discordrat | hxxps://mega[.]nz/folder/bEMUjBrK#dSqYdVa8Jk8vsVl_um5USw

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/bEMUjBrK#dSqYdVa8Jk8vsVl_um5USw

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0ODAxODg4MTEwMDkxMDYwMw.GRaXlf.ylaGWSJsDFw8FuU8OAZhB6MI1OqGbyePmWUsTg
server_id
1248018881100910603

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
5956	Client-built.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5584	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
2180	msedge.exe
2180	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5956	Client-built.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5408	builder.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1828	2180	msedge.exe	82
PID 2180 wrote to memory of 1828	2180	msedge.exe	82
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 2748	2180	msedge.exe	83
PID 2180 wrote to memory of 4732	2180	msedge.exe	84
PID 2180 wrote to memory of 4732	2180	msedge.exe	84
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85
PID 2180 wrote to memory of 3364	2180	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/bEMUjBrK#dSqYdVa8Jk8vsVl_um5USw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,18032822018193129892,8465791784065791896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x308
1⤵
PID:1500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5228

C:\Users\Admin\Desktop\release\builder.exe
"C:\Users\Admin\Desktop\release\builder.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5408

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\release\ae.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5584

C:\Users\Admin\Desktop\release\Client-built.exe
"C:\Users\Admin\Desktop\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
47a308e5964f51bdb70ec5bb36e759d4

SHA1
373cda6e888edd65e4e05ea6eda371166b04c4fe

SHA256
ed6a1e85a7055ce7bd40d09e559aa5591b9acd690aec5e0d459d1adba2c59557

SHA512
aa511fb4b172fd8f64452876fd46252edc817b162bf5fe33c34cc47045dabb420ab50bf2c87d226953ee9551a1d73a2c98fa04a5e0deafc1676dee1ab76f98c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79991567fbc3e41e5a575062cded10be

SHA1
26c5bbb5145c3ee96ec32a71924cc91cdd624ef6

SHA256
b5c173076fcf7e5045497dc4f18d7289cdd6c3baa1fc9348410b0fe507628b0b

SHA512
ef6d862cde89ae11f6d7ce6a505d27f3051c56b4cde68c95892e6056027eb73c94c1e0fbd386979c765f4ae579161016e852de33ead7f60e47f8ea5fe01ff9f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6fc04e24baa25e1ab1030b6ab517e7b4

SHA1
658ba64065dbcdb6bb83f55b4621ab82ff719668

SHA256
32ffd3dcf4097f92b3c4d82cd01165e0e05ebe301d483c46bfcae5f7e2bdcccc

SHA512
2060590dba96c52a4a16f084e41beded2434a30df106ed8b57dfebb5e2f4d451518051e96759e4b18be495c454a00307627a497255bb118ff72cbe52a0577cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3364d5c2e9c13384ff775df07b60c48e

SHA1
44b90d9d79168e4bbfdbcf241487fe9b475d3674

SHA256
886ef57a33d35e427c813551c5d7881834a86c83763357d425c2e7a9ed1e6678

SHA512
ceba74c846b689437c64531b60e82523f2d6437e5855a2e5e26a85cacb4d1db8ce209641e1430b29bfc22e93aa364591dbd88f1302fc9ead6f362cf0cddf874c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e74bda643507d3e2ef133e465d65ee65

SHA1
5752adadb466c02a89e4c3dce49a4e3262bb20de

SHA256
66565ed81bd394c81b8ab491704308ed278e407956a04e627fd7236fa59f478e

SHA512
cd34f126feb516409801931e6ccb439519d2fbc408d6a9a9b12b3e4202ede80643d7f20386430efa422bd2fb77c8bb943b02d2156d9f449b64232d36dd3dd2a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578916.TMP

Filesize
48B

MD5
7b20958332465227fd9f4cf173b1a8ad

SHA1
9b16f5312dd5790e659f8e0d37dd4982c9823d38

SHA256
86577a0081ba74ada82db751c7a0e2c7eb7a4475e6e37436f185bb752ac1c4a3

SHA512
caf041907faf31947e9d118910b86c2ff8b43bf379ea06d68980ee585e9ed8cfd1d172e0a40ba5fa219b9ca3c6077a285be0e27194ed48f37c6ed47f9e18576b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cce53698728ca52f42381e55c33ca8ca

SHA1
cddabb4e03e5c0d7bf55e973075b543b3b3651c1

SHA256
9da73653f3ab758db05bf4e2cc34dd946dac58aa4a6a5051cc2e2f64a71bc820

SHA512
83da6de963b41d6e931a920d318d91c283c91980bbf496af2b0393dbc5a8bca4637251037208af68aae5f6cbf8ffc1782be2c12773b41f19a978202825de67bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef95cdfb616432234f35e2eb586f2503

SHA1
aaeaaa6a17e7e64c133a12db67a60bd631e26510

SHA256
d7f4f22c7c3791b2213685cb4cb3cb61061db780e3617864dbe2d53ea4faa2a4

SHA512
f84c0838dd25b2c506420a298a87f1440bdfb63ddf0beaaff56d866bf7c9ead4563eee492a10f2d7e0821ec045935f4941d791ad36396015508413d2805ca92b

Download Submit
C:\Users\Admin\Desktop\release\Client-built.exe

Filesize
78KB

MD5
8f75dfd836b760534f4e72526f1f88c9

SHA1
d4c16b885de7f8967cae928d841647868c50b272

SHA256
0afc7ac322a298aeef692dc7be6d067dfdd8f1a3a28e8358957ac168190f2e59

SHA512
1a0ef2c83e99a65ecd32bd548efc7afd757691d48c831e5b675157981b085e2ff8a6d3976a33e9ee5c3b25cd57f53dbeec72b5ee22a86d12b866b0392f0d9442

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
1.2MB

MD5
d5de8bbd110d378fe0c7bd5bec32413a

SHA1
79ee86dd5eb5ac76a1c0181dac45c5b02aa7a248

SHA256
1edcf75fd5852fe96105c17e040b4bae92006ba6a53bdf2fc4c994898b2f27c1

SHA512
0c32bb99f73fc1e5b1fbd64727c75e553fc92367310e649e9efaf51d55fc0382d03975ed351c4bf0ea19f557cc1ff89d63ad15920edfbc73bff3d92132eecfce

Download Submit
memory/5408-195-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/5408-192-0x0000000000070000-0x0000000000078000-memory.dmp

Filesize
32KB

Download
memory/5408-231-0x0000000007D40000-0x0000000007E62000-memory.dmp

Filesize
1.1MB

Download
memory/5408-194-0x0000000004970000-0x0000000004A02000-memory.dmp

Filesize
584KB

Download
memory/5408-193-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/5956-236-0x000002B0E5C00000-0x000002B0E5C18000-memory.dmp

Filesize
96KB

Download
memory/5956-237-0x000002B1001D0000-0x000002B100392000-memory.dmp

Filesize
1.8MB

Download
memory/5956-238-0x000002B080840000-0x000002B080D68000-memory.dmp

Filesize
5.2MB

Download