discordrat | hxxps://mega[.]nz/file/jkNTmRyb#UZfDQMn8SnlAswttsJgsCzE20iJ6k_LXTwsGMIRxv90

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/jkNTmRyb#UZfDQMn8SnlAswttsJgsCzE20iJ6k_LXTwsGMIRxv90

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzMTk3MDk2MzI2OTM1MzUwMw.GNyyBe.sa4i9SKNY0DjPmCyWD9DDxyVQjWqZ9RQU8laDo
server_id
1231989894444744734

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 5 IoCs

pid	Process
5460	PlayStoreCards.exe
5604	PlayStoreCards.exe
6108	PlayStoreCards.exe
5228	PlayStoreCards.exe
4296	PlayStoreCards.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 786905.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
116	msedge.exe
116	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
5348	msedge.exe
5348	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	744	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	744	AUDIODG.EXE
Token: SeDebugPrivilege	5460	PlayStoreCards.exe
Token: SeDebugPrivilege	5604	PlayStoreCards.exe
Token: SeDebugPrivilege	6108	PlayStoreCards.exe
Token: SeDebugPrivilege	5228	PlayStoreCards.exe
Token: SeDebugPrivilege	4296	PlayStoreCards.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 208	116	msedge.exe	84
PID 116 wrote to memory of 208	116	msedge.exe	84
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 1788	116	msedge.exe	85
PID 116 wrote to memory of 4924	116	msedge.exe	86
PID 116 wrote to memory of 4924	116	msedge.exe	86
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87
PID 116 wrote to memory of 2128	116	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/jkNTmRyb#UZfDQMn8SnlAswttsJgsCzE20iJ6k_LXTwsGMIRxv90
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff848f846f8,0x7ff848f84708,0x7ff848f84718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Users\Admin\Downloads\PlayStoreCards.exe
  "C:\Users\Admin\Downloads\PlayStoreCards.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Users\Admin\Downloads\PlayStoreCards.exe
  "C:\Users\Admin\Downloads\PlayStoreCards.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5952
- C:\Users\Admin\Downloads\PlayStoreCards.exe
  "C:\Users\Admin\Downloads\PlayStoreCards.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6108
- C:\Users\Admin\Downloads\PlayStoreCards.exe
  "C:\Users\Admin\Downloads\PlayStoreCards.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Users\Admin\Downloads\PlayStoreCards.exe
  "C:\Users\Admin\Downloads\PlayStoreCards.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,729389102594178264,8585072743447549137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x37c 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
1e2aa9a96d067ab39dab1551ea82bd8e

SHA1
d97c6cbe4e2613eac95a713491e35ad91b981c72

SHA256
74dd1a4526a35ca202917e52179ee4eef0a7a413034bae9795a08fd03aa958f3

SHA512
833bbd0d0feabc4734d075a74bc153b333a06f17bcbf71b81fe3c4b527974df8167def25cf27a4e3d79382d293f7bb97989ee5657fff0efc2a4fe4f1fc8ccced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12259c914515691f64a5a9ab4a0db6a8

SHA1
d791914d9114245f903015bc113b322d8b5a5857

SHA256
aeeb5a1d2143b6c8e7fc4e39ea475d7821c3953894518a302d8c8affafc2336a

SHA512
9a13b03e50c3562c6b475394e8e29b09545bb8a3d393a96cd40103fb72c08b240ddcd7a5d793cc0285844cc4e13710d47e87dfbfbb9aea24d2e79020452b356c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
972fe979ae70ce47ab0bd06b19b1fc14

SHA1
4f1714ebd1c15e3fab826fe74189c81a43a8de01

SHA256
f644a3f058f8889c24bb8a848154f07828867f51472dbf7edfba5e901de0e4e3

SHA512
025dd52248d67e80c7b57b30020709ed95f0a7b49b09bbc39e3a9886acb4b5231cfafcbfd5eaa34212214763de00e5a470594397fc863d1b58ca2d2e212c8816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4b53f82a8067773c00650ab7f462dce5

SHA1
fc6c8dcbed2bbdc2c93fe960e3a27d3c861d3919

SHA256
86e0ee6df91b21bbe124bef89354090b33fb8b0cb91e2e0fb05cf45421906c36

SHA512
bf61fd9168bd4c1c3bce8c42784b53dea339971f7ec3591c28241c89befdd9d47f6e2b3cf09aa200b7d5635f183d1cabba74028b37a06cbcef745feb72acd380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579441.TMP

Filesize
48B

MD5
a130b0687c194f86a50f1cc96bf2a16c

SHA1
58a78c7b2447e0328d439898b216d2188c9079f0

SHA256
574b59591694e9a0d76b6bfb57515d575db0cef2e5c322882b02542baff19fd5

SHA512
2fbc9f9bc4bab44a1ba816cb363ce5f35deb8333c7b74ed21202323557323ea5693c60f5ad6fd9019e710d65c277b951a93648956150b87c20e480710a82864a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9d124fb1aecd7defcba4f54ffb7d1f3

SHA1
8b39269a12d9263d94d76de644b5cb0e94c6e12b

SHA256
515e89748a3809786fc25b263b1bea5209b70e467585ab79a18171d920806ae3

SHA512
a74ac47b77580acec1ca136681005e5c64c5b97a01d796e0d3deb6d66e9630af2d0a7b7e68257b4a8a47fbb1b3e9c17490796318cc73d180c17f73249b89a61d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a08c1c07b20bb6e3b7afe73b85ed418

SHA1
a6fd37cdac1c8593f884f00725080cb4cf884ff9

SHA256
88deb03f07bf8c502d42e9ce36bb73e1a4f3ed0cc99a555763324e7fac8018b6

SHA512
45c7b81b1b1ed3d6d28b55d4904b090292693d84bea46318ed237f181af253cab3eb391e85ce383e1f5b5616cbcc3985ad562522d44c0c1d2f745b436fc49175

Download Submit
C:\Users\Admin\Downloads\PlayStoreCards.exe

Filesize
78KB

MD5
77dfc6b9d3a1e3bd88379b330bdd91a0

SHA1
49c6ebcfbf85d7390c3fdea9c5d0ca73da7dda1a

SHA256
883d0f52ed05035ce815210e128d7581fa47314caf99952dd7622451ced87eb5

SHA512
d97d86a3969b9d43dfa24966988b1dccd0be981d23063270db0de48fc1a27b66b0cb777621650db7a7f2d56171a6a785a9c82cfff251a92fd8b21738d4183f16

Download Submit
memory/5460-170-0x000001F3359E0000-0x000001F3359F8000-memory.dmp

Filesize
96KB

Download
memory/5460-171-0x000001F34FF60000-0x000001F350122000-memory.dmp

Filesize
1.8MB

Download
memory/5460-173-0x000001F3508A0000-0x000001F350DC8000-memory.dmp

Filesize
5.2MB

Download