discordrat | hxxps://gofile[.]io/d/jXAclF

Analysis

max time kernel
240s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
31-08-2024 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/jXAclF

Score

10^/10

discordrat defense_evasion discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3OTMzNzI0NDUxOTMwMTE4MA.GOw-S5.o5k3EpcAZ5nDw2sQD40ybvdPi2Q3Hz-ydhmzcA
server_id
1279122304999100426

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4836	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	discord.com
25	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 169378.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
5048	msedge.exe
5048	msedge.exe
3056	identity_helper.exe
3056	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
2908	msedge.exe
2908	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2760	5048	msedge.exe	80
PID 5048 wrote to memory of 2760	5048	msedge.exe	80
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4272	5048	msedge.exe	81
PID 5048 wrote to memory of 4312	5048	msedge.exe	82
PID 5048 wrote to memory of 4312	5048	msedge.exe	82
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83
PID 5048 wrote to memory of 1980	5048	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/jXAclF
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb12c13cb8,0x7ffb12c13cc8,0x7ffb12c13cd8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,18388069537806434940,1414970300102066490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5568 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:556

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
0e219415e23035999917c578f6f30e8f

SHA1
e1decff79606945561d20d97655d22ffa06ae26b

SHA256
52e6d2d35ad47411585a9555b2b513eebf82a0510637bbe7f4076f65f01c3993

SHA512
eb347c00b4c4d99907e6c00ebc12b483c1f341b591313b8041226f9bdde204d44c1f594d7d9d2f722dfeda5aa3c0f0ea4d3519d07bf356b37a6faec4ba6a61e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
9dc479fd661486caf38cfe970da1dd0c

SHA1
9816cbff5bae124952e5f64a025916abd5c67d7e

SHA256
9d3a72c4743b3fbd2c77e1fb5a35671248de793d4a2c18aec8765630fa88b8ca

SHA512
6c2936b3aff330c63719b797cc2429b2fcd91d8647c4db32a04122fc64e55baedf823444896d7bb648a699de36d910f227ed68490498c713a7857ae366b5857a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e547620c81417c1c5a54825c680e788

SHA1
15f4a85e62b498c17c35f3735a31ea2369e43621

SHA256
861f5f30c850d5ca088b927be8ab6452e7fdf19161d8af3dcf67e85e55f0eaf0

SHA512
ac528a90ca85895b9276708ac84aaf80ae46f82651c31c6b25fe2e785b685dbc0711933515766087d200a89b356f73cc47be32040dbdaadf52cee640a02738b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56f92682597ed2b21448837be840c3b7

SHA1
49e25213cf8de5b6ce5d517d53afe61ed85fb812

SHA256
051b01fac1f1c6f59707b3b886f53dbbb9a1757ae5ee8061baf0da40d1d3aabc

SHA512
f95cf99206297ec04efe06e9a853aa6b901522c0facfcde39a1cd6e03237ac4638741729c6da1041134f7c5db974f6b6d41c5f56aa10935140ad894853171bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
132c9339b9e8c57bcff60f8aa77049cf

SHA1
bc8f5f92c362f22838f76c23ce6e418a72557673

SHA256
2b840186d71768eccc8109c242f4873590c399bee21e9c6a33e0fb5dc6428bbb

SHA512
f7b44fad3c47e8b37705de490e1cd4b7dceea2fd9cd261605ef2a7ab8500f673bdb13a317ba9a7d8311f5bf4787c16f7343bb24112ac0d208685ed02a84032d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46345a77cf8313c093c9f44cd8a00589

SHA1
14033002658c93977f32ebc391dabb01a9e73bfa

SHA256
4cfcf4f84612f2bb23bb7506d1b396b7007209e57d642de953fef58dfae20264

SHA512
fa4668d1dacbf29b69ffdc2579d9e5afb9298eed4a5d1c24ab75750cf0ebe970d86a0a2a4db61c63cf300c520e7428e94f3765d2bb5285c5f54ce4ec125c6e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33fad3333c17a754bd9262f6d5d8d943

SHA1
f56592ec7bc40ae51f60906888e1590d098ffd75

SHA256
f1d17df28ea59e6a01e31544a65586a360daa9dd9f80fd10e896a8011b61cd31

SHA512
9b184e83886bcd14283a70514800a6714c6dea1e9604b3acf0685fcd5c72a08f10d6489af3403b9c2efb7259948a887d1f09d049981357bc2b4513f4b4b5fe50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f102942dcb85f6fc924a47e84eb912f

SHA1
ea5803cf60793eb2307c702c7853268761f1ebc5

SHA256
944a6d465f2c9acb201ea3fafcbe65fa88fdf45c087041210c38e47eb5fb2339

SHA512
d94cf5a4e85d48e45ef383a664495c1fd435eede4852125910a8ac7503b3ec731d12a3041010381168eb4da2246b7bad8ca6b1b74b7d724ae23a5398e834f0d0

Download Submit
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier

Filesize
159B

MD5
7526c4aa82c59fe1872561be2f8c9ca8

SHA1
84d83ff7b3ba5818ab85ddcc7b669ac44c7210e2

SHA256
58fe302917b187b6a34fd255600ea8248ddcbe8e0afe272feb558ca02987f004

SHA512
e7c19e097be58224f1a1322654c7adf8e60b101c4a1d87ce425c9b69076752259635d2d67cca73d997a029b855aaad7d261785b45555a603612d4dbffd18fd8c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 169378.crdownload

Filesize
78KB

MD5
896a809d31572f36ae309cc4e0e4f83a

SHA1
475516bd21f8b755a41bacb9dfae918d913f1a65

SHA256
2bf5883c565a2ca2bd2f8b86f8237936a784bae717a778d5c389455b80e38428

SHA512
e477764f8d87bb404d70be133c29b4bf2fae752e74ebf3fd07a79c5fddf76b96e005baf6cd39ad949bb875f978ef8e6f294915f7eb9b7d33d9a4d5490784e88e

Download Submit
memory/4836-134-0x0000029EDA550000-0x0000029EDAA78000-memory.dmp

Filesize
5.2MB

Download
memory/4836-133-0x0000029ED9C00000-0x0000029ED9DC2000-memory.dmp

Filesize
1.8MB

Download
memory/4836-132-0x0000029EBF5A0000-0x0000029EBF5B8000-memory.dmp

Filesize
96KB

Download