discordrat | hxxps://mega[.]nz/file/2psW0QBL#udlcOx38emDVDlemOPGb0ro6T6IH8JzQKN62MePuzrE

Analysis

max time kernel
71s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/2psW0QBL#udlcOx38emDVDlemOPGb0ro6T6IH8JzQKN62MePuzrE

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNTEzNzk5OTU2MjM0NjU1Ng.GeDi6q._wBIraHzNyt0WRuFnFiI15VgjFOL1I9XpzfDlg
server_id
1235137214246031360

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 3 IoCs

pid	Process
212	RobloxBeta.exe
2004	RobloxBeta.exe
5752	RobloxBeta.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 702241.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1288	msedge.exe
1288	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	2748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2748	AUDIODG.EXE
Token: SeDebugPrivilege	212	RobloxBeta.exe
Token: SeDebugPrivilege	2004	RobloxBeta.exe
Token: SeDebugPrivilege	5752	RobloxBeta.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1088	1288	msedge.exe	82
PID 1288 wrote to memory of 1088	1288	msedge.exe	82
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1640	1288	msedge.exe	83
PID 1288 wrote to memory of 1712	1288	msedge.exe	84
PID 1288 wrote to memory of 1712	1288	msedge.exe	84
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85
PID 1288 wrote to memory of 624	1288	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/2psW0QBL#udlcOx38emDVDlemOPGb0ro6T6IH8JzQKN62MePuzrE
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde10f46f8,0x7ffde10f4708,0x7ffde10f4718
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Users\Admin\Downloads\RobloxBeta.exe
  "C:\Users\Admin\Downloads\RobloxBeta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2448
- C:\Users\Admin\Downloads\RobloxBeta.exe
  "C:\Users\Admin\Downloads\RobloxBeta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1089209327242077618,6907898086553045298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5660

C:\Users\Admin\Downloads\RobloxBeta.exe
"C:\Users\Admin\Downloads\RobloxBeta.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
928f973086b472a1e9fc3c6d1add3beb

SHA1
57c4c5d8e1066d8dafc0b9bf2ebe16625f1b21f7

SHA256
dedede60e8f9e541dc1a5263a233118c2607779f9ee53fabf9cfa3efd78d19f7

SHA512
918ca462a68d5bb989caf0ea6fd72c7c8d9baec6e7bd9e9f9c4187d43b15d2872dc6a13b3b670c26fb97becbeda6eacd7adc2c62712cf4be9756eb0786860f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3483ea06bd07fb313d6a427b9ec90f97

SHA1
148f69fa2668f6a34c2f32aaefe2bab5d1b2ac30

SHA256
36e2b0b76feba460695407cd80b6d01b39ab0a2720b50982bc139b4b97fd165e

SHA512
a8a2b631cd476fdbeaef0ccedad25c47bb5d34059582adc16bb9a3e7b6d941ca245215190623e35e15bd0d02f8060d4346044954a2e45f7b4dce9376ab48cce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dea692b648f5643e4b041924314074f

SHA1
0772ef03fe09266260390b74e25681f89800db9f

SHA256
6c97bf981f4964727b79cbc36a4507914f97a28c2f380ca3b10f993122c193f1

SHA512
015d9de123f67ff1b74ab4520650b502483c2df5f241f9a4d093c4fc93817ad5a0174f1b31bbcb89fb186c04d2a3215ac9a78395cf638f716677b7158d687edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
04a25a65c46496efd695f78820349df2

SHA1
0b07600fa5a133b17bb4edc009450236bee28dc9

SHA256
870feb731783975ec789f10e173450745f76a863dd3b60bbf65763fb31caba8c

SHA512
aee2d44dce519d6d81d54094cce44be4683f5fe9fa9129247019451d7dfe2a3a02a6186b1e2681581bdff6ec23aed967a9da447e8a6e764d0c8f6812e3cba81c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579376.TMP

Filesize
48B

MD5
6e78b180675e0ee6073c344193097f67

SHA1
cd9bad10d1f11883153757cbc8874ccaa84c9315

SHA256
583f65893d78403ca75454b275625cff0c17b7a491ca5b026d2a9db84b9e4974

SHA512
7b7b4ebad7596dc76e0adb767066c2083019c2932a7de985e5ca57644e8a33bda2239f019e1d3231494c314e7304c3f00426bf3a3730b86839a851dcdafb25c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
250d36a4b1e89416ce5559dcf5520233

SHA1
dc413650b43a2e3cee9686976ac8db9074c4782d

SHA256
c0f56cbf14285e446897ae3a08791e7319a6b37c11671adeef59c7225848cfb4

SHA512
7f03dff8e44522362c8602c248b108812ffb01fe0067eddde8fc25ff3300a80c82a5c3887bd69856c546122df73b50705a7fe46b961dea279007938ae17bf2f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22b502611740aaa86d32e2afed342f76

SHA1
aba8464c6bcef0fdc24cc3ea3b3cc401d71003ae

SHA256
48bd0206ae25dbdfd742f7f30ac147eda806698f87be74d91b40f9bc306501f9

SHA512
b424ae601547e6771a956db3ef2a093bed385c5f96d7bb6a07d9dd6857deb6ecc104cc9f0af4c92901fbf4ad741ee9ca169cf0f9bcd3039dc3185b3280c78c7e

Download Submit
C:\Users\Admin\Downloads\RobloxBeta.exe

Filesize
78KB

MD5
e1930b75fa9959cb412ebfae2f26b5d1

SHA1
836b838bf7e0383645cfb8068572d0852c6fc0ca

SHA256
c2d95b84e0355997cb81823199d31ad38f9ebdb2e9fb7644339259d3927ca5bf

SHA512
47d38c2c4f443c9d6cc6b8ebda3b3e546fd0e6916d3ad83ee1ab9850a3a7459cbd0a7f31aa8680b25baf581c008ac170e1a6712af39d9532b109b75212f26679

Download Submit
memory/212-167-0x0000024CF2880000-0x0000024CF2898000-memory.dmp

Filesize
96KB

Download
memory/212-168-0x0000024CF4E80000-0x0000024CF5042000-memory.dmp

Filesize
1.8MB

Download
memory/212-169-0x0000024CF5680000-0x0000024CF5BA8000-memory.dmp

Filesize
5.2MB

Download