discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0

Analysis

max time kernel
419s
max time network
456s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
1027401268227997778
server_id
1027401268227997778

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 2 IoCs

pid	Process
4100	Client-built.exe
4524	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
3504	msedge.exe
3504	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	Client-built.exe
Token: SeDebugPrivilege	4524	Client-built.exe
Token: SeDebugPrivilege	4068	Discord rat.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 5068	3504	msedge.exe	83
PID 3504 wrote to memory of 5068	3504	msedge.exe	83
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1008	3504	msedge.exe	84
PID 3504 wrote to memory of 1412	3504	msedge.exe	85
PID 3504 wrote to memory of 1412	3504	msedge.exe	85
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86
PID 3504 wrote to memory of 3552	3504	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd183e46f8,0x7ffd183e4708,0x7ffd183e4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,11314181387607899636,1039931777277316922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2788

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
81075975d1b6bf7b118c73526b53cbcc

SHA1
d10a9a6a201433d9aaed19e8cb8f88a04ee8f582

SHA256
8cc283d1e973e6a279d62b4a50b8ab9ab86244aa5cff108b495d53e54827a52a

SHA512
a8580f93e7adcf246622b51ade72d718004495d596f7c2b58a6fd33ffc4be3311f0947634c73d16963912414e25670297905ec24f0ebf90089a472130cfd0521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
99fe6aab08dae23f9aa0590ec18fdf57

SHA1
32342e1b06263085683adc2056a3189628ffd59e

SHA256
34ee3df8145cfc8a7696d121cfefb8448bba1520d401f18a25c2cbc8d6a31a35

SHA512
1e994bc2a70083de23c9dc094ac4da2bef0fe5d4bd9fa9d17070a3a68ca45c067ae2d26a985ab0a4effa782257d448c5f6e045564b83e9f152dffb068e3dc0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
00838b884fb16138d827dae0b813fa33

SHA1
52bb93c30e18b53ccd49bc6ec4a76abd280cf50c

SHA256
f9e1dcb6d0cf7097a5e53d1a8da3f75131637d32e5640671ffeeff6f91333539

SHA512
84113b2eeb64e39e457a9e39c4acb76f24fe7cc0a9699713a2bd11f04d7a662ce6bdc9f3a1d1ce20b2a31e00c5e47902d0a97893582f9d51d33d9c264e7ea2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd4dc3f3ad67d047ce9580d93b5c773f

SHA1
ec4abaa1cca20794ac0388ebf5c98a4a56fa4ffc

SHA256
2c28c1aff86b7ed34012b1a5c3ffe602bd7c5d53025bc3cb00839a9556f6b357

SHA512
912d935f1f735c13e97a4f055611e25d9f64e9cb6da655ad3262386516277961962c748d72ada3933eabf572272efe022833b68eb74ffce28c0d62ca780a5c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c4ed27e57119387b82344de7eb2ea24

SHA1
4bf9d92eeee9d44966e77a43ded7f39fafedbbfa

SHA256
ea0e427a6f5d84938c60eb1098a7f3518eb071d70ccabe177b7b639753fcfdac

SHA512
64e600d0e06e83a828f79dd1c51d11a4cb539dc2286622058fd216b89ef8d605a59be3689233a0f22d9d29d1c4b0527733d058d5b11f1badd6e9cf1a08d5e5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6635554ef5235e45651a04570827e35

SHA1
e13b226ff7dd7af9b19a8aafcd57df39312aff0e

SHA256
a9ad110236f9396b62004f1969a13c96644457599e29f7ba941bcc0056ed3182

SHA512
94bc34ddf7d03544ca56b852f012eb51e2fdcd7398698f90751c7c27c518f8aaf49f247504c229fa64cbbccd2f36bec51a37315f172c8ec5220d8636a6258dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e469a36883727c743b539ee2a3369336

SHA1
40a4569d57e1b3a9f5cbe558b94374876a66072c

SHA256
6ef517f25a551dbf03a38e7a76671722483d7e4753a69a5c0845bc0ac5aa5040

SHA512
1e01f24ac68fa9985302a1ba44ff1a4e9de7b42b90a2a58ca3dd487212934f8145e6f3688deb1b97b5b30484b626c256074fa344c987c302aa8e4b60b878e5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
192ee1849fd2a8418a4235df2e8c943e

SHA1
916f9a89dc91d09c536fc2e3765001f2e3fd79d8

SHA256
0ae44ec38a298b450a2dbf13510afa380b860efdbde022165c5d4c7ccfc32175

SHA512
989e7ad4ae3a08269dc7dc7c66b0321a651808106898ff0dc5beac3730903140f2648251246fe76f30f2ec2c7fb1e500fef16dc290d281bd35a5f458211cf676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585afc.TMP

Filesize
874B

MD5
dd5d19784ae1c750727c35c3162b79d1

SHA1
7bcbb85a803c3dfe70d7f51a13b39884e95b068d

SHA256
18641e3b950e6e4ba92716bbb46659b7f0663209d4d467ddbf3cae8f8621fa44

SHA512
e5559194ab5af8708a35749651366b1a4cd8591fec23de477a8c4e68f426c89d0c43f42b3c2a73e5eb990844dab2c82683bde0f3f64630897296c253fa27cd88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ae6f19b588114f450df65986e908759

SHA1
deb1f87eac7189ef01fb67e138faba644d8380a3

SHA256
b64e777b9305a4d6b35b47e16836eb3328caa2f26642e1c55ead40f67ea5574d

SHA512
47735235eb96b78990def270d183e4b8010ea917d6e7507957a62b3d3eb368eb46ee443204ca7af8b17df50165dcd83d2a74d0d494ced77ab4ee10fca2a7bc63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ffa89ce02a4337568c2102a416dea0c

SHA1
989555792c18561b3c3620b619d9500214d5e7e6

SHA256
1b71270e5d07b2caa2356f857042f94cc23ee300e9c84f08aaff6ea4a70714d8

SHA512
af3d9d3c5ab676a5864afccc2fd15f4526bc9698105f5def47c90321686e4cda78c08d84b5783a225b007f639eb78d40e5830847a0c5f4f496959fd57695b16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f704b2b132d9e95022bafc5266aa7ca

SHA1
4540dc1e2ba374377267e783bba8881fa1426c52

SHA256
1a0e9f2b43449e7e088ccdec496af49bc05e924618a160af31d071d48377148c

SHA512
1fb643c0bafa90b43e5904a9bf1454336d7980844a083943270d02cd21f75ae825d29c6d70ddc7c73fba4a7088195784916afd747b691cf1e754c9e516d516ae

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
9a6e9a36bf98f2ddec391a67899fec6a

SHA1
022b3a3ae1b8182a7205832ef26b136a20480ef4

SHA256
a991bd5cda887ab7347d53c83f027ce576ad1042a52ddfdefe4de827fbd34701

SHA512
afd5b4028d856158096b1d1d44bad7752d1ee363e6e67ae1cdb6d6438a15cf1adc322ec8b449d25393f887cb7562cb1457b7053232f438c6169aa2df850b76fb

Download Submit
memory/2788-251-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2788-252-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download
memory/2788-254-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/2788-372-0x00000000063C0000-0x00000000064E2000-memory.dmp

Filesize
1.1MB

Download
memory/2788-253-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/4068-381-0x0000026A030A0000-0x0000026A030B8000-memory.dmp

Filesize
96KB

Download
memory/4100-377-0x000002250C610000-0x000002250C628000-memory.dmp

Filesize
96KB

Download
memory/4100-378-0x0000022526CC0000-0x0000022526E82000-memory.dmp

Filesize
1.8MB

Download
memory/4100-379-0x0000022527600000-0x0000022527B28000-memory.dmp

Filesize
5.2MB

Download