discordrat | 08d4d8a882d74fa4d9525a5c78351bb3eba95f1c7d78f75c2f5d606715059e90

Resubmissions

01-12-2024 22:55

241201-2wf4hawlgz 10

01-12-2024 15:41

241201-s4269svncx 10

01-12-2024 15:38

241201-s23p1szkbp 10

01-12-2024 15:30

241201-sxv5dazjcl 10

Analysis

max time kernel
759s
max time network
763s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01-12-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

e8ff8d278de10cc2f7255b156ae2d252
SHA1

c91554ef849852360499b82579ca0c41c9dfde21
SHA256

08d4d8a882d74fa4d9525a5c78351bb3eba95f1c7d78f75c2f5d606715059e90
SHA512

c9eb226331c00b915c5ff5b2b407aa6f31536b671bff1cf11aa512d3cd4a60d0c9db14e5e4aee554e74259fcd755e9d835a960838d679e389943be0f20f65952
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMjc5OTI3NDI3NDEyNzkyMg.GOuWiR.FNWWDzhiZI-BJlCUAsWOf3Q5avMNCiFtgUWBSQ
server_id
1307914676973076521

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

Processes:

flow	ioc
27	discord.com
34	discord.com
46	discord.com
11	discord.com
23	discord.com
32	discord.com
33	discord.com
37	discord.com
12	discord.com
29	discord.com

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241201153901.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\350cc5e6-038e-43b3-b3d4-a837e9ff5106.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3668	msedge.exe
3668	msedge.exe
2444	msedge.exe
2444	msedge.exe
1048	identity_helper.exe
1048	identity_helper.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Client-built.exeAUDIODG.EXE

description	pid	Process
Token: SeDebugPrivilege	2700	Client-built.exe
Token: 33	2916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2916	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid	Process
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-built.exemsedge.exe

description	pid	Process	procid_target
PID 2700 wrote to memory of 2444	2700	Client-built.exe	91
PID 2700 wrote to memory of 2444	2700	Client-built.exe	91
PID 2444 wrote to memory of 3552	2444	msedge.exe	92
PID 2444 wrote to memory of 3552	2444	msedge.exe	92
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 5044	2444	msedge.exe	93
PID 2444 wrote to memory of 3668	2444	msedge.exe	94
PID 2444 wrote to memory of 3668	2444	msedge.exe	94
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95
PID 2444 wrote to memory of 3812	2444	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x108,0x130,0x7ffe8f7246f8,0x7ffe8f724708,0x7ffe8f724718
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5860 /prefetch:8
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x14c,0x154,0x128,0x13c,0x7ff63e4b5460,0x7ff63e4b5470,0x7ff63e4b5480
      4⤵
      PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10397701235406040527,16390334602606219153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f8 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
e2afe57c21304dfe65e90ea737e87330

SHA1
e2c7d0916425a88a72c88dc2a2561a41efefe141

SHA256
862a10895e37f84704ee90c8df6952e4729e8cce8b2a565e03504c4da93edbd3

SHA512
f5553207bc9b0ae8bc168e7ca848974d7f14220dac9c845c6fbf47ebb7a6f08b8d95fe63e46e2a857dfe0a53ce6f0d3c78c83668c3e11d675228f6a437c0ed6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9e98f24b131702f26194e001b8d795fd

SHA1
90f6527c1444e1e49e090034c72c8260edcf5fff

SHA256
61870fa159dd02bdb73142e82435939e996768ba99bf41d32518b30588c0f33d

SHA512
fe636ac165fa0bbb6b92ad09390fff2d744f0b882c1b46a854da61d5b6c7c12f2000572ab5360fbf60fa9c6f1644c2ac3674170ace308a08899115dd675ecb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ca5e5ebad1d4df37491eb7aa7f57522c

SHA1
2f1ad018b1788ec785f36b8f9aaec76e0d7c9403

SHA256
1b239e28fddf62f6b8b7ec707e07b3a09baad0f63701c02ff7e8e66c2eabe013

SHA512
aef4bf73c141eb31f505131b80905724edd428b8af58c2c3c1eb17b733449e95316b5c419f99be57884cf77bb46020ced9c47f7780f124b29e7d61f42625dfdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6cc8a3d5470558d7749ee0aa42086049

SHA1
6609883a5a78032106b4b59da4dfceeadb7db47d

SHA256
187c2f6252cff31bc5ac8599d0128ed5e25d24f8aa166329d990a72a9f33269b

SHA512
4a267cdf5165e062c8447a1369ae8f9807bd2315e64745cca57d34857f6501fcdf983010c2e6862a71d94cb84fd8f167add342b1a5c70f1a1e0c5df2d34959fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
db7768327b5d31f69bead309add60d8b

SHA1
0fb6ce8f1e8df9b1328723fb7864ca0a5fd19dac

SHA256
979c611a9e46246770546725e7ecc0ebc4c6a918d78992d8ff98dd69ac0bdb76

SHA512
a48df8591f8ba4fcb47251dc008a0149e7fb62c81964b7705be167788ed6bf6c360330d90db5f0292109319e9c20ce9491440946a1c833c1fdc1b0036a1be77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe594915.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7ae3c9e2ef0524a4d1cebf1ea84605a

SHA1
6d0c4895190d56e9106e6560a4374a8b17df1ded

SHA256
b3b741ab54080a018bf782ead5a72f4c80a5560df4ec227232585391118cbb6f

SHA512
032a8fcd597275562e3ec780c7f513471d97246a800b0dcd5bde36eef26e9e9a1cfa74468a24eba539e051b81ece9c0896ba28bc95b6fa6bd5ec73058553789d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
f5855c8b25c9f68b02ce1eae998dbf19

SHA1
f1127fcee92eff9a2009268c6fd76adee11be57e

SHA256
b0f7e51f0310d6e033c38447e79fec9d2da7142677fdc88fcff7a40e5e218848

SHA512
32730e615831fdfb7c26f25e6928061b1aca7474fe46d43fca5af6df505ce021632bc706188c7d6dc52de76f1538dbd0aadfec35127e2b9b83bc3f43e5e54327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b911b358-f85b-42d0-a2af-8397e338baab\index-dir\the-real-index

Filesize
2KB

MD5
602988c0177506ddd48ca46326e36c70

SHA1
45d597829920f2c967cebc7ba6f5df90587ec067

SHA256
ad98bf1cff045723d8d4bf4496ad22460df0792c3e1512439570d39ddbff4bec

SHA512
8203fe567afafec6be3a802c06d58a5608e38f201d4ff583826fcaaae3af997dce25d72609d6bc6448e6dcc69df1f04a35e3c867eff49a1625234eb9cf3a3fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b911b358-f85b-42d0-a2af-8397e338baab\index-dir\the-real-index~RFe5896cc.TMP

Filesize
48B

MD5
dc14b5d2b8e6fc294f862b1dc10e2fb7

SHA1
f2b6d96d7ce1db1b836333722f82098c5108c9c4

SHA256
a8e48b681e9c66a24849f7f2ffdf741c341694aae576afd3bc98581425ad2df2

SHA512
f108bfe8781b791e14d46c4597000aa33125b1ef1f9febbb60db0301ee07a491d84b0642bd4dea38ad0f723d79c7b9d7c0a25097f07b8741f4fada8fb5591a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
a39a43bea8fba9647e440c67f8f524da

SHA1
852d6e64f920c9b05c975c7725891ce9d6104abf

SHA256
6e206195587862e07fff6a4e3ef5c6ebef36513aca674752fd9a5297ff14dfb6

SHA512
62cafa7ddf427781feb44bd95ef3c8151f598f0eeab2678828951a8c4c9cd6127e0f2f75d068bd76586f65c79c6b7a625a5b190db296718de5ee42baaa13449f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
ff963399e0f01420de11c7cdd6ce3539

SHA1
118cefab66318b64b8dd83286bac5ffdd44534ab

SHA256
51fa8e271de4c70f861988e9f4570c13ec9dc02f9d4f5907b58335e0f3d263b7

SHA512
8b676d64f3c1801d83811d4afc86aab60fd1e09162d51f97a07ddb71df6ed1e4c45d32f8e5d2246c2333ed50193cc5b72d23141b265d7c70fb47051575b078ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
cd0d0463d4c3a5ea76bf4189a9c09fb4

SHA1
4eb366e4b579b69c3a12865a7c01c40722aa27c0

SHA256
facbb5590f54db02e017b58c2a60ed911242d5887205cada5975cd1d85fa6c4b

SHA512
38d3eebec33434fc8a6895bb8a63d4fa8929557088db8fcdf3bf2ae34e4608040c09a271f2d9eca41309bd02ad01f59f22c62d4606b6bf15d16493a620862142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
2fa4e1c5ff0947e8916536e1e6832ce0

SHA1
4d36dfccfc43d574fc285512d1c53cc8b2761d1e

SHA256
d5b0433b44ca118d82102f3ea76f3e30476f799d2cb57cbd136d42e1a1f7a5fa

SHA512
22af63c7a576e3bcb20ee93f1506d0810e50a45331008901124d4a2fa83b46c1100e0bc1c72fae128a0cc0a31087bf9aec9aa6ae8a7602e139dc814660e9ab08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
271fa6d7e4dcf10cc96f88125dad75de

SHA1
73a49bcbf7f0f3f7d487d22afd2af370f0d4876d

SHA256
b93e0e76f612201a302447d9a3b89accd0c0eb28913fe9e5bb7d64ab246bccc6

SHA512
30ac2dc9b5dc53bfb7740913e2bc2d11448c0e066109ed64915f862e517a3969de88aaa7212fbb751bd4d2cef6a20724b8b89fb3c157fe90b8dbd747e7d68d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58917d.TMP

Filesize
48B

MD5
c16e3461e6692f860d57990b9dfeadb9

SHA1
7e3c1b4b12aeac2ba2e8acd6b88210f20500cf1d

SHA256
b956a5251535fe9ce64e52ff5fc5d44307f7aff6d4ab4ea273aa0f884c44e043

SHA512
43e0e69bce05d0898bbc4d75a32785288b5f83b301a98ba250d0c45a36ec4f4ce36c227e0a1583c526f50d9a03fe17b73ade51ce82fe4776a556a2b22ac131d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df502875-bc72-42d7-ba18-e3aa06a1025a.tmp

Filesize
5KB

MD5
ba0dd415f5f23f8d005fe1ac0d5c5568

SHA1
8f73424a486494dc9bd555bba06d4a240b2db1a7

SHA256
b84cd4171d586eecbdaab922dbaf7f62191eabc3e4aab68b421e3cfa0e03b50d

SHA512
2087dcdf63cb2f9a44ad8931a251284cdd76cd3489ff4cd6bcb12951db8a186f6614993b11d08397601250146e528c6bc9ca0c7c598477277ed80a7e3a64db93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f9680bffd59c279f0a57097cd024dcae

SHA1
c8152c8802fe511870daa543ba44edecb7baeff6

SHA256
ddd8f40f43f49dcce24f1a0b6112e4a70eecb7c51f40fc2b3de08799c227e9ca

SHA512
a6b80ac56c0d25f9e17e69bf7b5f477d98c30e20a14efdfb86c3adf1f68af1df28de457374a75cef9d3b2390ee69bcbbb386a0190d7624c4bb2dff253a0b7723

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
73122152e0cd0c7099d5126be0f1a222

SHA1
3e695a6806c2abafcca4b15ebfa7e619b0fc5ee8

SHA256
a7b437815b342fd5c399afe7352d7a5985f2ad4219c41b6db6e072faac4b8358

SHA512
34c2173b164f56e91b15e0ba7a19c1ff61054b7c21d282e77ae5e2b1c56ba3ca5ff7cabc8db82d6cdf9461ba7d7bc67c787d400892324db6c9e3b027f0c43bc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
17d9388a1890a7e2163df321bb770650

SHA1
1e72f0520b1698b3942f818822900723212280ce

SHA256
cf000152c9c29100a389fec86beb1b91c5544693ae5acdb86cbeeafded36d644

SHA512
6d8a8a82b803224a04bfc3f06e66f3be8426779ade8a6886566e7721685cb19b659bb42b48347090a31e3a6c79798e52df10f3c4b6cdbda908e1da75e4b69dcd

Download Submit
\??\pipe\LOCAL\crashpad_2444_XADYJQTQGKZKCVYS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2700-1-0x00000180071B0000-0x00000180071C8000-memory.dmp

Filesize
96KB

Download
memory/2700-5-0x00007FFE95650000-0x00007FFE96112000-memory.dmp

Filesize
10.8MB

Download
memory/2700-4-0x0000018022140000-0x0000018022668000-memory.dmp

Filesize
5.2MB

Download
memory/2700-3-0x00007FFE95650000-0x00007FFE96112000-memory.dmp

Filesize
10.8MB

Download
memory/2700-2-0x0000018021940000-0x0000018021B02000-memory.dmp

Filesize
1.8MB

Download
memory/2700-0-0x00007FFE95653000-0x00007FFE95655000-memory.dmp

Filesize
8KB

Download