discordrat | hxxps://gofile[.]io/d/S5dzkU

Resubmissions

03-08-2024 22:36

240803-2h9tnaxfnl 10

03-08-2024 22:30

240803-2falsaxenq 10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/S5dzkU

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2OTM4NDQ1Njc1NDY5NjI1Mg.GVLhu8.p9W9pzdU2KtZkMRbDo2MgONe-11pxrAtiuFYTI
server_id
1269385366268416092

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4432	Client-built.exe
3428	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
56	discord.com
57	discord.com
63	discord.com
64	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 200008.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
4420	msedge.exe
4420	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
2008	msedge.exe
2008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	Client-built.exe
Token: SeDebugPrivilege	3428	Client-built.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4908	4420	msedge.exe	84
PID 4420 wrote to memory of 4908	4420	msedge.exe	84
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 1548	4420	msedge.exe	85
PID 4420 wrote to memory of 3216	4420	msedge.exe	86
PID 4420 wrote to memory of 3216	4420	msedge.exe	86
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87
PID 4420 wrote to memory of 2720	4420	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/S5dzkU
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9565f46f8,0x7ff9565f4708,0x7ff9565f4718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,2901957651577208167,8660223053784756458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3604

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
701ee5adc85b8bb31e077f02ffa4d887

SHA1
8c49b1ed3b484454e4f165bbeebb9e9c26e6cb4b

SHA256
9512e95b94827909f3c88e066deff2c6a1b3c46082833690f42b31eb0cc7cbd3

SHA512
a1b501c2d3a81b1d643f20292f81764637e57aa8b1178a7bc9468a830a83ccb81e22d16e86271bc048b1df0017089315b80d5fa9abab7ac49bc79d2d0ef552a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
ea5191d26ad76d7268090e2d59ea8627

SHA1
599dfd2f0b5cfc660fb5699a959e3ecd891bc287

SHA256
63c91fc8fcceea02c1d1c14ef0a7cd29a796e62fba67e0adf2ad0f0260ba7a10

SHA512
c2046f6fad34baab2e70c2f86c1fc2fd74ff5ce016a62077f55fd58ffa3399181241e878003ea09f7ffd3d2ce29cec4b8393d802aed4050542938925a79a0516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8b3ef95a55c1789573de4e430ac572d

SHA1
561ac1c2dad6ba694e79515400f9f749296a1e61

SHA256
d6dc42ee9cc3c6a6e072245d59b26267b0e65a998c7a2e5796624726acd119d1

SHA512
f530c7e5a3e28c065d4a62dbe9437bb4832f23ef281597591d3642c67bb0ffaa7caf311d9f1363bfc7d1f347d2e11ebe82d938b83dbc3c476839163d6ea6dad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
492aa5253ebe980c4b295b77b6a19781

SHA1
60dc65540ac02e0d11641a779781de0ce874e124

SHA256
fa76a4d54cb3fd7a8b1b7bbf7a09decc2116cacbd461c9ec8508fb4ba7075bb2

SHA512
620412f0bd28f72c4a8ab7278f7d7aae66756b77013ad316689db9aea50dd04794cce570aeace0a522206ce598600aaffedc6ec3c050f94f42d69ece4fad9e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19bd651963a33a80b311f0d7af78b432

SHA1
5e1e08653ed97e59adb4d08bf08432e6eac00535

SHA256
1d47a7f0e13d4a28c8b75dad66c3e568d06e2b295731f5347ea65cfdb3e81dc1

SHA512
d1bb1e4ec8dfee9f25e8c9d7b0e840fe6cfa6ae66a3875e78c2c2d3f3f7c8c451f98db36293741d3a7088c03bc7aeb0f082abfc6405c45a52d66847948bea004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
468aa006bd81f2163c4144f0cc905dbf

SHA1
805c81f601aedeeb62d26f0cfe3eac252de263b4

SHA256
da8d36dc70fd2315a565a9ec2cc5b17570962b4fa6536ca75f0bda175bafa5fe

SHA512
b2206ee992fc4664eab1fc6f5292b60994dc57a3aa2f9866709f690085eb1a00cf27c5770a8c2d70a0a95e444905a9e8d628da2e472a5af7c595fb093e1328fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a33ad989b293d49f8e6ac01f0656c23

SHA1
79466bedfd5051a3ba08a5cc6ffb2241cae332c4

SHA256
bca4792d4458297259c92f1f40e2b4f1c193deb85d789310bda09474afd04836

SHA512
54ac5e9002ad380c48cfdf71d0d670159b7041d1ed343ed67bf584d076aff1768cfce90a7a06f82b48bcc78e860b452c02bcc80995b7f8ddcd1bea600b8510fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45e87f4c00a2add1a7a2c7bb7bc96a58

SHA1
91c315de8cfa664c0d4df0fc93cf39103bf2be3f

SHA256
976cc17c5687c1893489277dcc3726125bb264042743111f77f5576e4755a01d

SHA512
60fd150ad105b6d11b4d9c8b315eadff40bbbb28192e76344b2d65cb81ee6e1771188cfcf57a580bf6f452621e077e65289ea49b8abfad63b54a2c9ece8cbcb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c5c004801d561d437485758f97bcac9d

SHA1
8e525d4919691e6306a7bf98762de148cd24b305

SHA256
f24caf0f1032d0cc3b4deb95c79db72ac1968595d0d698e39661e3f11630d281

SHA512
baa1c95ddf793928fc7138d9730a83f996b98306a6e42a14ff27b1769f3cb10de2b808c219553e7378d17a6281d6558f6e7b7843ee664fb4e8adf2cfdc2fa3d1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 200008.crdownload

Filesize
78KB

MD5
be535c9b9dd901ef74edf40a8f5c2d57

SHA1
948c0396f8b2e32449b5137cb9d7c145a9f4e7e4

SHA256
1324ddb38c3b33f5a30b129c3b9577759f0e4179be1a21e740cf6babb9b4829b

SHA512
fbdbf3395ade627aeb48e9428944feae964c276ad67d866724f38aad483fd6a31d86d81e1c9e31509570c9926e3c3770fc35874a3a5b4e69804dcf97ad637584

Download Submit
memory/4432-139-0x00000243045B0000-0x00000243045C8000-memory.dmp

Filesize
96KB

Download
memory/4432-140-0x000002431ECA0000-0x000002431EE62000-memory.dmp

Filesize
1.8MB

Download
memory/4432-141-0x0000024320020000-0x0000024320548000-memory.dmp

Filesize
5.2MB

Download