discordrat | hxxps://gofile[.]io/d/bASoft

Analysis

max time kernel
843s
max time network
844s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/bASoft

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3NDU3OTUwMzMxMzg1MDM3OA.GWo4HX._410PHlDNg_TffFlRxhJV16pCluP9gS8UTgRiU
server_id
1264517606757634049

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5848	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 183105.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1984	msedge.exe
1984	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
5704	msedge.exe
5704	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4808	1984	msedge.exe	84
PID 1984 wrote to memory of 4808	1984	msedge.exe	84
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 2652	1984	msedge.exe	85
PID 1984 wrote to memory of 5040	1984	msedge.exe	86
PID 1984 wrote to memory of 5040	1984	msedge.exe	86
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87
PID 1984 wrote to memory of 2136	1984	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/bASoft
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd3904718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5704
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2299657527616336534,16899556600922140300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
312B

MD5
2560b435f8018172213d91b5b5572301

SHA1
b22c23041c99d948b3c8d53a4cf469d26f643e8b

SHA256
800896fc47d0c6aa23a988cb028321dfd3bbae8ced9ae19d755a0c60b447e55a

SHA512
eccaa30703e59f9cc551a1ec361aa81eca921f212ec4ed7b828ab56203d605037ff879315c9ccf2cc8cc740fe45f9df4aca944a3ba29c2d1495dbbb87083aa70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
501f360bc663ba01954b1d1aad562cd5

SHA1
ca1b39cc254ed3c2140e572f0209ddd388c607b0

SHA256
bfb859389e9cfc0bb382383f669eda25fce4ed4c73fd5a0bd890c7ca1c5f69df

SHA512
aa6e1cf427e2a3d1665d6fad8b0fc14208dd7eab535b933239da68c9bd0ecc41ba3cdf41829f0221b54415ccd08dfe85a488e5cc581f19a2614f91465c2c951c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01ce3a68865ac223b916c1d17c897ec5

SHA1
1121b3fe0d5f79dc3b4a339bab07adc97722fdb1

SHA256
e9f9c1c45fa9f9f4e3f9367e20167164b488ae4a5e5db4004d459c9463fc3a7c

SHA512
502b2b333ce1c8ded053c853b346b202252e86b300c9e3dccd9ce4f49736ada7cbe8f6ae05baaefbf8c83f898c0534f0fa066e32b60fc6ea6a0e55fac751bf8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73df11fbcc0947b52d0afeed5fd85069

SHA1
d3ec2111b57e8919f17713a781e1c496fc589d39

SHA256
6afa57f66d7f500a29196ea96689031cd3561f8099e627f2b40a5a43c950c426

SHA512
fe1e816faef26945399208eb3c4c350ee4f6fa3e8b6bd804cfa441303f6f3b9ab491dec031b748d3935fa17850be3461e045419bacfc0f47347a52ffb38ccc3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
735e957c2f9f87f79b49299b2e7bd57d

SHA1
de2fb0c00da2f8421925dc3472908d503c4cc22b

SHA256
86e5ac21f3bb2d4f3d1ec1167c5f69b7c2188501bcab9ba15d878ae0d988e014

SHA512
20c39715c24f6d472dd2079a0437a96cd4c22f1e1160c8f7bcb89055305c8177f72d8bbeeae4c4032589d6c85f8d229ce84c9212c9a37a12a4fdd004fe7e8eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
599edd8d5647ad25d9c1fd677a0b740b

SHA1
c2c70552d832e36e4226919de731ffb2209abcd1

SHA256
56d191c1c10d0737ea4d8f7d0c673cf0f0f9bfaf4388488af288f83337719ae2

SHA512
39e16cbf6124185ad99dfb4ad78f835c96d8d82fefa7f309f5f616d251026ed049aa13ba9433284bc6d9ca7fc9ff7bd090a99343d9296390c01239807647fdfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f117.TMP

Filesize
370B

MD5
ddc9df2b8c7e3ccc1cb0d6fbe131c79c

SHA1
343babbb3863a3c1f6e48ae5dbb996810f468970

SHA256
7d3d13dae1b288fec9b494ec623d068a1cf1e4176ea3bef7fb7a7da069de1a98

SHA512
29890d522fa263f625481b28a690cabb21e6cb4aee71f0b97bdd56a3ad92e73bacc63896fd7ddee9b6b6f17cf771f41ae995b5ecd62e20af4836b3c5c270f529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1f3a1420ffb26708e3a7758f58d7dc2

SHA1
f10bc50bac0973e7e04e7bdf9bfde8a188909dd8

SHA256
6557cc1140b83f4920fcf40c53c9010522780dee16fc8f0c5a90ec752ad339bf

SHA512
5d06c9a573aea0e8f806531741e874a64f9f4bfa4130d63a3768b1b2842969ff5ed150b1d681f7094ee6073909e5a7d2b8681904603b5ba9248412edbf10d834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acf000031916a077ccce54870e6e2cef

SHA1
a356ddca9057248ca6e5d37156ec7cfd9739e670

SHA256
ed33069a973f8a690773e4323d9dae375668f4bf3817f50f7f0c1073897bc6ab

SHA512
149019ab555b9a26f1e0792f980ce31fe59b44946be03d0ef927acd3b99452904d33175d1b84ad6882a07104540b752b661426583e4531cdac1591077da47f22

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 183105.crdownload

Filesize
78KB

MD5
225f27a3afd8b962716a6fa99cec1a31

SHA1
13feed41a0638f55ee76a0d5f6adda3228cfb0b9

SHA256
214e7db39b331092a69d01b8e3cb36f3b47347db7e4d1f1b9dc8c67b92f0cf38

SHA512
2b7ef25787b632f0609cd08aa3f27d2f7b52183efd1adc2a59e725e2f28ce29a11f6d9ded988d0bc2a1e0cc2da605b5a62586b34fcd7186477608d90164b5764

Download Submit
memory/5848-192-0x000002576EF10000-0x000002576EF28000-memory.dmp

Filesize
96KB

Download
memory/5848-193-0x0000025771580000-0x0000025771742000-memory.dmp

Filesize
1.8MB

Download
memory/5848-194-0x0000025771D80000-0x00000257722A8000-memory.dmp

Filesize
5.2MB

Download