discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Analysis

max time kernel
162s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-08-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
3380	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
3016	msedge.exe
3016	msedge.exe
3456	msedge.exe
3456	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	Client-built.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1600	1584	msedge.exe	78
PID 1584 wrote to memory of 1600	1584	msedge.exe	78
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 2744	1584	msedge.exe	80
PID 1584 wrote to memory of 2744	1584	msedge.exe	80
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd63973cb8,0x7ffd63973cc8,0x7ffd63973cd8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2840

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:896

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a2a9b1b4a18ebd6c5984aa0418902e1e

SHA1
1859e621ab0af814ecfa3dc37b56515036f8bb5c

SHA256
64b3f36362cb43bcb67ddd43435b837a64b7d2c0967aa48abded48b3453579c8

SHA512
913a6c9e5ab08c6c4e0c295620bf7e5c7b5592279742fc7f1da0c341feff21f8cf97a90b7022282d183b4c84c1cc663f62100f70b454f4d74b689977f0963a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
bb519884fa134af09272e11778367548

SHA1
cb1ff76e6250d315a50a51a22802143a3353c853

SHA256
d2f1c28122333beabb631ed76a77400e79c61df3a6ae84f27ad460b67e40c959

SHA512
9332bb62e30c0b3c3af84fd9ada44c5a1bd2cf0168d421401fe6cd533804e0db3a426a4348677ffac21297721f32662fbe03059b1e70d46a5d8d79f1da8dbc06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4306e90eb1cc86766dc92ce9eab8e46

SHA1
af003c2524050f34ce4ff0ba2ba6034bd9e7910c

SHA256
594d8125fc9d5d40ab6f34d110d875fb0033e3c250c5edb4ba2d0ae8b5146511

SHA512
1175abe0451bec5939ed3fbf0610ca1a54948620bcbf191cc8b6118f44a6674e77b5cf907ce79d49874d7c9bbc348d298aaa5832530568f05315b62bf3c56c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
750d9cfb683199cb45e361ad76baeeb7

SHA1
4435970572fe7dcd3b4bdd4a359ec74e3cf7535c

SHA256
e92669c873718fa0c46b3bb4cd105d026ea32b21a8f0468aab735c47aed84ddf

SHA512
e9037178864e9a45b26c6bafb759e5ccadd3dbda2afbe36384936ca1fa4f2ced501a777a1a8a879405c55ce56944ed779832d7a45a33fac9de15605dc55844eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aedce114f4fcd4557c2c37d60ecd540e

SHA1
b9f7e557fa8011b036b5704a0041434264226755

SHA256
311f73fd1306505e5bc34380942f64734c785af9d8e16a71ffd1c76c6bc0727a

SHA512
b949b2f62c47528f666276359d8fb28d6f84806fd1e1295bccb9509a31c9c960e11be4def947ba21f6c834a17cbc0ec629878086a811d731a80ba1b1d7cd0bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef1874e68ce51c94c1e199432191070a

SHA1
0813dcaeeb577cc17ad9d3586039860dbae75691

SHA256
32bb4cea8a0669073d5d08b32b9eea8f04b01119676daafb1d12f126aa780932

SHA512
b8996a4fc6026e2d8011a68b468091d997a97ea7d3415106816493d81d13df6be4831ad9baa4ef1713ec717189441169770f0c303a8e53aa92f74f80188bfa4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42eabe97181122e68d393bb9c5e70d83

SHA1
64041f107aaac2b50858678a35ae9d2ca30be7c9

SHA256
b5f1da6d9de788e6f42f24aac80a35970ccebacfb17bfaebe99437b379fee2d6

SHA512
bdae725fef7b63bd7c77fb3db535d4ca745a77d04dd5ba122bf495b2bd95079bc7d93fd8871f6f1ffd48fa1795699009b93b70a90c1f8eb16d66ad4d9d2311cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83809448936509717687d622354f0ef3

SHA1
2c672488c7af9479c59ab983367a3e7d411c910f

SHA256
07d1430dcac6b2051f05e16b709e127760f3e09dea1779045a1ae39dbb8319fb

SHA512
a3a5f627d46c5614c220d39ddec06adb03695d67a98555f7370b876d5fcf6dc82e83af58c7370f73cfe88800b655e51c7bd5f04d119d6a9a3d5deb1418117b74

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release.zip:Zone.Identifier

Filesize
655B

MD5
80dcc3dfb67d54ffe6ac1d67e8c31957

SHA1
8966990e72e866acde8daf978f98fa7d9aedcb06

SHA256
8fa6fa6f5c48e7cacb45304a49fbdeca3af71adb0ecd7107af8c3098a469fe80

SHA512
c30071bc3ad452073674dc9d0ddfbaa68bb1872bb69c213cf8086c95b54271edf4de10a22d0d3607bdd6b192f61639d238a9231c2dba18368af099a3b81fc5c7

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
5fa78b19ae158350ead3ef50feb6a7a2

SHA1
57d57ca525968fd9d5a9ee38e783e288896caa01

SHA256
1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5

SHA512
c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e

Download Submit
memory/896-230-0x0000000005DA0000-0x0000000006346000-memory.dmp

Filesize
5.6MB

Download
memory/896-232-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/896-231-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/896-280-0x00000000015F0000-0x0000000001712000-memory.dmp

Filesize
1.1MB

Download
memory/896-229-0x0000000000C40000-0x0000000000C48000-memory.dmp

Filesize
32KB

Download
memory/3380-285-0x0000021D76460000-0x0000021D76478000-memory.dmp

Filesize
96KB

Download
memory/3380-286-0x0000021D78AE0000-0x0000021D78CA2000-memory.dmp

Filesize
1.8MB

Download
memory/3380-287-0x0000021D792E0000-0x0000021D79808000-memory.dmp

Filesize
5.2MB

Download