discordrat | hxxps://mega[.]nz/file/lvVV1ALY#I0ZbAWRen3rRPy7dwZlf6KRa4L7vbQeFiaKvsSVj-0Q

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/lvVV1ALY#I0ZbAWRen3rRPy7dwZlf6KRa4L7vbQeFiaKvsSVj-0Q

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNDQ1ODc2ODU0MTA5Mzk4OQ.G1TXa2.7oRt2Q-Qp8mSG4vpWmR5JEhhANuTxxOXzb_0uk
server_id
1191318589567934515

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 7 IoCs

pid	Process
5912	NovaDestroyer.exe
6056	NovaDestroyer.exe
5164	NovaDestroyer.exe
5372	NovaDestroyer.exe
5524	NovaDestroyer.exe
3912	NovaDestroyer.exe
2096	NovaDestroyer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 915261.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
3704	msedge.exe
3704	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
5732	msedge.exe
5732	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	4996	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4996	AUDIODG.EXE
Token: SeDebugPrivilege	5912	NovaDestroyer.exe
Token: SeDebugPrivilege	6056	NovaDestroyer.exe
Token: SeDebugPrivilege	5164	NovaDestroyer.exe
Token: SeDebugPrivilege	5372	NovaDestroyer.exe
Token: SeDebugPrivilege	5524	NovaDestroyer.exe
Token: SeDebugPrivilege	3912	NovaDestroyer.exe
Token: SeDebugPrivilege	2096	NovaDestroyer.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1128	3704	msedge.exe	86
PID 3704 wrote to memory of 1128	3704	msedge.exe	86
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2300	3704	msedge.exe	87
PID 3704 wrote to memory of 2200	3704	msedge.exe	88
PID 3704 wrote to memory of 2200	3704	msedge.exe	88
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89
PID 3704 wrote to memory of 2980	3704	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/lvVV1ALY#I0ZbAWRen3rRPy7dwZlf6KRa4L7vbQeFiaKvsSVj-0Q
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d0846f8,0x7ff98d084708,0x7ff98d084718
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5912
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Users\Admin\Downloads\NovaDestroyer.exe
  "C:\Users\Admin\Downloads\NovaDestroyer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9842672264267426734,4977939782025360524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
896c87ce40e3b07249f46e222a71f8ee

SHA1
86ddf28f3858df3bfb4378bc13f2dcac9d252945

SHA256
5a7172c9cd94ef90a1e0e628d300ea8d53db17e894a8305c6955670638981028

SHA512
c5074f49351e30b8584a5da73888d3a7cb69ec095878d42eec9d2ac2687d97e498a4f358899bbd6f4c4d7e8679bd0ebba97353c9591198ac424e25ea73b661b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53a7e4c178f95819c2d3bde73a810ca3

SHA1
e289b8cd6ed3ace8910f876561cffd3dab0f85bc

SHA256
6bf6b2813f7e635704fa3a638edc185250a9389f4830782b6080aa9501b53716

SHA512
ed45dfbfe064cb7c63571238484806d444cdeaef49b60d84112d2d31ee004688531050e891a43825ad3af60a3b672a1864341390c852dcce836199d85b0049ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2fa2c6acfb982084fe35a5efe2b8e77f

SHA1
8d6b1dd2586d97820f8d1f18dfe299f5f1f82531

SHA256
03bf2cb5edaae3e1117043c9f1751e4ce6a2a80e2c6da1fc4aa971e23f997d6d

SHA512
49b580061fca6c84c1c0b334b03404d67a4201364fa619e6724c982c2bdc721742879f85ffdc1924df1a8beca6d542730534c4b3b24ec233edcd40aad12156f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dd4851c045caf5c3cd6330d28a72e2d5

SHA1
dd5a6d1d53d0f152675a3368ebcdd1f680fb522e

SHA256
cf533bacc7160fb3e04aad5b43b0bb54ae26d812ff2317542147d8f6c3a55760

SHA512
46ab351b76c99c863e6c8b3922b39f8d4d847bc41a7eb7e222ef9c383d61a19a0cd0b5674f625970e08dee66150456d4fff0bbaf817aa8a1b6b4d1f84b9f7c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578bf4.TMP

Filesize
48B

MD5
46a602e8013cb6e1f5ccc2d2b88100d6

SHA1
62180595737dc81178fa0d72382b485984707113

SHA256
80bf827a3684eb01a68f7c411e996d2c7838fcd0232c0bb502db75b1cd03380c

SHA512
f4ccfb04ed83dedfe01fc89e63d1836cb3862b6332c8edb7c95b8ecd7ded99bb6994a84e34026c211c3b43b8b171047c03991d1a7ee546f97c8e3c6cd35d519a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf772818a38812bf0e85617d4b83cd8b

SHA1
6e48c0bac9317f274b134e32af04d889ca52f7a6

SHA256
7c8ab7512de6f8ca813d7a1ef1e3992b00e04abc4cd32649b8b3b664d27b2efa

SHA512
b964045a97e1d884f688d080faecc54cd905a7aea326884133875abd0fd18b7ca364cbe76a6fcd6b607fcb2032f1f9861683311e625cd8b08b1e229a791c76f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf98e65ee610f6978b31be7d2216cf2d

SHA1
0f141647497755666580f26385813651890b71bc

SHA256
c65fcf8e87c984bf4494588c068fbcadbb6e7608f177e226eabe00a048ebe0dc

SHA512
1e96a0bf9d237b5243abdfdc6da4d887e1210eadbc02cb90d748bc5d45d8d9553506cad0ddeb83a62c1bb28286aa9e343bf38bc2ca5b74f4fca8025d039ebd53

Download Submit
C:\Users\Admin\Downloads\NovaDestroyer.exe

Filesize
83KB

MD5
3a149f83e1c6d6984db3e9853341116b

SHA1
c5d498d2a498e5cce8f4c8a5f92392d146662162

SHA256
7423e2f661bb0127b386e76c019099bd96610a905d9f4ec6204a88154ee55235

SHA512
8e01072e43a8575e02c023f9792a5a349f63bd3f8a3d0866456cfa765477f5b99693acb2704205b2be9a38550f5de9861fbcfde3e2cb9a671b394ea7869706b9

Download Submit
memory/5912-178-0x0000016BA0700000-0x0000016BA0718000-memory.dmp

Filesize
96KB

Download
memory/5912-179-0x0000016BBAE50000-0x0000016BBB012000-memory.dmp

Filesize
1.8MB

Download
memory/6056-181-0x0000021937C80000-0x00000219381A8000-memory.dmp

Filesize
5.2MB

Download