discordrat | 7bdb19204fec2ec0addc3761372caef85894bacf999c6c2fe80c64eef3abd936

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Makala Executor/Makala Bootstrapper.exe
Size

78KB
MD5

6a7ea29ef2fb6c36471d0e055b81f084
SHA1

168ba0b3c3f51d89b4b3e5be7c91a813a51387c2
SHA256

cd562416060b65c4e342e62169e7d6136f7043e5252943b1a7033d9160ee383a
SHA512

f9ad092b14d16c13ddc1e791147efc2edfbe875865ee523bbb190ee851725ae3c909eabd15f9ad193d5cbedefa46802a886713cc471f0c2308e51fae61e9256e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxODM1MTU3NDYzNjAzNjEyNg.GOjBDm.fj5GQTX1yf12bG6cA-jFqOCZzVLbT2a7KZ8L7Y
server_id
1031700632450641981

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
11	discord.com
13	discord.com
21	discord.com
25	discord.com
80	discord.com
83	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
748	msedge.exe
748	msedge.exe
3720	identity_helper.exe
3720	identity_helper.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	Makala Bootstrapper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 748	1036	Makala Bootstrapper.exe	92
PID 1036 wrote to memory of 748	1036	Makala Bootstrapper.exe	92
PID 748 wrote to memory of 776	748	msedge.exe	93
PID 748 wrote to memory of 776	748	msedge.exe	93
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1632	748	msedge.exe	94
PID 748 wrote to memory of 1588	748	msedge.exe	95
PID 748 wrote to memory of 1588	748	msedge.exe	95
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96
PID 748 wrote to memory of 3300	748	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\Makala Executor\Makala Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Makala Executor\Makala Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.roblox.com/home
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb204546f8,0x7ffb20454708,0x7ffb20454718
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1760,17777558244886085481,3639493080205268256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3820 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:5344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\256985fd-a5c5-4ef3-9a75-8541a2798921.tmp

Filesize
5KB

MD5
868ed1df51bd34bc941b0ae3fe594c07

SHA1
fa58d2cbedf8f511a638b44b5ac712587c4c79ba

SHA256
fd877c6d8c3b0ba5f2182402c9dfa6f62208bbacb60594319b9c038f4dd91464

SHA512
20c4804eb8f0a597a35148421ed74516c2689de1fe4b01641895582878740bae5391cf65d0489929d89d747ac8acd1c9df4bc4615f729d0bb25165c5f1cca787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3260fe3236ac14565c489c5689e54682

SHA1
ef772f0b27f03361ea888b3757fe94f81590576d

SHA256
a2f18ae034287bf125f7b76239ad5a8f8fc38ed60c2e7da27aaa9e26c41d9825

SHA512
7496af2293add3577c2b63c84c1e54d21a1709d087334b21dea2a69ce01b902344c4950dc6f19a77a1ecaad0fe387e305cb0ba7a00b8f38a41858bbf2e1b5bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
9adf5ef4ac285ec14c29b44c43356e78

SHA1
82fa71a32bfd8c954eb803c4607ffd255f07391f

SHA256
88610f3dcebdd7af6bfff50a9204df05d9c848fd1671ca66a271dc8506154a2b

SHA512
827b3b8ee25509f9ff5ffc27c7d02d1574db72abe361735a4cc914cee63c22e873ff57a7ffff7bb4cac222a42bdf0394e4826877673bac39830bc2a40f79d1fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0e487f4451750e22207e99a2fdda599

SHA1
c3da4a48608a2be0033b637506077780cca526d4

SHA256
a3da7cbe2f3dadc7ed216e72d7d56031bc54668231179b917a644eb18c1e871d

SHA512
184f92307c36ba07ab8102d2c0cd3957abce6c8e3c2016b7a9040978b9a150c76607c98c421485d9333d379055755542fed11c041730588daba22377f275d964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af2874ae9dc344c35ce3348ee934d51e

SHA1
17f7a16b56ddf732c9f3ebc6ac19aba80ab00822

SHA256
0327d62705d4de5019ad6f0174753a99e1ded4a4f75a712578fef664b3a0d310

SHA512
5d039cdf2b2181c54cfc0da07472ac4a499363909792108a20bcad2d313b44c9d701b9f26bd004f5bca0f9a2400738dd038f4768cd9eaf8054bab8ac54d0bc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e72fd0999466dc45a525b4245f9520e9

SHA1
f5e896b4ce55b0971d58ff16d5fb6f330ccb8a26

SHA256
2cad11430b703df0762bdd7b3e86238440c26afb4e72b0ec7fd9cb5999dc7cf5

SHA512
61f73c766f576d4f0ca31cd527511e81542247faa7e3a1c1ddc21ff87ecf5691ec7dd76fb205393ebac942fcdf3e16fca2b4dc186c063e70ea7e600a6e04f11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c8cc7173db3d3b7b79d456aa9450d62

SHA1
90f21b666fe050043a308ed4076b5c34c170d473

SHA256
66d851b2442b70853629506e24c7e1075833ce056bb2a66f317521ea6d2a2e90

SHA512
74c26d3fedd72245955253debe516ea4e41818bc778c802cd39b6f453d3172c55de5b3c094c4b0c0b839d5637d22b222afb1a9a58a87b46e5fd9af42a21304d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58246b.TMP

Filesize
1KB

MD5
5bfe03aff396809019de120e83804b3f

SHA1
aff610dbe9d8e8121c1403eff7fdbb09a6ac0d6c

SHA256
9ca097c7b7c73bc66dfc135fb785c73ccbd60c38984add7588daf9f4e4ad25ea

SHA512
4e7fe2fa6901265060d1c947bad49c100ef7b93cd46e0a422233d73055c4bc986958a6317e3c71126378b670acf2ee835d8bdec3c597296f2cfc829c7fb399c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3098628a57faeec4a182e461624a52af

SHA1
934b00e6fdc4018c758164d1734e317f5c78a494

SHA256
ad1dc918d8a2807fba40d3bf918c58cac19cd4304c17d3931055def5443a51f7

SHA512
76194ee097a8a257aafc4fb9d146c6c8128c6ab193c462b57cd14f720da844e675fe734b25347b90398205c8673daf3830d8b754d79b44b9bc13ff9d097e5c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0623267d6184a7294ba0fd060713f57

SHA1
123a50f876a94024abc2542da2f3cda950dc45ee

SHA256
98e311d41135ab5e44e98f7d613a292882bb4a51493591e92d534f534ef2d7e1

SHA512
056074ed696d0a5c8aeac854427f54eb7b51322cce3d8e7d2b93c8c85a39fccff43ac9b091be69246bcf9e38ef74fc9dea0fc1e85c334dc9fb1b65c54e850417

Download Submit
memory/1036-0-0x00007FFB25BC3000-0x00007FFB25BC5000-memory.dmp

Filesize
8KB

Download
memory/1036-6-0x00007FFB25BC0000-0x00007FFB26681000-memory.dmp

Filesize
10.8MB

Download
memory/1036-5-0x00007FFB25BC3000-0x00007FFB25BC5000-memory.dmp

Filesize
8KB

Download
memory/1036-4-0x0000024A6B4B0000-0x0000024A6B9D8000-memory.dmp

Filesize
5.2MB

Download
memory/1036-3-0x00007FFB25BC0000-0x00007FFB26681000-memory.dmp

Filesize
10.8MB

Download
memory/1036-2-0x0000024A6ACB0000-0x0000024A6AE72000-memory.dmp

Filesize
1.8MB

Download
memory/1036-1-0x0000024A68680000-0x0000024A68698000-memory.dmp

Filesize
96KB

Download