discordrat | hxxps://gofile[.]io/d/r8x2Im

Analysis

max time kernel
94s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-12-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/r8x2Im

Score

10^/10

discordrat defense_evasion discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNzUyNjAyNzg3MzgxMjUyMQ.GJi_OJ.WdkRDMKS5ahnXPzezWaNV6rj4gcnEH1caNAnas
server_id
1310228786406494229

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2724	UI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	discord.com
25	discord.com
27	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\UI.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\UI.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 143987.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 139350.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
4328	msedge.exe
4328	msedge.exe
2112	identity_helper.exe
2112	identity_helper.exe
776	msedge.exe
776	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	UI.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4124	4328	msedge.exe	77
PID 4328 wrote to memory of 4124	4328	msedge.exe	77
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 3804	4328	msedge.exe	78
PID 4328 wrote to memory of 2756	4328	msedge.exe	79
PID 4328 wrote to memory of 2756	4328	msedge.exe	79
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80
PID 4328 wrote to memory of 3568	4328	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/r8x2Im
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xb8,0x10c,0x7ffb9a463cb8,0x7ffb9a463cc8,0x7ffb9a463cd8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,11062476678205337776,4057767423362921241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Users\Admin\Downloads\UI.exe
  "C:\Users\Admin\Downloads\UI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e43e85676cd7ab6d08d79afc58dc3c6b

SHA1
b9f00db079b5541a2823f0a79ae0289ee72d4cfc

SHA256
61b227b671aa8c0cd05bd628bb9e2549d0457636f4267ffd5f3d7ee1dc9a160f

SHA512
d75bbd815bcf4f91f93e683402aafdf82bc992ca165e3c039dd0d644fb3722ad66263da3ed231531d9e9bfa1cd7e4c65de3177a7254b5d1bce9191b099dab5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
5c859d9288a60d235b3cad2c36ab5670

SHA1
e51cad875defee4028accce6de5bde1b6ca94dc6

SHA256
3f28f1593628cfb46518b9252683e3a8b0bfb921021be4c6ae413f114ccbb517

SHA512
24c6cc4268ceff420cc3026217c35566680a05e584498278e7c479a03cf55f8461135c607a849600a117e1d59719e7eb6e289087575689556d90ca0a9671ea8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28b933fabc5e44597f65f1982f7d2271

SHA1
56aebc2bfda94befd92be58db7ea46b1205153ef

SHA256
95afc9da0cf98ec1f4f954288aa754c6ffa950f965ac5fd7a07566bf08b5e744

SHA512
e5b5b2deb08f8bdd315640402d7be25517b8efad65ff4323e08d6dd19b5e892640022cd0a0f3e3efbe84235efe3df7387c2da6af04b2e5521d85b1c4d06f9f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
305f93f76d8827a224b817992608760a

SHA1
51ae38878543fe99e2e493c0924b540c830af396

SHA256
8a3397263208af30c4d8f03224b70d9c3c55b94a8ce6dc2d5452f5f36a9f18a5

SHA512
9ad3c9170785ef72f62cd604fb22fedb916badd8af0693d35588f9c5f67de58801c29a0459bcb1014f86004643a5308dacfea750b7c38a83ce4558ab65a9eb20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
10736d1213cfa0290aff873fb50c7da0

SHA1
650560828254b25480cc9db89633e57b78260ac4

SHA256
75381956ce4d8438481d4e974f5fb25e1c96319d3ca19b10b43f1c41cf01c1ef

SHA512
e89819c84d46188d2a47e530be539e3a00e7493b139badb877daa35a73c430f417bff85c99b663ff967dd47e79ae6e7f3a82bb635b620749e710b3e466eb2247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581d28.TMP

Filesize
370B

MD5
982eba279e8ba65d141c2405291842a7

SHA1
d16ccc4f544624f05092b673949325f2c6cc55d0

SHA256
03f9c615518e374ecf3972d452be3d98c225dd7273c9bd2e337ed97f5fcadd4f

SHA512
ba2c2014f563e7994360a53ca09beb3a56d520056a73210626138291116d148f8c29c141d4f69df39cff10b0e444a78107870ca186d55b476181b4aca7d97b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f4ea79ac6e3ac1f0ffe33fa205100c8

SHA1
baa41570be3c5fb917036db9f70f28af3dfba48a

SHA256
ccc045035cc44298069d16ddac9cd3f0d07c10b1a81d5b00fd5aa567dbbcb1c5

SHA512
6119e14e088ac09317625990c37c871895fa2f39f757aae2e9f630dfc139e2642005617323e90a48c4c98530a2d400c588588e39eff1ff222ca87853645d1666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a9722c4c76c77157c77fb478a927a4f2

SHA1
9abc7f6cc1c794a4b2f3b23edf042c82e281248c

SHA256
05f90186d8117bc6cc64b296c98db6a46f57c55f54585860e38c751922ee9822

SHA512
a7d3b3ac4808cd0ba180ec0de5544f0dc5d1c6ac7bb30f6419a41a08dc2176ddd825ee08b45b920c71b0f3c246f811d8b4a68e402b4839168dbe173abcf8cbd9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 143987.crdownload

Filesize
78KB

MD5
12577cbeb8cf3114038cb2c02c0c5040

SHA1
bda03051d67a86a71aad0f1cafe08d340a3da878

SHA256
b0e3aa228fed561185f5a0a3a08996e5021eedec8c5a44d89a1c19a43a7c6ed1

SHA512
edfb2956b8426909e7e8054e9a14e7aeed03955c9ee1ae4a144cb8a29a550e42289d2b317f4db5d54dc4e6da63de802c4545514d1e1d82b40c457813b53e1966

Download Submit
memory/2724-187-0x0000028940520000-0x0000028940538000-memory.dmp

Filesize
96KB

Download
memory/2724-188-0x000002895AC80000-0x000002895AE42000-memory.dmp

Filesize
1.8MB

Download
memory/2724-189-0x000002895B4D0000-0x000002895B9F8000-memory.dmp

Filesize
5.2MB

Download