discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0

Resubmissions

18-09-2024 19:27

240918-x584esygkb 10

18-09-2024 19:27

240918-x54tpszcjq 1

Analysis

max time kernel
1680s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
964	msedge.exe
964	msedge.exe
3512	identity_helper.exe
3512	identity_helper.exe
1684	msedge.exe
1684	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	Discord rat.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3864	964	msedge.exe	82
PID 964 wrote to memory of 3864	964	msedge.exe	82
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 4928	964	msedge.exe	83
PID 964 wrote to memory of 3064	964	msedge.exe	84
PID 964 wrote to memory of 3064	964	msedge.exe	84
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 3320	964	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2446f8,0x7ffdbe244708,0x7ffdbe244718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3210212240435168765,13777017096485133505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4032

C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
42f5cd9cf99a45093591902c2cae3f54

SHA1
532b828b939b0902f808bc44f7d8aaed57d0a0c4

SHA256
4a5dc2473a648bb31257b0a7a3e1c116ee652f205e959604ebdf91fdbeb1d0dd

SHA512
52f8e5fa5caf8141544760315e3e246e5318b693ec9631a83f9d5c6a5acca88a170f9aff760fafb4f7c418bf233e9ee7024bc31869e7ca5d63a01250c5928de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0616cc16c1607b9831d9db3e69fc13bc

SHA1
265d88e3f139a4de57a408133d7bd32f70ea8736

SHA256
d72e5ab15035c481a2f887d5f58ff4d71cca212f77da44944a2c5fd3cd4b95d3

SHA512
be8bdde38422698fa9c09cc49768e26a7164e5fe29fc6cf2f2e8ee397f4426fb26457381a9f99794435fb2fad47fced78ab88acf0272dadc11e9e4baba50b253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
406d40f57c41b87d19b999ebfe5296fc

SHA1
7d6ce47afbb25a87565cebdaf0a1a2f4af4bfc10

SHA256
0d179bd1f38ad65839441984c85dac651e393eb75c561885911cb8cce8be6974

SHA512
a763d98c4e196a8f81244761848a52ab25cf2b4dcc91ff8a977828a7f3639f05248463828221b575942a4c99dc5b720703339e4cb59e11a301fefa6236e660fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa6a238f0cb6c5b024a56759dcda92a7

SHA1
f6dbfb5bb428e35291551ace4cbdf42ce3fb8f42

SHA256
4157e06d2ba2e24827ed5cedd45b58e9c5f5114315531f62968ec8c6358c204f

SHA512
d7d028733efaf0dcc709c55632f536c08422bc37bbdfe7ef908588b55b0460c10eea2b594c565e5d3eb6899e045dcb4b8b88e1957324588141cadf99743f85b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f5c352d68654cc029c9b7fc90c3d7fb

SHA1
f7b22c1eb6a82d01cb8cb5bbac210ce0658a24f0

SHA256
51e6b7540056f182e992b0e410451e72129fb5d067f5f39024cbc6b6452b1c83

SHA512
216f4745e079eb4569e98822adc1165c85353efe90bfceec03541b46aa8782fbc48d148e0b673077ed3cbcfdf5a5476654d75a617f93903122473d2256ed7c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34f6dbeefe487266170ef7a9e8dd5112

SHA1
dec0aeb79476682819dfd8de9b11406ad6a78e9b

SHA256
e68cbf3ef49936e64c52daf1200f1e85233e3b466e8f7bdeef4212a11f74e1c4

SHA512
1befd7e76817fe069f0cf7a6f89dadd54068f832df835d9cbdb25a71a65fb7517f6ed4a37ee8fc90a939eaa7361a97d2da0003fa97bf8d2e412644c17f1eda72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b3c818d344b4a5d63f331b5983a537a

SHA1
94863fd887359db2afed5537796b37dd6624b35a

SHA256
ae1762dc58fda5b5d3feb7da52ef94a29cd4b66714ee95b31882c363ceff79de

SHA512
d113f590868df6a13186956931ae04623e9ddd247f4c1dbdc6f18672be2eaf03a93690302ba118ace295de911404bb9be995867fd128c6e80f360037fb0c13fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
02c5041fd653fe6398f44d7111a05984

SHA1
5fe7be5aefbbe07fa175ff0c5946d56af7cf3452

SHA256
1319d01d5bb4ffb58613964c706fb6db080326813e9320b6ee93f12566f6feb5

SHA512
29e751916e29d0d5be6f4783e2a9f420a4f23ea846ea901b7513ab34f4b8f74c6b8f2e009a3d2cb315e93645f8cfa7bdebf92f991492c3f1c36bb6e1f4311349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5933b8.TMP

Filesize
874B

MD5
22ed2ddb6c8a448afee822d205c9cc41

SHA1
8810c4b51acffd8fd5445c0d92fafb381ea7beff

SHA256
4aea00f043eb5bea342709534bf6a75ea817636e721317bc291e02297a36de64

SHA512
0e6dfd58bf1327796808f39c982adb871b105b91dc41b2eb7fbfb1165e15c6ebd72a62bde5e993d77909862c81791a4ad39efd5b6bda83eb6938a826956c7596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
017d2a9a078fc0987775e0b14c3ae3c3

SHA1
f88ccf511e918651919a215519542e1c47048cd1

SHA256
7e54c450bab741be15a300d7d943a2870f98155ac80191beb66db8aceb51d1c0

SHA512
2610c15e37ecf6617c0388032412f3d8d9bfbf49bc46895cc6b61bd1aef07e3eec462ea4a81d8f759a836b00d50db7c27af2e14300d53e8812829cb268034448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
43c7f510ed293c0e8b6526e831f1b2af

SHA1
8ef71beb594c83ab108b61954ca6c3122bc241e5

SHA256
c5a58a2988ed3f6aa3b1f0640204a9aab679bd969b908cab986f76dfe07455ab

SHA512
168caf002f061c9ef81b169438474c0fa48edfd75ec0793195fc2288ce9a0fd7297253e51ca459e434ba7029c0c2aa1ba144c174509e6b112dfa424f1930e800

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/1308-338-0x000002607EC20000-0x000002607EC38000-memory.dmp

Filesize
96KB

Download
memory/1308-339-0x000002607FDF0000-0x000002607FFB2000-memory.dmp

Filesize
1.8MB

Download
memory/1308-340-0x0000026019AB0000-0x0000026019FD8000-memory.dmp

Filesize
5.2MB

Download
memory/4032-333-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/4032-334-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download
memory/4032-335-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/4032-336-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download