discordrat | hxxps://dosya[.]co/cwf688n82m0i/turkcord[.]exe[.]html

Analysis

max time kernel
74s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-11-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dosya.co/cwf688n82m0i/turkcord.exe.html

Score

10^/10

discordrat defense_evasion discovery persistence phishing rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwOTkwNjkwODUwNDkxNjA3OQ.GclJ9i.iOv34zwsdQ8U1kW_wa7omJgFe3BCdb7uAGF-Qg
server_id
1309598956350869586

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 2 IoCs

Processes:

turkcord.exeturkcord.exe

pid	Process
2820	turkcord.exe
3524	turkcord.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 66455.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3048	msedge.exe
3048	msedge.exe
4136	msedge.exe
4136	msedge.exe
420	msedge.exe
420	msedge.exe
1476	identity_helper.exe
1476	identity_helper.exe
1500	msedge.exe
1500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

turkcord.exeturkcord.exe

description	pid	Process
Token: SeDebugPrivilege	2820	turkcord.exe
Token: SeDebugPrivilege	3524	turkcord.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4136 wrote to memory of 688	4136	msedge.exe	79
PID 4136 wrote to memory of 688	4136	msedge.exe	79
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3412	4136	msedge.exe	80
PID 4136 wrote to memory of 3048	4136	msedge.exe	81
PID 4136 wrote to memory of 3048	4136	msedge.exe	81
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82
PID 4136 wrote to memory of 3516	4136	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://dosya.co/cwf688n82m0i/turkcord.exe.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe34b63cb8,0x7ffe34b63cc8,0x7ffe34b63cd8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,3300234356842233829,1910983853559413817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Users\Admin\Downloads\turkcord.exe
  "C:\Users\Admin\Downloads\turkcord.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Users\Admin\Downloads\turkcord.exe
  "C:\Users\Admin\Downloads\turkcord.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a80bd4b940c24a7b0bb3becc605b7520

SHA1
391c33cb408ff44ef38f277298c98f78bdc778eb

SHA256
2663e736a341fa469d6db5205fa77929ab69af6c238bb3477e5d06b80a3bdaab

SHA512
d822922bbaf84e7dccb1ae2a4395fd4e17a430a943495d690fa8a3489253a070099f916f4552ea6e11eca5ab0376f978576ff8821ef7b3e6a9768074849b56ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2f7a8582842d404a23031f7758da834b

SHA1
e0ac6808cf7575a8a7879e5a5ffe0febcf1f2cc0

SHA256
265fbd7430dbbffffeb5d9d559d8c4fdf464526fbc9164024aa92dfb5148217c

SHA512
e17a49549f9855df060ab51e8f8484b96b7f9cc23df96e98a907cea53fc37a3739afd137c68850808d19762caedc951b0dea805791b055398c5034c4bfc0db4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16a4ce45f54ee5086a27f27c08261335

SHA1
d0f1cb620aae3ec33a6c72ba35999e07b881dc45

SHA256
7cfee5f73aa187a3672f89a5707dceccc18fc1bb4f1dcc97168c73c2ac3ac21a

SHA512
f81deed4fca7005d4c41bbfa7560156a0c7e9488625ebe094ae5ddd51b99de0fa2b9960aadb4ba20d1dc0e64fed0ca125e00ac522d7c5b829a2bb0ae292abea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65034285273ed2eb3a4f1b4217f0ce98

SHA1
bd1af821ae612d4340a73e802a13e42fc481321a

SHA256
c04329e6954e84dc45e801e78a116ef2af8c0df27f5110dd86ab32f4847c1770

SHA512
bed67bbb7156af44fef36b837ac16a601c4fded1fede99cea341586506bce7c69a8d03112d40b833d6d8d03cec1c2bb8d03ac023457bc0445b6de0a0f182c7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a75ce96c5adbac8c15f945f697f8375a

SHA1
6b13b85e16472efae518d36ff7f16d31f58442fc

SHA256
dea4d97c7f4234da5b9a725408f2b1434e236f61b5d3ce736bfa988533085c01

SHA512
0931f9d72e803da486453eee4083145bfbe5d0558617942da1b0d9c5ce2b04295b73e51d0b906ff8e76636b6db37bac07130d501fe39410f0254c49cfb938ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd6b0c46a481860dd56ced62c3fd9573

SHA1
e78d9441e983897f262a62d24d4a8d66e586ff4e

SHA256
eb7f5510f46adbbb864d606f1fa30a15b9cd9faf40085764c428832180d762c7

SHA512
53f3c593014174d7e4c467675625f3cfa1a8ac7c881389d9e00d4b80fe884e8adfbb21a49e15f3007eb6e064c690188ebd3cce7865f684804a9e39ae967f95a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d30b3cec740fea306eae52a3352ba3b8

SHA1
861dca7c186ba55f8bede67eb527c97bcc0143d2

SHA256
a33b4ababade45159e0cd83dbc8e92c72ab560985eead23f0ed7b06135493f99

SHA512
4a5553fa79790903f3c49b28865b75af0c14ef74e682618a21597de427fd5e6e10ba5a68837a99851e1ce4947cf6ba605fcd5b7eb64a67c6b787d3f3c0b66a5f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 66455.crdownload

Filesize
78KB

MD5
5ce194eee4e11c74ed405e504dfd0f41

SHA1
e2dababa45f8812f7251dc72c5693d8621b2ac6e

SHA256
b0f26dbf73492d85a63bda858bcec420a46c7d66abd4dfd90dcdc19140d378e2

SHA512
6d9d656e55b34d67d4ac27bd16e7bd768cc6a89f12add37ca1fb451da379e8e7073b6351916f594cdeeb2558ed11140375813a67135dbfc7251572f2390d29d4

Download Submit
C:\Users\Admin\Downloads\turkcord.exe:Zone.Identifier

Filesize
165B

MD5
8cee67485b2713be6f1e29d017f1ef8b

SHA1
123d7748adcb5e0dd9393df3958acc0c84dfb892

SHA256
1750333c13b8ca0bcdba794890d54e8b6c772e8331a71230b08549605d169508

SHA512
18ba77ecbaa48cda18fb4134d9fc1d5931a0ffae3d92663f01cc4e60fdf606385e9365dc352bbf5356722a31b91ed2750cd59109cd659a2f0332d13c443e8409

Download Submit
\??\pipe\LOCAL\crashpad_4136_YSSRPLPICLQYNQJD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2820-157-0x000001D169A50000-0x000001D169A68000-memory.dmp

Filesize
96KB

Download
memory/2820-158-0x000001D16C120000-0x000001D16C2E2000-memory.dmp

Filesize
1.8MB

Download
memory/2820-159-0x000001D16C970000-0x000001D16CE98000-memory.dmp

Filesize
5.2MB

Download