discordrat | hxxps://pixeldrain[.]com/u/AKboUEnM

Analysis

max time kernel
258s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/AKboUEnM

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxNjc0OTI2MDYyODgyMDE1OA.G8734r.OQz-OXe_uZmEAeWMnccQe4M_M012iMadcEWrcg
server_id
1187864302279991336

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
1600	free robux genorator.exe
2044	free robux genorator.exe
4636	free robux genorator.exe
1224	free robux genorator.exe
2248	free robux genorator.exe
4320	free robux genorator.exe
4328	free robux genorator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
60	discord.com
78	discord.com
81	discord.com
87	discord.com
89	discord.com
57	discord.com
59	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 613554.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
2108	msedge.exe
2108	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
2796	msedge.exe
2796	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	free robux genorator.exe
Token: SeDebugPrivilege	1600	free robux genorator.exe
Token: SeDebugPrivilege	4636	free robux genorator.exe
Token: SeDebugPrivilege	1224	free robux genorator.exe
Token: SeDebugPrivilege	2248	free robux genorator.exe
Token: SeDebugPrivilege	4320	free robux genorator.exe
Token: SeDebugPrivilege	4328	free robux genorator.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4296	2108	msedge.exe	83
PID 2108 wrote to memory of 4296	2108	msedge.exe	83
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 3948	2108	msedge.exe	85
PID 2108 wrote to memory of 1576	2108	msedge.exe	86
PID 2108 wrote to memory of 1576	2108	msedge.exe	86
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87
PID 2108 wrote to memory of 2100	2108	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pixeldrain.com/u/AKboUEnM
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab4b946f8,0x7ffab4b94708,0x7ffab4b94718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Users\Admin\Downloads\free robux genorator.exe
  "C:\Users\Admin\Downloads\free robux genorator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Users\Admin\Downloads\free robux genorator.exe
  "C:\Users\Admin\Downloads\free robux genorator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Users\Admin\Downloads\free robux genorator.exe
  "C:\Users\Admin\Downloads\free robux genorator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Users\Admin\Downloads\free robux genorator.exe
  "C:\Users\Admin\Downloads\free robux genorator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7235800778796713129,12461965845809647762,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Users\Admin\Downloads\free robux genorator.exe
  "C:\Users\Admin\Downloads\free robux genorator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2976

C:\Users\Admin\Downloads\free robux genorator.exe
"C:\Users\Admin\Downloads\free robux genorator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Users\Admin\Downloads\free robux genorator.exe
"C:\Users\Admin\Downloads\free robux genorator.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a82e52b-f14a-4c96-ac74-f53b8263bb52.tmp

Filesize
6KB

MD5
9c53a3f00eb0d7744a266146190744cc

SHA1
ca54ee6dff098b655765a572297343f759535fbf

SHA256
04347720727807730194d27001ced1743884044297043adff96f926606e57051

SHA512
cf674bcef2538e0aa144fcfd0e7499bbd0a845e8c38aa08a30b7e02754193189296cf9cf68ea4c56dd57dec4733b666111b7523ba6360e034e5c59d87c45ab11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a13aa7c01405885df6c28936f9694d53

SHA1
4fc7ecfad012d5e53ce4ca7c5bcc2dda7d545c81

SHA256
3c05a1f24c4bf79f22cdbf91456826a8014636c2d0b5a895052b358830df273a

SHA512
5bb656722e2a1a1e148094ed8bf2d8cacd57815fcb2bfa1b1cfedad5978ae5ad8d30aef6ff6646254e628c9b1febda226d0398e7f20e6b636bbf55617ab3c431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
9eb9d67f919ae153884991ffc5223fdb

SHA1
8ebbb1a763b529cc9bf2839b13f0564f10d10046

SHA256
08e4c57ce93d9bce050befa4e516d8aca239010d22692f90ea30a39ba91a1d40

SHA512
9aad23e77ff458c7b49381fec4e0c650172314e46cdae969744d948f67eabb8ee25e2d04f6d81d43bc97f2d704fabc43b4b63ece97a14f09fde78c59132a003b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a912990c68a4a9b12ac04bbc4085358

SHA1
a991a78c7b409e7a365148fb980658e5aaab7006

SHA256
1877d22c32c8c3c9b56d5a7850475e2e2ce9a2c94976c4cd0d1cf29f0a720c16

SHA512
a9131bccb28ab79cd5f908c7cd8e8c6ca205bc14bb844b65901b1c54d9bb444813c5b33f8464b0be119872adafe31047c0907c9e5b677a1bc47ade8bf6408349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1783ebae337a7c063f048aca9f45440c

SHA1
1df9d8a690821b26856066aca8a6b3922ff22676

SHA256
69e484dc945c62ed33f995e638a524f96b9d613e02f207d5d7c26aeb5e7a3353

SHA512
9d224d40800ffc982d194211a1f1c364a8219cafb12031f91fd0eb14f8cd2f507a03ba8d09b18cccca1d59f87eeaab164defbf0bd801995946816724fd3f49a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b046e11a2fcdd04455e095a0f4a57388

SHA1
1f91503a92e2620f2649fa934b7640e4a2c56502

SHA256
b5fca725986241bd847812e61a52d8932436dc7f0e85212896969315e99d30fa

SHA512
a35cc57f075666f4817b8d6c648df2d50faab52b2e0ff5ede1fa86eb8163c3002cf65f11100d3cbbec66210fff9b43becba365fd8991dcdb163b9db911ca8cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
cb95c8e7b1d52ab6e68530080dfe4e84

SHA1
606db540fb7fd59c957299bf0a64d225d4cb8ec0

SHA256
21d4de7e2c61b5112212e2da93d2c4a3c8845909a056d8deac16804c7283ae88

SHA512
2881addfc37f4e8dabd40543cb4bb23ada09eaa185e0d461b66a6637d4a6bb86efae349e51f08fdf335028b9dc213c247e3d695a94da48ead9ac16accbb6d8e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a420faca9c416b77cde62621cc58b925

SHA1
d6e12a8149fa84d5a75ffbb00d19352f913cb2b7

SHA256
e3fc307aa334742d53cd4055aef406ad8f0619c1a7137ad2e70ce0fc1f997b78

SHA512
88d895fa8f3ec68060c1f22a89024ee7149720bf1d089898c913206b22801ab93dea1ce3b0e166d0fd6db785ac655af603504d76ea5194216ea68d982b734607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
b2216ff7860b93431ee142acc7b7de66

SHA1
441ccdf049d31d82f20b4da88c29fc9c58792825

SHA256
adb3746a37e658c09f7e54ad97583f02957dcf6817b67c62a46d7f70005fe7e2

SHA512
57bb771b7ce996716e66a1e5f9b0a001353235211dce7b9da95942d62c607e881909b468341d4ef118e2035f5fe4427226ec9aa71fdd0e623a8d27b623dbae91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
66123c6b064b6cabd46ddddaa28008e4

SHA1
39ff37a106587e884bf79a1ef2aff70cc08fb521

SHA256
17ca5d864d2ddf8145e9678990588ede21ef5c708a1449a89cb4a944d4ef9c6d

SHA512
0a1ad1d90afd8fb166409a5e4a35f5c146907139c71204a6f559c9660097ee3a0ba6205bf1072cbd5cb6bca1d480ab6bac3fbf53fcc303e0e5a49d516d7a9841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
dbd886ec47036fb0e9485df2e13858a2

SHA1
5383209655a82faaa1cfd13f1ab3bba493641996

SHA256
7d07b71654d7ed13ad674aa41912e02386045b2fb65f077bdc62adc4207c2cef

SHA512
65837ab89ba28dd8bf01d30225012bc325bc92f6d0940fc0398486fab8e68c49cb6ec31fc5b44738f405c098e074f150508285c29f5d4f3fcb1e9eb679973cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
772fb513afbee74137b4ff65861ba930

SHA1
c2201b2769708fe45f69d5f38ccd9fba7b9272b8

SHA256
2737b5fcce7c23f2ac8128850d6d4816afdbe1f6ff24e3c17283d2f2583bc21d

SHA512
2a2551bbccf74d34cf4d8a21e654359199c4e2ef5b1a68980ac99e62de19ce694cf0bed50612c58f192c1fcd60c14c506ec630ad5b97f6da8027948db084ab91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
2ba7c28450d673fb02ed5cfded4c4ccd

SHA1
f5eaf2038d585dade9f079049a4bd4d963afe9e6

SHA256
6c71d3d61226db7604f4081160ef65109503825eee5184228430615dd0277084

SHA512
a140ce48f95c100f3fe8723abe5b640a427ce354740e544a1363255d37ef94a8cc4da6d13909d47d3fedd83bc0d7c0a0b1b83b215f13904036295e5ed49fb83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
cee791671b27595b886a486e39ae405a

SHA1
28a204e658c965a053ae663c30a983922bca634e

SHA256
1c29e1ec3320991251b617ac60bb4f7f3797ebb5f312ff77b79791aeb2d88e8c

SHA512
82f3fb267cc26922985eb867747ffeca76d2ac6e558b060ba34b29219be26c98c141c2a1cf3042c4a05bbc00cb8b71947999c1bc40102b39944f761d5fa5d730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
816b3cd77cfe668f3ff326c8965648ff

SHA1
92b9161684c9100411c60536c7bd62c538380570

SHA256
1bc44813715e9a82738dd0f2556fd4a6947deacb7aac96f2a5ba6858f6fa0d65

SHA512
ee882ea86c6d71c77232d242f8fc4f061ab6a65ca3820adbe171aa4d022741ef15d0d5fbd18ef354439b46d3cd833413a9e7dda7c2eb01c30b5e7b1b5308ccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a5baf56e4ba2636127356adf8197afff

SHA1
ebfc6f49a2b961e4034eb4f6f918c3cda7e0a624

SHA256
c04cc0197b910e9c4da8f9c9fb369f9ee1acc9881fa88bae906bb25659ce5107

SHA512
dfa1692d4ae88a07f1591f4d84e61df44af8c31cc3168de6771eb1bc976d5da78f0bc84346b14d6980e6d6e56a131b73a8bbaa91484c5bbd4b8970eef2e1484b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
7f541ca09ce1911ba8085cb1f9ebdf01

SHA1
0c48c928c391c146c526780d276ff7e5737f719c

SHA256
1e3930a8b05aae9bd1579cfc51793375ac07e16cba4b93d3c2ea5549b173550b

SHA512
8d53578c2a8d3c1294493bb8aa2cbcb7046b99c765cb3cc095f056c9a99c5db46533c3c1df51105bc9c65c2f94e644e7d15e55333ef17b03efedd4b10b5c1837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
ee9e74c8ccb4233ef85b3117f8e810f0

SHA1
67ed585f2745f5eb30056fa4aafca074506cc010

SHA256
0ed5f3d31eaf37c3453ddcf329568a725dc760ec6097b2cf9ddb7b8c74a44b91

SHA512
b7be1e61a8bb63409fbd86cf1795147408e9aa04213ec4a03962de657a3cd3aad4f71f41b53dcfc36b02c4cddb24dc85f7bdddc6750b33d15505e092f59eada9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
37389d19d9410d7db06f4fedbb7ebaa5

SHA1
777f3c174f7f64005b71ee795d6b9f633fad4181

SHA256
e197dcdbee32546e9811d4d10ddd24de506af3404f496cdb9ba0acf68b5b2710

SHA512
258aca70e0949e63bec174911c2ef6cd9d833a4e51f762ae1ae6efd516ddbc8b91f14c34f926b7a14b77828f42528e02a88f02bac85022047a8d6752ff7865c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b268.TMP

Filesize
204B

MD5
64a3ddf781db6a25594f4f5de47771f5

SHA1
412b1a5b35a171e099676f0afd739026f4c05f32

SHA256
05564a3674aafd29cd170bf6f655dc2e825dd78826c7be032fa8028724d960f1

SHA512
af12b137113009f7870439b6120bda120245a7d60889625e39bbd7800b87849dc88d9a143dccff3bdd15eee6d4acc5ca3cb3eee52db5da1fa5c46d2ee74eba13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec0c71fd18f9ff385e3826da58d73d0e

SHA1
af1404404cb7338bcc3bf711d0d1092898ea6643

SHA256
0c52fa7488ba211e9c725183fbb43aa3b87fa0e44423be5ccd8256a486692fdb

SHA512
dcc932a5d15cc0eeddb8d7650bf99a2dcdea5339155113c130de2db2e786a273605aeca89a987e1437bd4969956d4adac9675e4437ce19dd9317e6768da2201d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4030d0f86d9d308dcd644c091ce2c6a1

SHA1
23d91514e59ef4274b2a55f6bc55a0b4071fb11a

SHA256
fb2b625092b89a9126e75a8f07b1edd5becf56321f388b8d236de2091460b599

SHA512
dbab15dda83b23941d89e3739111c79499605b1e4d6021c718785feb88059d713d9cc515e4be3ecbe08f8bcd8e2773ad7594dac0ddd171d5c10beff2b8fc8ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
414f5058e38d57196e537bc7e01d0806

SHA1
ebe06b1c4923b9c5f2be858afbd8152437bd3c1a

SHA256
36c70a06b553e8c1a40229be8edd1a29442d98cc7ee6e6b11c942d4ee52f71f8

SHA512
e1e5592b2fe346b0a81c8b5df2425a6b088d94275b8ff8ce0a71b265ab60dfee15fd642a1c10975036069cbfe8466ecbdffc7057320d66316019d9e55f799f2b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 613554.crdownload

Filesize
78KB

MD5
91c6b29f08020e64a460aa8e51f2c736

SHA1
a049f1e9e954976278eb3ae8cdbf030bb4cb740e

SHA256
4a377e23919691f8bd06dfbb4b2aacfcfdfdaaabf8dc23dcbb5068b710efe7d6

SHA512
cb74f7898b84c451f30af8f7f91308b602f37fec3c55b156c7954613148802759a673caa37aab6539c7078e9acc81e8e11f2d8f758ff856d6b5830a5905fafe3

Download Submit
memory/1224-231-0x0000028DEBA10000-0x0000028DEBA20000-memory.dmp

Filesize
64KB

Download
memory/1224-230-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1224-241-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1600-169-0x000001B5AC140000-0x000001B5AC150000-memory.dmp

Filesize
64KB

Download
memory/1600-136-0x000001B5AD6A0000-0x000001B5ADBC8000-memory.dmp

Filesize
5.2MB

Download
memory/1600-121-0x000001B591B40000-0x000001B591B58000-memory.dmp

Filesize
96KB

Download
memory/1600-158-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1600-122-0x000001B5AC1E0000-0x000001B5AC3A2000-memory.dmp

Filesize
1.8MB

Download
memory/1600-123-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1600-134-0x000001B5AC140000-0x000001B5AC150000-memory.dmp

Filesize
64KB

Download
memory/2044-179-0x0000021BA3CA0000-0x0000021BA3CB0000-memory.dmp

Filesize
64KB

Download
memory/2044-168-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2044-133-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2044-135-0x0000021BA3CA0000-0x0000021BA3CB0000-memory.dmp

Filesize
64KB

Download
memory/2248-278-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-288-0x0000026A7ABB0000-0x0000026A7ABC0000-memory.dmp

Filesize
64KB

Download
memory/2248-254-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4320-292-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4320-277-0x000002B3C4FB0000-0x000002B3C4FC0000-memory.dmp

Filesize
64KB

Download
memory/4320-276-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4320-311-0x000002B3C4FB0000-0x000002B3C4FC0000-memory.dmp

Filesize
64KB

Download
memory/4328-331-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-341-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-187-0x0000016B41E10000-0x0000016B41E20000-memory.dmp

Filesize
64KB

Download
memory/4636-138-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4636-139-0x0000016B41E10000-0x0000016B41E20000-memory.dmp

Filesize
64KB

Download
memory/4636-180-0x00007FFAA2520000-0x00007FFAA2FE1000-memory.dmp

Filesize
10.8MB

Download