discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases

Analysis

max time kernel
1771s
max time network
1688s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

builder.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language builder.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3024	msedge.exe
3024	msedge.exe
3344	msedge.exe
3344	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
2120	msedge.exe
2120	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Discord rat.exe

description pid process

Token: SeDebugPrivilege 2120 Discord rat.exe

description	pid	process
Token: SeDebugPrivilege	2120	Discord rat.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3344 wrote to memory of 812	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 812	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3856	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3024	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3024	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4660	3344	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/Discord-RAT-2.0/releases
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2ee246f8,0x7ffc2ee24708,0x7ffc2ee24718
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16275960336901856920,12120567691896858101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2412

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0b8f5ccc5cd7fef2d45b4191faf721bd

SHA1
018c3d270e3fafd8a58aee85ffc28dcd94002794

SHA256
3ab150f48b6278f63d0e71bdd4311327c3a8d98cbf5e8120078fa41c3643c3e7

SHA512
221bd28a4459479eecd2d366ce1406d777a7e84db1b5ebdd805ef789eacd7cda4ef5075098462fb2a46695d3938b1347ddc2bae9f5dbe38dc92f54c03ecd53c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
1b92794633aaa7d8ca83e408ef516a36

SHA1
4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

SHA256
0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

SHA512
698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27d21b52948f0551872be807a3b2b962

SHA1
f641e429bf29f2d4d60861e97e8b136eb5bce87d

SHA256
5a929310e76e175643d1fbd704d7e6a0eed5720a27745e0a4762538e13048dd0

SHA512
f3f30592dc09951aba7a00d77fbfb30976d03b8c4e8d8ffc92e6fd315be6af6e0fcaf8ea161ab207ac9a8d73b5d9e2b1327591ccb87754f688225bcd966bf799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3f8c4da400dd58872305d0d5ec1b928

SHA1
65f68d4795aa4362ce116c76f754eebe4873cfac

SHA256
5fff16958f3647fd438147a2971a4369066b4781fd41b808b70128a1b7531d8e

SHA512
c6c2932f9e729ab68e8b394a1964be260057be768d2af24a8f87f363db6320e00db6e2050b3431d5512dc04c874f6eab9a57d0918a867d23b7521793dbb24402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cac679b8448d2a7a004f7cbfc35e8720

SHA1
e77d9edf7346d37c4e71337a05bdd4c9bce9b7c0

SHA256
ff56261b1a98e786eb7be8c08536cd56c508ce09248118271a9b81628705ffbb

SHA512
27fa9565918f46c67d995d3debeb28e695eb8baae7ec6eb948cb03e7d77728e5cef339a27210abce68494ca26c00a6c8820e30e4150dfaa37d85c7adac704365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f45d7d24d9131145498dc24fe95c368

SHA1
d6a4486b4a2ce9fe3d725c597e3f1c0204ebede8

SHA256
3ef0116cafa7a5049a5f80f160264f6e457fd833d6cb5dd7f9f146c57eac05a4

SHA512
25eeffd344f7c2828b8582e54297507054a7d5e4ff9fdd43ec9954471691be3ab7f4dfa0e0a4154a3ec06fe9298e039a3ae598239c9bc0e8c2cb8e45ddf5bdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d379253546ac69fa68c01a4baba4c523

SHA1
c3e615f8eab7dd2a6da6c6819b498a92ddfd8195

SHA256
6183431b4e5694b90de42cfdcfddfa17faa80103be021eb4dc16361d625a25f3

SHA512
2a6ec4af9e95b8fd981af65e6e97dcaca89507ed4d98fc126cceede742a4f4cb81514a9ec19a44a1fb01a33e569a7536802591d2d03f191b7679144cebde7ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
a91ad67a5292710825417566866f2613

SHA1
a6c7b3e7a51bbc3624efc445344b61cd1f588542

SHA256
da89b250ceb01739753b3ef0a983eb324c1397b43d4d2c95ff161968b3782fbb

SHA512
4e777edf88f6474744b454e6fb3561cbd17fffe9f505f75f2b80798506217d2aeeadcca46740e8502afa55feb8dc64273692d9cb07c9b65211a4e6f100719f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58171d.TMP

Filesize
874B

MD5
db736ba5ddf870d018355ebe8c25cd82

SHA1
915e3306b4038159a0dccfe667df0097326589a1

SHA256
d7695b20bb4efdfa6483c11b62b7d4ffdb7e807c7345e1d6032d47743af14ab6

SHA512
079e94d107236e08ddfaedca0c6d36580543f14f1d848e213d38dd62189d33a5ba0e9d8b3fd7af3ee14bd547a02fb5b580f0164df1e7ddcc4ecd6e92bd741d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb90ac69d4865439ecba9a2b7badb094

SHA1
e4e9279a4df4ef91aaa8f4d7baaf5ed768dc8940

SHA256
264ff7b0ead7171af79c96e3d69bdcbe4a26279b24e874c12f8daab947dba077

SHA512
17d60783d019617415405439911ca92e7185d7905b890ffc21ee553eefb6d9a94bf2e89281ebcb88919b92b9086d7807135a5fdd0c127e27cf4d8110e6b96778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95ad5ec9d9c93edff2facde8f130e620

SHA1
be529a7cfc7377fed2c97586f8308a5c209ec502

SHA256
63768be7279d4be36e21738214f42120bd2496a4c0afc02aad97fbdfb18f4c8b

SHA512
54e90ba0deae1afb20f8c55cde62a931193ce7ed18b99355267d09dece3a56b8d9da70930f29366479c992f4751707eb8b852154ac4e6872bed23d8a397553dc

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
\??\pipe\LOCAL\crashpad_3344_DDWQGIDZJLCOBZGP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2120-248-0x00000253EC220000-0x00000253EC238000-memory.dmp

Filesize
96KB

Download
memory/2120-249-0x00000253EEA00000-0x00000253EEBC2000-memory.dmp

Filesize
1.8MB

Download
memory/2120-250-0x00000253EF100000-0x00000253EF628000-memory.dmp

Filesize
5.2MB

Download
memory/2208-251-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2208-252-0x0000000005330000-0x00000000058D4000-memory.dmp

Filesize
5.6MB

Download
memory/2208-262-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Filesize
584KB

Download
memory/2208-277-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download