discordrat | hxxps://dosya[.]co/cwf688n82m0i/turkcord[.]exe[.]html

Analysis

max time kernel
31s
max time network
26s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dosya.co/cwf688n82m0i/turkcord.exe.html

Score

10^/10

discordrat defense_evasion discovery persistence phishing rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwOTkwNjkwODUwNDkxNjA3OQ.GclJ9i.iOv34zwsdQ8U1kW_wa7omJgFe3BCdb7uAGF-Qg
server_id
1309598956350869586

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 1 IoCs

Processes:

turkcord.exe

pid	Process
4700	turkcord.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
21	discord.com
46	discord.com
48	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 602025.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
4244	msedge.exe
4244	msedge.exe
2636	msedge.exe
2636	msedge.exe
2116	msedge.exe
2116	msedge.exe
1784	msedge.exe
1784	msedge.exe
684	identity_helper.exe
684	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

turkcord.exe

description	pid	Process
Token: SeDebugPrivilege	4700	turkcord.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2636 wrote to memory of 3240	2636	msedge.exe	77
PID 2636 wrote to memory of 3240	2636	msedge.exe	77
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4400	2636	msedge.exe	78
PID 2636 wrote to memory of 4244	2636	msedge.exe	79
PID 2636 wrote to memory of 4244	2636	msedge.exe	79
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80
PID 2636 wrote to memory of 4476	2636	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://dosya.co/cwf688n82m0i/turkcord.exe.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd7553cb8,0x7ffcd7553cc8,0x7ffcd7553cd8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Users\Admin\Downloads\turkcord.exe
  "C:\Users\Admin\Downloads\turkcord.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,15082969232552835749,10578653004186153538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
5361cbbbb5ec2b0eba4f7778fa398615

SHA1
6aeb00904e07e95f5221935d2503b9195cf3ba41

SHA256
db390d4b7557a1e01a5458a7f96033e3d38229443d38d5cf4c85efa529d2710a

SHA512
223b48efd05de454d352d219d7e84ce1952e34e0783101cb8185792d5207409bc40e13c6ffd86894df9dafe464f8056aef53672782c264cd132b2468170ddb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d90e4fae458203ab45f71543ab2ddd3b

SHA1
55345f7be4fc9239c55cf2969734736461d92f82

SHA256
64b72b4d30bc28369a91a0dc865bcf96b8a01249b4ed03e6f648dec0c4200251

SHA512
ba768dcd0dc41c788ce625283f23d0fa75866b2535d1f3a6e316953358d9b4ccd1072628815ddd41105ebe775fc0d3393bdb44b6ae9f720049b62b028b7bdcd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09ff867e86097aa8f03ea43eaef6e5ce

SHA1
0933f2c3e23a7580ff87a0f32d4184b38853a521

SHA256
493e46843066aae5f02e6941f3d4404933b621005b6bebf081446a0746751f1a

SHA512
3c3fa0f0d0d8041d3c9fa37b4c17a47a1a79dde0144384e09fbdd612b759039d6c2a40b36b5bdce0885c83c4a9e75a8ecd1cf36daf8a244e9088a5320104298b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20b7b6977071b98e451398112f081870

SHA1
ef7a3640fb0f3915ab3f241e179139e5c0e047ef

SHA256
5c21f79051933f34eeb9b9bbf60f84f41ca1ce681f3234285c98d9b32c7d7a31

SHA512
f909442cef3b4ed4ea1553393c166182ae09f4d35bf86b92952e5b41031e3f3bd859f42dabe05afdfb4fde9d40f8709cd050d2b61309ab6e214f81db2dae1fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d3c7c3a9a58ab267f3cf52d8ad0bc2f

SHA1
4c26eca7cc6edc8f8e1e6b711006868172e9901d

SHA256
05647c3768d4d3a51ab9259a7a39bfe697a9d56884737f7d3070518a9052eaa4

SHA512
d30c2184098f4978aaae681a321993bad2b5885600aa9dd7487ae3658cad272f57b037718f758d570006b34606d3da9ed0dcf99c5814953c0bc2b04b3c7e1999

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 602025.crdownload

Filesize
78KB

MD5
5ce194eee4e11c74ed405e504dfd0f41

SHA1
e2dababa45f8812f7251dc72c5693d8621b2ac6e

SHA256
b0f26dbf73492d85a63bda858bcec420a46c7d66abd4dfd90dcdc19140d378e2

SHA512
6d9d656e55b34d67d4ac27bd16e7bd768cc6a89f12add37ca1fb451da379e8e7073b6351916f594cdeeb2558ed11140375813a67135dbfc7251572f2390d29d4

Download Submit
C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier

Filesize
165B

MD5
10de80bf3382c6a1c47847af703ab02f

SHA1
e4907252d648ea81eb747293394f78ddece1bc9d

SHA256
dfc8ba90f8b16e4d1226ff74d1526a597a49103a61d670332df765c1fb1a5c5a

SHA512
fd8101da59adbf82d857b77638791759b4d6e4057a736acdcaf93914b5837a6a66537fc0ee419a06c2c83698736278d299b5887764095fb4a10b6b35ceb19ac2

Download Submit
\??\pipe\LOCAL\crashpad_2636_NIANCQXFUSYAGKEI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4700-116-0x00000220D5690000-0x00000220D56A8000-memory.dmp

Filesize
96KB

Download
memory/4700-117-0x00000220EFD90000-0x00000220EFF52000-memory.dmp

Filesize
1.8MB

Download
memory/4700-118-0x00000220F0770000-0x00000220F0C98000-memory.dmp

Filesize
5.2MB

Download