219C8000-memory.dmp

Filesize
96KB

Download
memory/5600-248-0x000001223C940000-0x000001223CE68000-memory.dmp

Filesize
5.2MB

Download