discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Analysis

max time kernel
1289s
max time network
1329s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE3ODY0NDY3MjY1OTM0MTQxMg.GBL0VX.hLJt950Tw3kAXvkzecVPnmkBZdB6z31D-ULof4
server_id
1211651163519189044

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5948 created 616	5948	Client-built.exe	82

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4884	Client-built.exe
1728	Client-built.exe
1388	Client-built.exe
1156	Client-built.exe
3428	Client-built.exe
540	Client-built.exe
5948	Client-built.exe

Loads dropped DLL 12 IoCs

pid	Process
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4076	taskmgr.exe
4076	taskmgr.exe
4076	taskmgr.exe
4076	taskmgr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs

Web Service

T1102

flow	ioc
227	discord.com
238	discord.com
239	discord.com
343	discord.com
349	discord.com
351	discord.com
352	discord.com
224	discord.com
353	raw.githubusercontent.com
346	discord.com
348	discord.com
350	discord.com
354	discord.com
236	discord.com
233	raw.githubusercontent.com
234	raw.githubusercontent.com
240	discord.com
357	discord.com
223	discord.com
241	discord.com
243	discord.com
355	discord.com
356	raw.githubusercontent.com
235	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5948 set thread context of 4820	5948	Client-built.exe	166

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6016	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133534242068509297"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "6"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000a1fba794b664da010f8d6c75c364da01440d137ab168da0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
3408	chrome.exe
3408	chrome.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
2576	msedge.exe
2576	msedge.exe
544	msedge.exe
544	msedge.exe
2188	identity_helper.exe
2188	identity_helper.exe
4076	taskmgr.exe
4076	taskmgr.exe
4076	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3912	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe
Token: SeShutdownPrivilege	1832	chrome.exe
Token: SeCreatePagefilePrivilege	1832	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
1832	chrome.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe
4720	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1152	1832	chrome.exe	29
PID 1832 wrote to memory of 1152	1832	chrome.exe	29
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 3876	1832	chrome.exe	88
PID 1832 wrote to memory of 4028	1832	chrome.exe	89
PID 1832 wrote to memory of 4028	1832	chrome.exe	89
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90
PID 1832 wrote to memory of 1244	1832	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7fe19758,0x7ffc7fe19768,0x7ffc7fe19778
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=840 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5452 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5592 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5740 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4932 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5772 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5820 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 --field-trial-handle=1908,i,10305803470201062464,4434128238292779019,131072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3912

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5420
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3564
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1168
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d2b3d3bc-a94a-474c-9040-1c2cc0f38744}
  2⤵
  PID:4820

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe"
1⤵
PID:852

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
PID:2140

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
PID:2472

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:4884

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:1728

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
PID:792

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:1156

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.erome.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6e6846f8,0x7ffc6e684708,0x7ffc6e684718
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,10520416560211515428,16633384265053398965,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3832 /prefetch:8
    3⤵
    PID:5560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390 0x470
1⤵
PID:5676

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4076

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5948
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\Downloads\release\Client-built.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
74cba1005e7760b62f00a9b71d69839c

SHA1
27731d1ec9a683b0a635ddc060f3a98f6eb2be07

SHA256
e6d64281d3c5f05c6ff4c8ccc1fa16e27bf47f7bfbb762faaa5bed028da50dd2

SHA512
0196c2ad783728ff07ecae9d95145049ba4c6b768eebfdb4bfa78b0a9f9c0a434985b4e591b2abbf9cfe85469ce1f0bc6613b61291c415dc93d65823ce26d527

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7dbc1d36a677efa267aa77e5bab8a99b

SHA1
ca71bdc489170314d9f5f51d914cca88396176ce

SHA256
f329b4b210938e8f350e510b2bf6330327bad40582c281c641bc8dbfd255e4e3

SHA512
06c6e69a09125ad1bc914773747146d27c03127a2d30b1cf739d64e9b9f76bee229a8a0cef3201fc71b4f469a2368a4188f6de8de9ad3bf7178d17b9cd29b215

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
da71216c0f723bea86dbe2cf8c033258

SHA1
063407944d482b35216fb3aeebe3e0a6a1e987c6

SHA256
74b51ceb90514e7ce5deb18282c1daee8cf59f8efc3128531a50e3bc3eafb410

SHA512
58ad3ef41704a65fd4c50d66b9ebe8e63179e0bfdb8094c56b011253ff46f4543090a16943bf2b374ba15caeb48faceb231b8f44f16d58968b44379d4fe551c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6f782ec0-e1d8-42ff-928a-604b92aa0f0e.tmp

Filesize
4KB

MD5
575f8abdc1b5a553c17c38fdb995f3d7

SHA1
1f82e62ee4337ecb21db073ef4c40e46acf288bb

SHA256
2443456fd4741b3e9c495ba7b2a94f25d1ac388bc55ad6c5a8f9792d5ecf8e19

SHA512
bace3b57b093d38fb48b65a477fc86668ff1ab48d5f9a0b397f4dcb64e8afba2b327beb79aebb149737aac12c0582f2050f742f55058f295da5286c960c2e49e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4a98d17d0bb729a103a15d771a0da416

SHA1
38143ac5bb3fc7f80eb99033b8d48d22ac5c676b

SHA256
8c9c24e3180f190d3f77ac2b71fd291c9b6bb035fd76d177283d13fe44525945

SHA512
75e2a004e2cdb3067230e35a44fe070bbcff77f3447efba11572842e349ec43367ca501c0244830d5537ec4e10b946de4de860fa1a4e6cab5986731e3927d56a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
07acef6180079f18616fe2c6ca829b58

SHA1
9c1705cc3efb2ea93601b821c53c48066d978636

SHA256
08708e60ce4241bc454d9613f1740ab0f5f89e53d1fbca962fb6a17dbb9b9c71

SHA512
c12bf2fdbc88de75837473cac9d140fe4621d0b38f9ba5e7ab089374e62ee1328318fcce6e559d3347324c95e714536476c269bbccdd5552e2590f65a7a79ad4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
038f3f0195c6dd7038359e9f24374906

SHA1
3bab9dd1c3d47933189c527a309d28c889ac2a0f

SHA256
947e45a926c9a99b6a4902ba4bc2dcebe8c9babcc5aadabc54166c457a9174ae

SHA512
53309a4f8369309ff47f42ae10374377429251d57a76ab264502f1c025ba40d9022a62a083ff33c07340133cd7d587c5e5e8ddd97c8173ddf58fb87391ca7df8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
bc7010cf274a237e3ba47ef3e668901f

SHA1
7ac49ac5a9764a0c4a0ffe6ce35748eb91599323

SHA256
7ea6fb7847604c11028d4f7a510381319258e0d617cccc009d2664dcd5b6d9b4

SHA512
ad78e37027e67cbdbf306ea498f4b2cb134d2135d2daf9bec35e95d5b8e7a355c4a107d126b108f1d53a574d06243c5c6e559ea21fde407dffeeb942b5b544f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
0bcf53f5849e53f2ff3f2d33b56d60e8

SHA1
4c802e748a0deb4d6012fdcb12d77a15a1411f9b

SHA256
0680ca82582b82c125259d3c0eaaeb7074ddbcabb825f2814664d74f61bcdb0e

SHA512
31cf5d6289a9868585715c536bdbffa60d83bcbb0fc0edb97962aef0ab8d1aa5755e1df10db3536acb1b705bf414e7e14c7fbf27c03fdcf170f432ba48463f3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2441cb12472534e83aa48b0c26fd648d

SHA1
6a2a404fd327538a33973bc3d339a9de317c323d

SHA256
770848e66cfc746141aa3d5aba6591949467f75a8675a537e38767dd725b5230

SHA512
a82b8b5e1dd32771807e649e994bf5aba15914809055cba0fd4bf6dd1a0e228248697ecae5cdf82e857d7fd36a3bd91e6b43ba086c932965937078ea0214d2b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
482c21b2cf0c60cde8a4c9478178a3b0

SHA1
90d4f1bdc6ed1be14ee3c4b2223fdb8ed34d7fb0

SHA256
dfd40a8ed716b9d4af2099188e9e366ecad8eb81b96aedb011665c1ed854216a

SHA512
31db5b6d792434e302e5a6aeba1a6e927199c116157559f0c633294014d711e5679857e423ea2d026599e30d4a0763a9827d0113249de3862dc9aa45bd40d75c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7042e4b6a8448e4aa8971e9be9d39bdc

SHA1
1c5e254be14c7f5af9b3ce5ed67ea1110d678553

SHA256
90a1d83834a22fa8b621f9e7c8508abdb8793ee76f16ee6f1c140f9865600dbb

SHA512
fcd790e977b21da615a0682e5a24ad4c2f229a233581a37a27fd55c8761ea99d0b1d220b223e2ef650ebcd408d454dae4c35c67997724715206ccc7a0d2dfd3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
caee6a6001cdec27b15ec85300b746f4

SHA1
7193a2e64b534ad3e1d62ee48f87462cbe0644c7

SHA256
04dbb8203f87bb498175ed8c0bd64b87f96bcd6ccdd1d2e10fc63fe255627f07

SHA512
936c390bb2ad5c5961ebd3dfc6dbb7a12da1334fd03bbe4edef62a4627b87c790d6bf77e83e1faac4c63153dcea229017a5545717875cc41f783d1edce6dfbcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ef43d187edc4e4eea42b79b7aa7c2f8d

SHA1
701451ed96c437ed488651ab2f5a8fcf7b9cdac0

SHA256
111d1a0e6cba05dd30e263499a3db731c24df8d2db6697f9d773ba1883e163c0

SHA512
abd32fa79357b2b8859a0550a2141eeb1fd853b83ef0afbe29f6d0e2fbff00189cc1a3647ba8ac66344878da43c8c6b30172ba5b17e154339e3850e56e304e9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f48f7751086f4c24db87668a9a445e8b

SHA1
44a49ffbcc104ce1559d67e81c6fa207527d573c

SHA256
1cd3b3b33f16d9388e442fd3ea6dc6f3540dc9c6c4769efcc5b3d9e6e3f73afe

SHA512
ca9d67657fc842fdbd1f990f8840e56c5cb2e5e5ca6e1aff1bc2077317109ad4c85012f1b509a18807f5cfdd059392f05565687a7e57ceabd92a3c5b71554284

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1f513b9f45c0b21e6b42b0a02e7dfc67

SHA1
851063b2db27fe00c098d26ad9fba2a6ae100b3a

SHA256
39ff434265a08f776cf5927209c27d9d156c92ef95a470a952a5fd82b46f0520

SHA512
5451849d746dbe8f9f4bd5969e40ba9f9299235913c0faf4389d7ee196751a3d522367c175f344521b444896b703fc7a09e19db653471d94a67a66a5bedb546e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8d19bd9919dca1d9bccbfa6a8163ad32

SHA1
8c408c7e23afa89fda14f71f43dc36b5f709a453

SHA256
667a9b3a670be33cc0c15cafc9cea8795ff205df6a0f6731ea06e287bf1be95e

SHA512
51b91dc3764541575eea23a4c22680d940de8ee1ed95e7496093f8a066c19b9204136567ce3a8933c7505d63583a2cf838fc57c99857f8d4e843681617954c59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fc6a031fe4910a6b6fc0705e22fdf8bd

SHA1
bc9165e6b556397dbe73b73fafa662f37508d6cb

SHA256
ef5a701f8dafec4738806add314dd2af8075ba48d5bb3d5e0b81fad9f714c6a4

SHA512
bb18c37f9bac6db7f0b72162df9f5f235faf46fee6be6d16eb79474b603e55c02f77386b068ebb1c91f6ad3fc34be43afc2b7f0a403521503e6b9d054edefc69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
de0d7efb3992086c9186b8afed9df2ba

SHA1
ec7119294adffe47564d366e252483d5cc0c2f3e

SHA256
2b94101d741af997b3da400597da087c622a1636048e8a45b9a35b6eeecaf687

SHA512
6cc0609c7a9083e4139ec485b0d65efee52941a7433c36dd9907c2cb14cdd1eb9c4825240a2e1082dc5a016b16e27cc7c0c21eec7004a872cec62a69afd24dae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
df7e0bfca93714eb40134328d21d7adf

SHA1
1b9ee8bc9eba269e45afd3af518ed69c645dbb8a

SHA256
b6ad544bf0d5e443333a6e84e7201cf78b62a0cab96594418de644b1f439dfe2

SHA512
75f0a781f7881535985fbf5c7b5b5d81dd820910625450bb2400398bd81aea92142173836d189bf0e7d828b042ad1e67c7502f10b3bb29983e6d8ee1c86eef75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0bcc99631e885aa6da0a3954b38a4c2c

SHA1
56c54a34711ce447c00b96e648d146f6570633a5

SHA256
10009ce828c71e0772210d6c4a3bd823866625b4048899557dc1c3496f2cdaf5

SHA512
91e4e4910f7bed9dd9db9e5fcedcab6e2d48398019f23c22e4108b3a103524fba65e618e5faa3dcf503d91d39d52e5b5e2d6a33cdf132c8a19229a6f6c7468be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5f699cf105a6e8c5516a9e4b45f4d1c9

SHA1
4131af6e9229ea253a375de0225d4fd9dcfecf6a

SHA256
8b89f7a9ad51f54a7e5c0261866e8b6c8b9ff3e2dbe3a4f69639ff1dfb8c41eb

SHA512
af12b942340dd4e9fa6e56009e68bad4b437ff97c31773770f4adfa5aafab0d14e33a2cd660b1a17cf8cdb6ea5365be9cabe2e985b5b30626632c799f2a9269f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a14e196959dad3a23b24909fd4ca1d66

SHA1
e413250c5b1c20f918aaee54f3e352482d4b842e

SHA256
7028fb22c0965a8677ca4c15a5397cf39afb180abc7e6b30e5c0dbce95c4e1c2

SHA512
137f9ec12c88632096913066d6bfdd4febf49e09e81122eec19b541f37e9c93476d21dd7760ae48ccc0614f2e4468e274f72688cf77ec84ab4c61d7c0862d226

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6244569bab0a2e7e42aedb4786514015

SHA1
594ff37b32d67acf05320bda8d4cdee7d6da087b

SHA256
a4c7d028da4b3deabc23d49192de28732ed47827e94b2cddfe6e0def36d8a411

SHA512
ef5e3878933ed2239c43279c1551eb07a87986051bd551c1a9420ce44d9a7b7be07adc042b39ff050768aa6b76725321c11d2ff6d6399ad788c931ccc2b315b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d6cc33b1c3989b086100ead1e6f9163f

SHA1
6af24f38ae731af65c29e706ffab645707a9c3fd

SHA256
69e1354527eef07aece272a1f29a65f03d4b667562f1da1bba3d64905cabff06

SHA512
661cb39342dda82352177abee1bc27059bf72e6f17d732268b8179cc3860649bf13ed89c58bc1f7a2ca39fbcb8720c7949644d64cb5f81155377478fd906c6d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5e0207f3411f96fbed89c3135480c470

SHA1
8d2af22d47957fd9ab5eef82f200a4044e68d396

SHA256
41b090128148243c0085eb9db1d66ddb932d8ac93e54b4ca6e9149c55b13a8f8

SHA512
392ef5cca04f0a0a2d0dd8cbbed5ba06e2c37aff28a011faaa3be3b268a48c2360f37c588a5b46c3856c6125cdee2e3740ddcda2f024ae44a02915fcce0afec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe64831b.TMP

Filesize
48B

MD5
f675e7dab743bcd0f57030348c63b978

SHA1
554e95dbf646ccfd4956787dfbb1658ba651aee6

SHA256
b4d6c780db913a9b63315317c764efd0665a32c13ee13c527c8f416e9ab5ca0a

SHA512
6842bffd97beaa6add6972d0f09bb447435c38ea4dbebcc158f76182b5b62c7909d80d0c08c6c04c46b635142ba2bf53b94a83c037662c2b341935993523100b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
5e81cba9930faba81763b833fc01c780

SHA1
be120c93cc1bd3c17d5265e94090028b25e07ff8

SHA256
9c8355cba2ee537c3bacd2b8c400890269ee72bdaf83c86f53a8c4013cd64c0e

SHA512
5f668fd94fc349a79fd1e4d3dca65789b7414aed99622b3119bc416c6285525dce2d6f2e6a8360f9089442723eb6a41a1f3732d0558301115de8105c4c589493

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
e025b16621db3c491b291b224cc2e381

SHA1
14d3d6437b45fb073a51b3ed1a2ad9b3264d3bc1

SHA256
3fdcb72d85d7b4a8731301bbe0830976dc192407158b4ad956afa7e11cfbb759

SHA512
67f0e85f4ed607d5d8452bd852941291bf51d651662d2bcf015157609e4c0d6763e710f2abd312875059d99f1934eeb32b282e265d889c44f8342874c568e73a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
f86055bc822463ba44d0259c5554837a

SHA1
089fa98199909e122cf108317f9bfe7531697773

SHA256
997811bffc766984fbc709f31d0e4c490cb84d73b457871f2b83de5fd963ddcd

SHA512
865c998fbc799316f4b29f28ca126db58a013ff31c26e9bccd995e7c18d83fef189d3dd10385e77c20043d4a5ec013bf103d53f3a4c70f6f2e44fcfef805d6f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
cb351b2f89c378ec15d5ffaabec00501

SHA1
8be883aec08f0362ac9d1d1af67e369d355dd145

SHA256
02f028fd7f2054dc56e7089d3ead283b467ae8eac816c84a037300cea0645062

SHA512
d272a73d1c2f343a975df4a2d3764197709cef640fa21826ed90bdced823f376012a1d302c7c6990516d742cc43b119251ed1b15f6cc3323d4dbcaa7de87f8b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
4f87b8ce9c0e10ce1e71b862ce6441b3

SHA1
1f6402cba21331cf440975967c409cc799eaa156

SHA256
d54b21ea0aa4177188a7e96f328d482c4807004a31466cf07378e3542e48e783

SHA512
636e470b2654f1f25097e0c811eeffd9b6ee5f66405e1eb5f2dacf2d52551ead88a8a588bbd7ce70c1eb63d8619cf430006657abf1e7b6205bef05c123a8fe6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
132KB

MD5
e82410f8975239888fe6430fdc8cb774

SHA1
1f9bb9d805866122415ae61fd1f9e892d6a6d5c5

SHA256
322762cd2b549de26188149e207b611b0d557338ddb72fb9b62e6dec5c92c84e

SHA512
afba4b50677b119c6b0da3bf0e112759ea1145b6259255bc65d0ca188aab666b243b5bb89cd0d9f8cea85f6836e84f2ac50a0f939823a5c379d8680bc38bcf6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\builder.exe.log

Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7213c4f8b0be44d93d2563960c0030bb

SHA1
c4dcd474f1c9462617268993a86670132248e159

SHA256
d3f9760d9ace933806a73727fda2e010684052ca0ff2bb261d46b1256337f46f

SHA512
f9c1410a9f04cbfde23c4820b1595c7655b8dc76e7905063f68f8eb2dda3f15f2b44212d1cf21967ed6be5cc8de60db184e311f6614f3dd5fab47bb4c093baaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cdd1e120f29246457ad41e554313fceb

SHA1
1ae3ce4f69d5edd8005677c22bd64b7ed04b9845

SHA256
72a2c2b568be14501b12129115e01e6721c6212cdc9ffe7443a9950878e0cbdd

SHA512
66dc1d6c850275ad44aa3d8b1f9ad24eed3177c103c56df136df9ed8bd523821cdf0ba6263ae80f7503f8dbb10158675cfa560f6e2225254086c4e1a74474bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
789c1c86cc290ed735b72c0c0dfed48b

SHA1
c5053bd9bbf2ac482fa897ef463c585870b3bbd2

SHA256
5915f9371de80e9ebc519f159b449c1c418daa1cf107b62f2bb56d1ea851a816

SHA512
3b76dea7b2f0b30c662dfd32ac3e06747f5fd5b8fb6bf3f173251d76e5f31178d6c6257a48a70f8f7e7b5d0b0bf56dd192b9466e6dc094caefb7a53fa876796e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bcaf3a35b7012cccb093c40d7d10e8c

SHA1
e76376592caa2588a3f335fb3def40c180f204b1

SHA256
fbf55df3e001f40c76b56fa5fc8f11243f73f2cc5cef35b354c53f793130f25f

SHA512
faa2495848410d555326557e89c2085919bed6a11a01ccf16020ef13556666127504d66b59995febca18fda779db13f42bc0f2c3879d707f7bff4f006fb47f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d15c1c5256d61eaa580028a66cf13fcc

SHA1
f0404f81c691c63c4316d01acf4cf3053184fd4e

SHA256
5c525896f1cb9468caf3497d5df21a56bbe071d69faf8c6501a6f5c7ef12819d

SHA512
381e93df8d3d5fb16b9a405461c2fe52096b96339d3ee0be1653f394cc1be5ddb0fab9fdbc95e7f3d0b50e5a8a6e5c47288151d83f2ac248f5575547cf91a2bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\37da4806-fb65-49c0-abc5-d71f4b9ceff0\index-dir\the-real-index

Filesize
72B

MD5
33487ed8e1cc727dfb2a7d08a3ed5a4a

SHA1
ed3109361405979f41e4c4a973493acc29194546

SHA256
5264fabdbcb8f8740ffe64b91fe117fe23122cc907277c54147029eaa973547d

SHA512
5b7a47361469c9213bfad6aa523f2dd01e2764499202e96ebdd04bc957d663562cbe1e999b9555299ed5992457ddbf95c7ca648c61acfa974bded5ae7762eff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\37da4806-fb65-49c0-abc5-d71f4b9ceff0\index-dir\the-real-index~RFe684d04.TMP

Filesize
48B

MD5
82f47879830c17a870044768c840cfaa

SHA1
a82bc0e848ed1197322dc3563b1d0365bf9ff10c

SHA256
ef692609b7e8c11272e4de0a521b2b4787b10e79e26dbb806b5aec79bc53ddb0

SHA512
1698643304324fb2e44afd2a90f508bdc9252c316f3be9a8809d44b343c5b28ddb5613764c2307a08e2d08bbafd7a2a99eab51d7de4ca3d4eedf952f4572f933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt

Filesize
103B

MD5
0172ebec15e011920246b113162c1626

SHA1
3b091821c930652a6fc75ae478e5e248d8fe060f

SHA256
e9404717a6b7cc40a5619c78dc6cad303bcec1eb1d6d205d3370ff0d4b60d27f

SHA512
2269ac4e86126d9492f8cb39a8083f5f0279d354174c5f7651c828184f0cafd03e8b0d98966b485f23c675a3a5149f222b41c2c775eb12373c05b04c3d792567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt

Filesize
98B

MD5
56f6f5c03423a272c8001e8ddc57e6c5

SHA1
19565525aedfd3ae04083f7b2e7fbc54db5f548c

SHA256
e7b0a31ef745c37fb6648b50327056f4be3f24d206f479c15b7c3f1e68b90700

SHA512
399bf1752c7a1589cac7fcc861a445249087992433ed9b12b84ffbc6e808ad5952a9f48c7826546646cc6cb7321a2c7675e1dcd2b2d4557dd9ddbae37c101d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f25133681e799e2f09ca9a8cafe28ca3

SHA1
60cc4d47af312b769142deda93b49bb56ea22188

SHA256
b2d585fae141c744fef183467e4d4bcaf7b882ee698349f3b307ef6e81dc394c

SHA512
e34d23339f48335ccecb3734603ed597dd5fe7564b9a440be885755f06e527c4116911f932faa49581c52f4624b2a96698e050049a0b4e388c581f0563b2763d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe684d04.TMP

Filesize
48B

MD5
95d46a7b5cd015fae05fd6ce0e9ed369

SHA1
50127129c311a6c5a91647445348680ca7a36b68

SHA256
52bb287e97da63d67fc039550d436cca55482174d8bdb03d36c76813b311d4dc

SHA512
6a0667509a151a1dbcc8092637e85083d6666cc2d904c46875e48fddb2a62e7166e949ea13310fc8b06d70bd8862eb49c9586382aa8442e87a8357cd167a10a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe684d71.TMP

Filesize
539B

MD5
c4ec58b338388d3f10708f15138e85f8

SHA1
d4b5b8231bbdcb04684977efe6ff747a546c5c81

SHA256
a9830f4bbd14515f6ef7c48253ef281c334e09c335425312a708d57d92d51aca

SHA512
6fefbe1f069df21752df441cf9241c81354b9c991cf542bdf1910d906db4c854f6c3d3fd9e391336f7a08656a35952dfbce6c65fe4ba5dadf5fe4847a01c9b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a35875c1-e387-4888-822b-b9eba9a2bd2c.tmp

Filesize
707B

MD5
aa4b3f89e89a04128ae72b7d22f2534c

SHA1
f36bc6ab19e60075cfdf4d71a42f56c75ee3e399

SHA256
a0f397ff3138d314ca89357dfbaae50a26b015e422dfc1129c5417fc76e9963c

SHA512
16b122353f208ca46835eecc8cb2c7ae6a214aaab0731d78d5106fdc4ab1f6b1a5f1d1b3044eeaf2f6dc36111bea85db0cd058d77991417b881d642b2aec3739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfe12f370d2693a10bbd67a438dfc645

SHA1
ed991de3deb2bb5a64f6745b8d33af38570ccd83

SHA256
2836fd8d013996c7df67989c0f80feb05bbf4b8f450ec05f24a9ed0cbf4f8339

SHA512
234a86837ee6858d4f8a78297b60024f32bdd99d022fc00fde6ab1d46448ce162f2cb325e871fc4fd46d64653044ea41e13750dcfb86375b2dcacc9b3a41cf95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
04bd93dac4612ca5a763739b238f3da5

SHA1
7fdff8792a5d8bf92c1f802d561b0a22effad3dc

SHA256
1e23344f4a5595b28695946c49093844e176a1e206c0e9851394e1530a149b65

SHA512
3a23d490f51eec7323c2faa7fe9fb1bb2fb3814d571390b1f5d6358ace85d3c2595e6219f8968d3d14058b27940c535b4c9c2acfaa47857997e2e82becee4937

Download Submit
C:\Users\Admin\Downloads\release.zip.crdownload

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
c71bd69a6afc1ee7684bdf5ed28c16b3

SHA1
49237c87a6b42adfd0a849cd9608440055df7175

SHA256
b0790ae7744942f6a06b17319ca51c734c30ad903f30e8946da7a07c65f41b39

SHA512
0f4c3144d42288066bf5a2a8e4038d2996e1cc5cd57fb207584d0974ea9ae91c45036bca7c21cc33915f30ebe42e19021d5057f8fe842df1a928f8d05cf7d59c

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
d880dcb7c82555596dfb82f6fc5da786

SHA1
16f5e2c9f05a3350d9253629e6bf43e87a481a9b

SHA256
99a704cb15d302c4719b3da722677f09406aea0e72119ad9aa21dc115fc551c8

SHA512
9d9a2ff622e1ec49d30f461f61010bf2a571f13474cfea224551c9c440143569587f9b77bc69bd9cf1d32697c29e485cab2cfeda1af652b8fd896a31ca4087ed

Download Submit
memory/60-1371-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/60-1367-0x000001FD25910000-0x000001FD2593A000-memory.dmp

Filesize
168KB

Download
memory/540-886-0x000002507F900000-0x000002507F976000-memory.dmp

Filesize
472KB

Download
memory/540-882-0x000002507CF60000-0x000002507CF78000-memory.dmp

Filesize
96KB

Download
memory/540-883-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/540-884-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/540-885-0x000002507F540000-0x000002507F550000-memory.dmp

Filesize
64KB

Download
memory/540-887-0x0000025018560000-0x0000025018572000-memory.dmp

Filesize
72KB

Download
memory/540-1338-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/540-888-0x000002507EBC0000-0x000002507EBDE000-memory.dmp

Filesize
120KB

Download
memory/616-1355-0x000001D43ECC0000-0x000001D43ECE3000-memory.dmp

Filesize
140KB

Download
memory/664-1362-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/684-1375-0x000001FF36C90000-0x000001FF36CBA000-memory.dmp

Filesize
168KB

Download
memory/684-1377-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/792-325-0x0000000005A50000-0x0000000005A60000-memory.dmp

Filesize
64KB

Download
memory/792-324-0x0000000005A50000-0x0000000005A60000-memory.dmp

Filesize
64KB

Download
memory/792-323-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/792-313-0x0000000005A50000-0x0000000005A60000-memory.dmp

Filesize
64KB

Download
memory/792-312-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/852-212-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/852-214-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/852-220-0x0000000005B70000-0x0000000005B80000-memory.dmp

Filesize
64KB

Download
memory/852-211-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/852-227-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/852-213-0x0000000005E90000-0x0000000006434000-memory.dmp

Filesize
5.6MB

Download
memory/852-219-0x0000000005B70000-0x0000000005B80000-memory.dmp

Filesize
64KB

Download
memory/852-218-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/852-217-0x0000000005B70000-0x0000000005B80000-memory.dmp

Filesize
64KB

Download
memory/852-215-0x0000000005B70000-0x0000000005B80000-memory.dmp

Filesize
64KB

Download
memory/852-216-0x00000000058A0000-0x00000000058AA000-memory.dmp

Filesize
40KB

Download
memory/960-1370-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/960-1366-0x00000271B77B0000-0x00000271B77DA000-memory.dmp

Filesize
168KB

Download
memory/1040-1383-0x00000239643B0000-0x00000239643DA000-memory.dmp

Filesize
168KB

Download
memory/1040-1384-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/1088-1390-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/1100-1394-0x000001D5C68A0000-0x000001D5C68CA000-memory.dmp

Filesize
168KB

Download
memory/1100-1396-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/1156-329-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1156-351-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1156-332-0x000002016EAD0000-0x000002016EAE0000-memory.dmp

Filesize
64KB

Download
memory/1156-331-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1156-330-0x000002016EAD0000-0x000002016EAE0000-memory.dmp

Filesize
64KB

Download
memory/1180-1397-0x00000270458A0000-0x00000270458CA000-memory.dmp

Filesize
168KB

Download
memory/1180-1399-0x00007FFC4E6D0000-0x00007FFC4E6E0000-memory.dmp

Filesize
64KB

Download
memory/1208-1400-0x00000244292E0000-0x000002442930A000-memory.dmp

Filesize
168KB

Download
memory/1388-309-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-311-0x0000020D2D530000-0x0000020D2D540000-memory.dmp

Filesize
64KB

Download
memory/1388-310-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-354-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1728-307-0x000001E471260000-0x000001E471270000-memory.dmp

Filesize
64KB

Download
memory/1728-303-0x000001E471260000-0x000001E471270000-memory.dmp

Filesize
64KB

Download
memory/1728-302-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1728-306-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1728-348-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2140-268-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/2140-267-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/2140-266-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/2140-265-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/2472-282-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/2472-270-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/2472-284-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/2472-281-0x0000000007370000-0x0000000007492000-memory.dmp

Filesize
1.1MB

Download
memory/2472-271-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/2472-269-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3428-373-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-1339-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-372-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-374-0x0000027E6B2D0000-0x0000027E6B2E0000-memory.dmp

Filesize
64KB

Download
memory/4076-1324-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1323-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1322-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1329-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1330-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1332-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1331-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1334-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4076-1333-0x000001B9C2A10000-0x000001B9C2A11000-memory.dmp

Filesize
4KB

Download
memory/4720-335-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-340-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-339-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-341-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-342-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-343-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-344-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-345-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-334-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4720-333-0x000001BC5A2A0000-0x000001BC5A2A1000-memory.dmp

Filesize
4KB

Download
memory/4820-1347-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4820-1348-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4820-1352-0x00007FFC8D620000-0x00007FFC8D6DE000-memory.dmp

Filesize
760KB

Download
memory/4820-1353-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4820-1349-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/4820-1350-0x00007FFC8E650000-0x00007FFC8E845000-memory.dmp

Filesize
2.0MB

Download
memory/4884-287-0x00000286D2CD0000-0x00000286D2CE8000-memory.dmp

Filesize
96KB

Download
memory/4884-290-0x00000286ED770000-0x00000286ED780000-memory.dmp

Filesize
64KB

Download
memory/4884-288-0x00000286ED3C0000-0x00000286ED582000-memory.dmp

Filesize
1.8MB

Download
memory/4884-289-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4884-357-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4884-305-0x00000286ED770000-0x00000286ED780000-memory.dmp

Filesize
64KB

Download
memory/4884-304-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4884-291-0x00000286EDCB0000-0x00000286EE1D8000-memory.dmp

Filesize
5.2MB

Download
memory/5948-1346-0x00007FFC8D620000-0x00007FFC8D6DE000-memory.dmp

Filesize
760KB

Download
memory/5948-1340-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/5948-1341-0x00007FFC6C2F0000-0x00007FFC6CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/5948-1342-0x00000253D7320000-0x00000253D7330000-memory.dmp

Filesize
64KB

Download
memory/5948-1343-0x00000253D7300000-0x00000253D730E000-memory.dmp

Filesize
56KB

Download
memory/5948-1345-0x00007FFC8E650000-0x00007FFC8E845000-memory.dmp

Filesize
2.0MB

Download