discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1221895306933833802/1221898554881212558/Client-built[.]rar?ex=661440b5&is=6601cbb5&hm=e16a2b4f69f372f8313a451d1f5bbdb43f419fd93e13b4647f2b56f9f9616461&

Analysis

max time kernel
308s
max time network
329s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1221895306933833802/1221898554881212558/Client-built.rar?ex=661440b5&is=6601cbb5&hm=e16a2b4f69f372f8313a451d1f5bbdb43f419fd93e13b4647f2b56f9f9616461&

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMTg5NTk3MTUyNTQ5NjkxMg.G_X-be.E8sJUVwetw4JXRkXLSkoeawb2aYJtgn7GPPHtU
server_id
1221895306120265778

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
5924	Client-built.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1004	msedge.exe
1004	msedge.exe
3584	identity_helper.exe
3584	identity_helper.exe
2112	msedge.exe
2112	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5368	7zG.exe
Token: 35	5368	7zG.exe
Token: SeSecurityPrivilege	5368	7zG.exe
Token: SeSecurityPrivilege	5368	7zG.exe
Token: SeDebugPrivilege	5924	Client-built.exe
Token: SeManageVolumePrivilege	5948	svchost.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
5368	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 2972	1004	msedge.exe	86
PID 1004 wrote to memory of 2972	1004	msedge.exe	86
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 896	1004	msedge.exe	87
PID 1004 wrote to memory of 1688	1004	msedge.exe	88
PID 1004 wrote to memory of 1688	1004	msedge.exe	88
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89
PID 1004 wrote to memory of 3032	1004	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1221895306933833802/1221898554881212558/Client-built.rar?ex=661440b5&is=6601cbb5&hm=e16a2b4f69f372f8313a451d1f5bbdb43f419fd93e13b4647f2b56f9f9616461&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab4b946f8,0x7ffab4b94708,0x7ffab4b94718
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1438387763266914592,2342288371343149811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1612

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Client-built\" -spe -an -ai#7zMap9582:86:7zEvent1302
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5368

C:\Users\Admin\Downloads\Client-built\Client-built.exe
"C:\Users\Admin\Downloads\Client-built\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
783051e347ef08875a7c1cea67575b7f

SHA1
82ddfd30a89f2e09141902cca7a6408c97c8ce87

SHA256
24706aa8be14979ed34da08775cdd0480fefb0acc9ae11ea080b17519c5fe118

SHA512
127bdc3d29da3a92709fda8cff0d967a5e29f5b9e495b0d9c3e806f80e60a46b46ab82ab1925767cb90dfc6ce9e139081a08f7998e951f3cff0c885b893da7b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb173885229124298ba2ad0b018fae75

SHA1
443cc575b2aa196282ca9405bad7bbcdcc523afc

SHA256
80730b6d1f6b684eede3279f9f1e7cffe2fdaf7f701c062b5f1fe52684b2f03c

SHA512
ec08da763f967cc42a8181f60146cdf756bbff844aeb30fa6c0faa067b9440328ee862b22b19d3625500c93b2b415375928176d8961f648c198586a2bc403f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
680a79d8374281362fbf3768ef7ff428

SHA1
1b03768aa4a4bcbe678b4cc2fffd7c634f455481

SHA256
9ed789a7250e77dce66d7b2eb0b75cbd9e3bc4747f6265b5915d95aa6a4e8993

SHA512
6600aaaef043d7f7dbb606411406507e8eca0ba682370fe63a4c5cb6a3a6aeb836ebef29fd7108b40027f9a70102c09071bb810eabf11e9179743e5b87671101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81f8ef013b2f1ee7999c901c1a7adc61

SHA1
35746ee13cd3676fe3b15cf8bc0b0fd5b14576e6

SHA256
a26a1c38a619c29cb81e10724b817ae897b39885ca59a1d6ae4511f38c6b923b

SHA512
8cd50be7f184002147793b79456aeaa2751d9eb027a9e13572840338cb8fa58a737a9d24c7079167ca0c7cbaf674600eeda03590140fe5d3f5864f0314ac6a62

Download Submit
C:\Users\Admin\Downloads\Client-built.rar

Filesize
26KB

MD5
9add42f59c08775d4837d367ad6ab39d

SHA1
178a554579ae84da18889444b7649695f85089a1

SHA256
f148119bf8c8ed3d9006b25c1ed94ff56a6a8c6506818f5c9e939dac085991f0

SHA512
deb273b9a8205632b71f1e31c18ea6090b711356f4d4148be3cd4db70c3459b174f9be49c1a021d0b71d4e23257a284da3e8ca20a150938fae9b61c33835a2d4

Download Submit
C:\Users\Admin\Downloads\Client-built\Client-built.exe

Filesize
78KB

MD5
c457f37d56b3dcae201872b6db4920e4

SHA1
274486769ff007717b29bb05512ddbe8f264b8dd

SHA256
d9b2081ba5292d8ddc0fa95e031a84be520c07aba878e169a0d3c8be10048a16

SHA512
d14328d8272bc2421606ee51336c9b10deaa514352751e9ee6827e259f078e87f58bbcf13930cb480a158fce191c99c1b4fb99172b1dc39991b2a95be529441a

Download Submit
memory/5924-81-0x000001ECA97F0000-0x000001ECA9808000-memory.dmp

Filesize
96KB

Download
memory/5924-82-0x000001ECC3DF0000-0x000001ECC3FB2000-memory.dmp

Filesize
1.8MB

Download
memory/5924-83-0x00007FFAA0F40000-0x00007FFAA1A01000-memory.dmp

Filesize
10.8MB

Download
memory/5924-84-0x000001ECAB410000-0x000001ECAB420000-memory.dmp

Filesize
64KB

Download
memory/5924-85-0x000001ECC45F0000-0x000001ECC4B18000-memory.dmp

Filesize
5.2MB

Download
memory/5924-88-0x00007FFAA0F40000-0x00007FFAA1A01000-memory.dmp

Filesize
10.8MB

Download
memory/5924-89-0x000001ECAB410000-0x000001ECAB420000-memory.dmp

Filesize
64KB

Download
memory/5948-160-0x00000224DA440000-0x00000224DA450000-memory.dmp

Filesize
64KB

Download
memory/5948-185-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-176-0x00000224E2A30000-0x00000224E2A31000-memory.dmp

Filesize
4KB

Download
memory/5948-177-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-178-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-179-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-180-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-181-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-182-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-183-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-184-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-144-0x00000224DA340000-0x00000224DA350000-memory.dmp

Filesize
64KB

Download
memory/5948-186-0x00000224E2A60000-0x00000224E2A61000-memory.dmp

Filesize
4KB

Download
memory/5948-187-0x00000224E2680000-0x00000224E2681000-memory.dmp

Filesize
4KB

Download
memory/5948-188-0x00000224E2670000-0x00000224E2671000-memory.dmp

Filesize
4KB

Download
memory/5948-190-0x00000224E2680000-0x00000224E2681000-memory.dmp

Filesize
4KB

Download
memory/5948-193-0x00000224E2670000-0x00000224E2671000-memory.dmp

Filesize
4KB

Download
memory/5948-196-0x00000224E25B0000-0x00000224E25B1000-memory.dmp

Filesize
4KB

Download
memory/5948-208-0x00000224E27B0000-0x00000224E27B1000-memory.dmp

Filesize
4KB

Download
memory/5948-210-0x00000224E27C0000-0x00000224E27C1000-memory.dmp

Filesize
4KB

Download
memory/5948-211-0x00000224E27C0000-0x00000224E27C1000-memory.dmp

Filesize
4KB

Download
memory/5948-212-0x00000224E28D0000-0x00000224E28D1000-memory.dmp

Filesize
4KB

Download