discordrat | hxxps://github[.]com/eduuvlcc1/discord-rat

Analysis

max time kernel
45s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2025, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/eduuvlcc1/discord-rat

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
548	msedge.exe
548	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	Discord rat.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1680	548	msedge.exe	84
PID 548 wrote to memory of 1680	548	msedge.exe	84
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 3612	548	msedge.exe	86
PID 548 wrote to memory of 1700	548	msedge.exe	87
PID 548 wrote to memory of 1700	548	msedge.exe	87
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88
PID 548 wrote to memory of 2308	548	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/eduuvlcc1/discord-rat
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa048146f8,0x7ffa04814708,0x7ffa04814718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,18277385906421336312,14532276198720813357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4572

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4480

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9204f6ab498c1827459436856a2b458e

SHA1
bae2642d8017d7dd0732e798a609f47189655c8f

SHA256
e87c9266e7e1690db6b093a107c5f43e30307548c6d50fc1d7e22f44d49c7367

SHA512
d8ab1aba97c79a2726cb1b7919fbf83f52ba5b757c43eeb56924f1128f4be46d2b1e4aa2b298c6c441e099b1ff9deaa1f66173bc85d938abf85f2de141a27ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1283bdf16ccf544dbd88fdcf9b0d2645

SHA1
404e1a59ad0555e7f0d1c2be5881919cb9766a7f

SHA256
e0253c83f6c7b7f2b570cfdab128d232e3471737c72d8007f5cd79394f7a24af

SHA512
2c279599b325ac3b7e3abc7cfd0ede2acce9f4a2016e3875f722fba8dee2a4443d22d94f0fe1a3f3fd4369c1a426b837e60f8824a26f20f9a3037ebc68c43722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
180503796b2745e01ee4a709bf9f906b

SHA1
f9ee81003a5127141250ba8e90dd53b0b915c351

SHA256
c04337a2ce875f311eea2b3410d3d4b632db4bbbb9086f699a0e71d36867ccca

SHA512
73b0077fd003d3a2eb548d8c3c099cddf6d67f7be555873547d12c77aaf0b532ac0c216f9bfca8b418562c8936c02661bda032e670001d5a2205fd745fcf7cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2887fceb959bb0f626eaaec698131d72

SHA1
ae0b091593a48ea804a3570eb77881f3b4c562ea

SHA256
c9cbd13de06e1af502f89fe9549502dd274c6afe4cbda0672773273b1f9883f0

SHA512
dc75d5fe088231387185d45e76b107f02b779ba8cb72666579129a0fd12a7be1990315c476f06a9614bc68cc3628c5fc6e12f0dbd4deba9ba3e402a812600e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b882426760f34fa3a14bcf1273126ed

SHA1
c3993a10dd685fccda860e85f0cb50ded3ccc8ce

SHA256
372f8ca6868ba6ec355769c64903cf69a41321ce4fcf7f7eece4ed4e6cc96e81

SHA512
8357bc231c5ccc97ffc57ebb93c9de0cae3a727f13dc857a0e8d9d7d625a5549d3a9512093cb01f7196be83a1651241647e4a68881933147cbf81514e876fa15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef90.TMP

Filesize
874B

MD5
7173db7661e0b46c39c85cc40e4f43f1

SHA1
e48ba13a49246f33f84ecb33e11fdb733b1b566e

SHA256
dba4f44011a6859f449903bb6eaac8b35a08f2608cca766250bf7f7973bb8142

SHA512
d7163b2ad28c59aa8144c1001e2fd957f4d5a8499be5f5d5da3e6f70ceb4aa696eb72a2610de5e0ed43f8b19a6b2ea284d4086c80c2be288856655e91b376597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8728994c6862a711fa49ab72bc3a8ab

SHA1
5c602a4c325ddf72fa37119bbdbb55d08852688e

SHA256
c63db2bab022739a373a446b611bd8ff5cd245cb78c74fc5e253993fe57ee15e

SHA512
03394a4d9605eb2299b69407bcdd84826b034b551c9047561a5f68b8d7391c2719dadf90fa56a4982f8bc68d05f85b452e4c6ee27105260ffce0440b03c06041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c443af29d5b40a58bbbe668b8a2976e6

SHA1
86c96bbbbaefc6ab7930bb36111522d7a4701e62

SHA256
9cbc4d37dfc72c086d51cb616c0356d13432f208f82c38adb20be232248e8160

SHA512
96d1fdb7d7fab0530a097a0707e946bc41019f99f93f8c0a1d0dfbf2a42816adf8d2d8675d98d6d749377ffe2874e61b573be1e951af90a4e9a38f7764310eba

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/4480-237-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/4480-238-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/4480-239-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/4480-240-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

Filesize
40KB

Download
memory/5196-241-0x000001FE66180000-0x000001FE66198000-memory.dmp

Filesize
96KB

Download
memory/5196-242-0x000001FE68950000-0x000001FE68B12000-memory.dmp

Filesize
1.8MB

Download
memory/5196-243-0x000001FE69150000-0x000001FE69678000-memory.dmp

Filesize
5.2MB

Download