discordrat | 20e11ce6a0dcdbc282d1bb7b4ed1e5b6e54eddda7e56413d10344cd78db51efb

Analysis

max time kernel
64s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7.exe
Size

78KB
MD5

d342164488b5574da639e404c0756831
SHA1

1896ec0095610935993935b1fa14678d729e3d12
SHA256

0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7
SHA512

0b9b76906bf6ec4e2868d3412df69ee77bef132ff2396c2cf802c44e909c53635bfccdfd23fae3b55560f4e83edacec529311f94901e6c23654e4f8bb8e62590
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzMjQwOTA2MzQ5NzAwNzIwNA.G_n8fU.DfbgmS7-yP4cbSNse2dBgOV4sXge7EKO5X8MBo
server_id
1332408693144420362

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
1856	msedge.exe
1856	msedge.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7.exe
Token: SeDebugPrivilege	2988	taskmgr.exe
Token: SeSystemProfilePrivilege	2988	taskmgr.exe
Token: SeCreateGlobalPrivilege	2988	taskmgr.exe
Token: SeSecurityPrivilege	2988	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2988	taskmgr.exe
Token: SeBackupPrivilege	5032	svchost.exe
Token: SeRestorePrivilege	5032	svchost.exe
Token: SeSecurityPrivilege	5032	svchost.exe
Token: SeTakeOwnershipPrivilege	5032	svchost.exe
Token: 35	5032	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1284	1856	msedge.exe	100
PID 1856 wrote to memory of 1284	1856	msedge.exe	100
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 1744	1856	msedge.exe	101
PID 1856 wrote to memory of 676	1856	msedge.exe	102
PID 1856 wrote to memory of 676	1856	msedge.exe	102
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103
PID 1856 wrote to memory of 4168	1856	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7.exe
"C:\Users\Admin\AppData\Local\Temp\0a5829c5c2d1ffb068abcffc0a6f808438a52cbb7e974445d08770428b96c7b7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd989746f8,0x7ffd98974708,0x7ffd98974718
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5558964938630508315,14861037653742977781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d6d3fdd40ec1226f2e5c0231dfa5ce2e

SHA1
ce0d9315e8ed325bef96bb70ac6f588bed0e4579

SHA256
f998260db38ba56554bb1cb09aacfd8b14ec85143421f08ae833ae542b719afe

SHA512
13141aed4e27688b1b956e839ad980c9277024fa01f4dacbae76a5888af56f1013179d814ffc934c33a5547ce00232c87a84290b424dc8cd8a95f2d2d5e7a010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
331B

MD5
9abe554d954225aebc97d82e2ea56ece

SHA1
5a706c18b3bda10018d6e8eb4cd89d5bba17c1b7

SHA256
4029a7b475037230805a9746033559e62b77c98048609bcf01b6f0fa70beeec5

SHA512
16161088aef53c478e251bdedc463ee1144dcd2b2522adb045a3e77272586561995b18ad191e365a1f6e26acf1872ec42b4ab04f7b268e9889280eb295fbc471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06c2a7cc4d8b323f8f14b4d594a58adf

SHA1
3fe0fc9c6bbc843c6e5779698e27cf3c3bd04011

SHA256
d6d797a216b507605715a2093f534f29a106df95848e0649ebbca375a1c654d1

SHA512
247a467c06d4caf5d6477e88c6c22f17c0d4aacabc65e10f5b0ad067e21e272cd2be52e6dbab19141edada5231e70c640072d579743ad93c19aae10236067eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b522c1519f7490b239632d1430281d5a

SHA1
15fd632955670927af574d61b5feb2e2f47c16b9

SHA256
8717f1ec60796dc5853eea73b6f4b6528a7e032c0e22b2dd5d08656288a192d4

SHA512
8b18f75d678bf06957d45fb4a550538856bb5141508d1d6326b3ddf286705790a0cd5985b9793a970abbde1d51a00ff8508240a61ecf1b0a6330ab82cd2b37bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d221217294613c05c241f67fa77c1d11

SHA1
0e0df91717ba75df71afd4caa7a1363d19f0b39a

SHA256
f3692a7de5c4a2c618e1fd5a8f3069a26e2a9ecd688d18f18cfa97227174e2c2

SHA512
ef48253c7f273a2d3fc695815b6ad7d3f03f45a90529edbdb100305c9341ab0fae39b37bd3872c190d47c9661d8190d5ffededdb15a6724ce0598bf496ab2f59

Download Submit
memory/2988-241-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-242-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-246-0x00000196D01F0000-0x00000196D0200000-memory.dmp

Filesize
64KB

Download
memory/2988-252-0x00000196D0A70000-0x00000196D0A80000-memory.dmp

Filesize
64KB

Download
memory/2988-239-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-240-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-243-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-233-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-235-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-234-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-245-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/2988-244-0x00000196D0260000-0x00000196D0261000-memory.dmp

Filesize
4KB

Download
memory/4180-0-0x00007FFD9EE53000-0x00007FFD9EE55000-memory.dmp

Filesize
8KB

Download
memory/4180-3-0x00007FFD9EE50000-0x00007FFD9F911000-memory.dmp

Filesize
10.8MB

Download
memory/4180-4-0x000001B59C6F0000-0x000001B59CC18000-memory.dmp

Filesize
5.2MB

Download
memory/4180-5-0x00007FFD9EE53000-0x00007FFD9EE55000-memory.dmp

Filesize
8KB

Download
memory/4180-6-0x00007FFD9EE50000-0x00007FFD9F911000-memory.dmp

Filesize
10.8MB

Download
memory/4180-1-0x000001B581850000-0x000001B581868000-memory.dmp

Filesize
96KB

Download
memory/4180-2-0x000001B59BEB0000-0x000001B59C072000-memory.dmp

Filesize
1.8MB

Download
memory/4180-258-0x00007FFD9EE50000-0x00007FFD9F911000-memory.dmp

Filesize
10.8MB

Download