discordrat | hxxps://github[.]com/ramer-py/aimmy/blob/main/aimmy%20roblox[.]exe

Analysis

max time kernel
63s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ramer-py/aimmy/blob/main/aimmy%20roblox.exe

Score

10^/10

discordrat discovery persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMzA0MDkwNzU2OTc5NTA4Mg.GnB-rf.nnDGsX-Z9pGJFRsY4NrmXiHZ4ytAvcb7urIy1g
server_id
1322790854867292273

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4592	aimmy roblox.exe
5036	aimmy roblox.exe
5520	aimmy roblox.exe
5644	aimmy roblox.exe
6076	aimmy roblox.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 21 IoCs

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
101	discord.com
45	raw.githubusercontent.com
63	discord.com
72	discord.com
90	discord.com
97	discord.com
91	discord.com
93	discord.com
96	discord.com
106	discord.com
111	discord.com
44	raw.githubusercontent.com
64	discord.com
74	discord.com
95	discord.com
98	raw.githubusercontent.com
68	discord.com
100	discord.com
104	discord.com
107	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 878385.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
1628	msedge.exe
1628	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	aimmy roblox.exe
Token: SeDebugPrivilege	5036	aimmy roblox.exe
Token: SeDebugPrivilege	5520	aimmy roblox.exe
Token: SeDebugPrivilege	5644	aimmy roblox.exe
Token: SeDebugPrivilege	6076	aimmy roblox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2432	1628	msedge.exe	85
PID 1628 wrote to memory of 2432	1628	msedge.exe	85
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 520	1628	msedge.exe	86
PID 1628 wrote to memory of 3884	1628	msedge.exe	87
PID 1628 wrote to memory of 3884	1628	msedge.exe	87
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88
PID 1628 wrote to memory of 4940	1628	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/ramer-py/aimmy/blob/main/aimmy%20roblox.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb77bc46f8,0x7ffb77bc4708,0x7ffb77bc4718
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=180 /prefetch:8
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,3333844548309405391,4316967995751034208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Users\Admin\Downloads\aimmy roblox.exe
  "C:\Users\Admin\Downloads\aimmy roblox.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Users\Admin\Downloads\aimmy roblox.exe
  "C:\Users\Admin\Downloads\aimmy roblox.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5468

C:\Users\Admin\Downloads\aimmy roblox.exe
"C:\Users\Admin\Downloads\aimmy roblox.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Users\Admin\Downloads\aimmy roblox.exe
"C:\Users\Admin\Downloads\aimmy roblox.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Users\Admin\Downloads\aimmy roblox.exe
"C:\Users\Admin\Downloads\aimmy roblox.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cf7c1f11ae00ad44b168f64215ed9499

SHA1
70e681b8d69d91c1b948bdf93af14d879f9b0d32

SHA256
a7dfd14ac1af2ea4ca0615e39ba0d9f73fe36c40dffba309847033c6e8e53c2c

SHA512
8fec8625d376260ec2eaafe3d5a21908d286a6cf0749d5bf24c580f294908624cb87d8f90a779c6b032ff8b73bf4e5e934eee54c87ad60430b2066455753f269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5d970e1e336406f0f19d5968aa43617

SHA1
9d0d8a015fd3da12033d9c2f5e1ecacea194ee2c

SHA256
e252015c024ccf0eaf715f8539906a2b5809b449dda162acb2ba9514797e60a5

SHA512
81ae904f78515d971ec926e4f4a330283be4224e2dd07180139dcf0d157dfcf3b41222f0a14cf250a145daa7cd4bcbd3da0f7f50b03bf5575705b620fc087f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82a46c261ed4669f9a2a204bb1a1bb6b

SHA1
e5950684e32fd9a2e84fbfb9093a9e7b4b811675

SHA256
7f6f85730e229dc6ca5d1ad8ceaa020d1253f87acf4112a76215b7ffade82b53

SHA512
8a1849b294de721ef9c689d2790a3ccbec0ac2b163d71666afe04e528c4f37611b3692dc89e5f64fc66e29ea122276f47fd892089c619196372d264aab5db3f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a4df1d608abee3f1bb1a7be94e9b5e3

SHA1
2e7ce1125dda44c23504edd829edf7e6effe5262

SHA256
b8f70c569deb684293dbb9a79835ee8b2a27cb0222debc7e2be73859ae6bd61f

SHA512
6cc296c1d0e8306dabac65380c0b35aefabac411390ac77d25391b350010cd4527a6563272a7a5487437776bb23f04aff3fc959ced9ad3f06c9bdebc7a618738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b47b.TMP

Filesize
1KB

MD5
a219c429f2729a86a0c921efa551e4a5

SHA1
a15cd05e949a68f85747b9c70721d56d7ea01fdf

SHA256
57b0a6c6b974ee56f9bcc5582a86ab70b9dedf21d53287176b3ee10776776bec

SHA512
0639e663ecb5761dc857b907cc2804bcd1aa026b2db17ca327fc5cd086d77c2eb31713728e67e76dfbeb7e6500a0327c95e833a282c671003b828d233526e479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ec16c232d265d750931bb4136d90f4e

SHA1
fccb48cfbbcf12e0b466478ba4252be71c41c0e3

SHA256
44fec42b92e005db313f82ad7a0eab0431c5c8f194fcd91a795a7430fc6ce67d

SHA512
2ca886c755630c0da8c02a03e15a3e581918f05161d922bf92f610bfe87fac24cd405587dd718c7828da9d1e96208b9bfa85c7650c4dcefd07dac94c97f97023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c6f14c0ab78948b0da5348e7364a6ae

SHA1
ed3b023388b20b87f4e617f7d753c3b68a42d520

SHA256
25413573078dd298e10c688a0917519b4115855dd759ff13821e15c46e436eda

SHA512
124fa32d3470c7c197349c86ed1555059476ec1fefb3d258e394e9fd0db99aa993a551f249eaffa75942a9dabeb6b77814a98868534874d8a8ef2c6e761c9646

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 878385.crdownload

Filesize
78KB

MD5
920856a47582dd23735d958a7a5e6ae8

SHA1
b027ea9404d2cbc7e1a5a38d57a1b787adcffcb9

SHA256
41d6fd398be2e8eaf3af39573180b8755fbc7326d6aa9277fa7e8089dbe257c7

SHA512
13bcac1322e36b8922ff01d8f28d99b7e2c47bdb75b8d458d8d86f8e7cbb1ec6b5fba7d99af2bf069cfd24934d7cd17dce374d31408abc80227263c027480ddf

Download Submit
memory/4592-192-0x000001FF43DC0000-0x000001FF43DD8000-memory.dmp

Filesize
96KB

Download
memory/4592-193-0x000001FF5E3E0000-0x000001FF5E5A2000-memory.dmp

Filesize
1.8MB

Download
memory/4592-203-0x000001FF5ED20000-0x000001FF5F248000-memory.dmp

Filesize
5.2MB

Download
memory/5644-241-0x000001D57FBF0000-0x000001D57FC66000-memory.dmp

Filesize
472KB

Download
memory/5644-242-0x000001D51A340000-0x000001D51A352000-memory.dmp

Filesize
72KB

Download
memory/5644-243-0x000001D57FB30000-0x000001D57FB4E000-memory.dmp

Filesize
120KB

Download