discordrat | hxxps://gofile[.]io/d/yMIF1D

Analysis

max time kernel
1156s
max time network
1184s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/yMIF1D

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3MDQ0NTIxMDE5MDQ3OTQ0MA.GjFin0.X1Vtr9hv82eTV0R0_ajh8rIg2ENQGVkar8dWcM
server_id
1269293168697020497

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
41	discord.com
42	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
4032	msedge.exe
4032	msedge.exe
1568	identity_helper.exe
1568	identity_helper.exe
5056	msedge.exe
5056	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	Client-built.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 1660	4032	msedge.exe	83
PID 4032 wrote to memory of 1660	4032	msedge.exe	83
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 3972	4032	msedge.exe	84
PID 4032 wrote to memory of 408	4032	msedge.exe	85
PID 4032 wrote to memory of 408	4032	msedge.exe	85
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86
PID 4032 wrote to memory of 2324	4032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/yMIF1D
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9ada746f8,0x7ff9ada74708,0x7ff9ada74718
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16693860272176506430,13987043070426124712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3420

C:\Users\Admin\Downloads\eee\eee\Client-built.exe
"C:\Users\Admin\Downloads\eee\eee\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4693a41c-89f5-4903-aaa7-a9c436a25745.tmp

Filesize
11KB

MD5
c6a2aebb5c028326ec40a4311dff6bfa

SHA1
ca4bda51e1719882fd1dc76668e6d3dc354422c2

SHA256
a8b9fd92b2901e69ff58138fb118065c66ff041a143a9cf1dc0ab2c1126aaea6

SHA512
98e47df9f0646cb40663a340715f9bfbb13d5989d64483b1abc49a08945beb9a4ec443060f6cb528375f3653a29e21399a512077818f9d98ec3373c10f74b353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
04777b3fb373dd16b2ea0b3b29a98e4c

SHA1
fce15ba6434fe89ef29f237f626f1cf236e1f8ba

SHA256
e9cb6869494bee5828e888ada42132838888c56ee56ba469e0a65ec38d561efb

SHA512
c81500072a0a4bdc50f8a8ab0bb761c701564b395e5aeba2341a64b00049f2997dd2dcad09f413b41a6c6a7fe68fa7cf255ab5200b219eee99e7733d15168d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
d3dec18bb94719971f2fca51c7457284

SHA1
fbe56fd514e178ecccb27b047e9c4a28f85969c4

SHA256
49bf2e0fd563e5a70eef9e3826e4e676d36763b75a56a667b99d061d8e40c433

SHA512
a5dbb443eb2e99435f0b302177eaee58b207806279d7c3e299371d401277bb0ae008902eb70075664976212571430c26febc7e47d71a47bd3a75829be5f9baa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
941c7d9d0bba742d689d5a39cd047662

SHA1
2e7c477d42bd6639dd0b9ba97528b550f599c291

SHA256
2f8a69362a0ae6fb3b56a3c0ac74465c92f9909178ecaaf160f3d54b19dba767

SHA512
bccdeb4a03e6764b7345e7676ab3f85e9604f83063c371c65ff42ee576eca353d3409377e53bbe10707184a7d5a150e4da0f711f3a1d73969e39553bdd25d81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb31f40682416c2ed9d206c255723b88

SHA1
1f1f7320a68ad80cf4b70335009e17ca1e1dfd0a

SHA256
a7c2d1c45c6927b20299e72eb18a3666c391f597554244af6344df19c502b0fd

SHA512
7192f0ae345e412031781ede92c45c85321f183549d1e9c668788a1818d329f3e6f048ffdf9767d2ddebe865a8ac038bd99cb9c2491ed82a4f46964a0531f1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
088166a8c6e6dd6d26c17a2e889a4704

SHA1
257bdf96da274b53b621a9ced6dab2a37d6676ca

SHA256
d9e8f0f02020ca0a8d957ffe9998a54d55e1e064303dcba18aaee64c9ce325d8

SHA512
dbc8c0e4090c194cc9ecd0acb3c3532d35c69facdd47c2e3333906106b53609c24ee1465117fa930611a897e8a2cd97bb53567927696be35f10f7dd093374f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c201ef5da8e82f2741b1c11f0407973a

SHA1
fb7e2341bb5239b2413ab03c7c4704132a169aa6

SHA256
d9439ef85b84bb2514fde9c2fd8a3c2f54fb63be3c2b3d2a87c634a76c2ecaf5

SHA512
325bc726d25fd7f2c3bd463fbcc4071f0ef696c30c2656a74734e96566fb80b32f0dbc799b31a5aa0e3193f0a32cd81fcd6b8c069fc3c0379998e4ece5a0dbe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7de1bad3d0515b0bfd0ec4688d21034a

SHA1
63279eeabf1450a665e1bf25478cd42d08062927

SHA256
d1cbeb2f8cd6cc1aaf47bf6566576014648f7ded986022b93ea8cfd0de5e5103

SHA512
be8cdb1ac10ab2c366747e986d1bca09e71529e76c6ec60f4adc8ee237a31d42ceeb7927562bda2144c5612f788cf1e5eb275653e9f0577c8eda23cb3f6a2082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2041c50ee5783974d9af7dd84343085e

SHA1
e9fd94b6e7aefd6c37c33638eeb3b67be823acb1

SHA256
fd9218ad788328796d3ebd0964767f9915c8a36e1057ef6e83015c3398486bc7

SHA512
42a16e794334690b3944c61f0953b3bddc49caccc68f28434f704f4c62daccec6376585e3af381f1ac796b83ac319df50327c7d63a0600e3b12ff854874fa8e9

Download Submit
C:\Users\Admin\Downloads\eee.zip

Filesize
28KB

MD5
c84d32c336647a1659130e7dc5a203ff

SHA1
9199fe4d591509043325e9eda3e9fdd9bba899a1

SHA256
0dd064059ed0acd8bc38bcc38be56c59cf5304a5305f52b8e1e3733c236868c0

SHA512
8f3e6400a1d885b54c9cb085382f5106b20b8c293edac651f913ca2bdedb9bbb6499a6b888a37dfd031b257244a145cea93342f6e107dd87ed096a0357787a52

Download Submit
memory/2964-128-0x000001BA6B870000-0x000001BA6B888000-memory.dmp

Filesize
96KB

Download
memory/2964-129-0x000001BA6DF20000-0x000001BA6E0E2000-memory.dmp

Filesize
1.8MB

Download
memory/2964-130-0x000001BA6E720000-0x000001BA6EC48000-memory.dmp

Filesize
5.2MB

Download