discordrat | hxxps://gofile[.]io/d/AwPQOg

Analysis

max time kernel
46s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
31/08/2024, 07:20

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/AwPQOg

Score

10^/10

discordrat defense_evasion discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3OTMzNzI0NDUxOTMwMTE4MA.Gu11rN.Rd5L1lKFg9KORYC2Acpyz613CN8ljgcppT0oso
server_id
1279122304999100426

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1956	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	discord.com
25	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "34"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 416738.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
5040	msedge.exe
5040	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
1468	msedge.exe
1468	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3580	5040	msedge.exe	81
PID 5040 wrote to memory of 3580	5040	msedge.exe	81
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 1788	5040	msedge.exe	82
PID 5040 wrote to memory of 4580	5040	msedge.exe	83
PID 5040 wrote to memory of 4580	5040	msedge.exe	83
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84
PID 5040 wrote to memory of 2216	5040	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/AwPQOg
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff924b93cb8,0x7ff924b93cc8,0x7ff924b93cd8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7912675923513141187,12799680519769196951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1688

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
17a9fee1b8c6f4e904d625cbe1533ab8

SHA1
41e176d46f1c1ea732432878c6e8d3036fe02edb

SHA256
d9c56f07dce9101d630f88df222e99361c4edef724058e12cc6ef7bb0e8d81ca

SHA512
5d7c25a26e99b2748ecc0132c6382283154813d237b776b864da56b8a9d983aff891bc0106a1a0084cb51874291bb037c8fa0a1e82a459d1f0aeb1ac97fb8bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37c78ea17c460c269274404a34486866

SHA1
2a7352adf1f28c8fb45040312e92fd673f9b17e7

SHA256
6f6913758ef023341f1471cafd10de5f8143efed4d63a02936ca165c7dbb6fda

SHA512
b838009b28742979e1782e6ce58cae65473498c9c23280e6af78af95d7c3fdb6712d5bcc4727f1d77016e6223b1c4804534269b6fcaca19a0789f029d2803931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ebddd6ec330f7b65d71e57a3f2d4887

SHA1
68f9f564b3ce2593ac85856a48c0992c873a6a78

SHA256
c52deb9e21349005c89fd7c6b0fa70dd00a6ba4b8be38318278fd819f5b40f64

SHA512
60273cdc7e8c8a0ee26da0c9b285a9866d57d17c4bdd76dafa9d130f68390119f5b98a2fc3daedca18e75dba0230901f2f5150d37ecf3cb463b096ba56fdd110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74b981c4c5967deb9bcf34bf561ff86e

SHA1
2adede900567a196dd8275c115943d681a5435a5

SHA256
9188b77fd9392cbf66ed8cd3b8cf69314640fa6dbdaa54a552b2f99a3b027aea

SHA512
cd2d7f5ff35aaa11e6a1a30354dc1841ce4b718316c7234a9c8edc01bca88ded6c6660d8102509cea562b06ebe2ac5423c74363cb7434f5bd5abc428e13a4f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d78e668c68c3917b355d4327d292f008

SHA1
98af0724982f42c58ac0a9cd6fb65ac1021324b5

SHA256
ec8028e70a48d8b41fe79a2a255787b8a2e79cf226f90af0c3ada5c40aa8ac5f

SHA512
96bbc9f851ec7350ffa700820c606ac094b4816395262c7baadcf5e4f538218c42dd4946e2b9b2568490f6bbff5c90e2c6c82d48e145df36bfe6e9250b3395b5

Download Submit
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier

Filesize
159B

MD5
c5b8aa95df835d2f9af5edc5f44f0648

SHA1
7cb44bfed197c049d16914078a7ced68988c22f6

SHA256
b95a68ad4c0647df0c40f7e43d94a10574cd775b5fcfcb885499d3822186f9ce

SHA512
7496945e6865bc1bb9e8d938034dfb7a80bc4756e69bd900f8c841c5080e449df604c5366f91feae645c090bbcf7d8cd19a41d6a92b7358882922840b0612709

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 416738.crdownload

Filesize
78KB

MD5
08f0c07cd5403c3941a9a46489bf095b

SHA1
1b00de5827725e9d3a3765b0cc4b890ead834831

SHA256
1dff16bce7153b4f873910db5f407c785637a2b99e3351bba49fbfdd6aad1074

SHA512
67b26f97375912d3b286379f7803e928df1db6685c0fda51153d9763714d05e763ff9ff526754965427fe605a4261ec8089e454a441115ccd83a4140f999da41

Download Submit
memory/1956-118-0x00000245E4940000-0x00000245E4958000-memory.dmp

Filesize
96KB

Download
memory/1956-119-0x00000245FEF70000-0x00000245FF132000-memory.dmp

Filesize
1.8MB

Download
memory/1956-120-0x00000245FF7C0000-0x00000245FFCE8000-memory.dmp

Filesize
5.2MB

Download