discordrat | 86c8812621c9af04b428b99aeb96627a340c3810d2bdb1053d2fb0357337a99e

Resubmissions

03-08-2024 14:36

240803-ryw8dswelq 10

03-08-2024 14:34

240803-rxs5cawejl 6

03-08-2024 14:30

240803-rvcpkswdkr 6

Analysis

max time kernel
684s
max time network
687s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gothymilly76b779.mp4
Size

261KB
MD5

d3d13a4ac1f069c0c305836dca7a79f4
SHA1

9b3fdb93a1e59d3238b110bef6a56ddc4c94c449
SHA256

86c8812621c9af04b428b99aeb96627a340c3810d2bdb1053d2fb0357337a99e
SHA512

f3f8a5814fab743ab4f3f31f800ef66171673dbacbe66722e2a865cc97fc3e59deb2655da10e5ac84826d3fcb2c4ee0d671c7d0179a0b6e3ee850f43b348515f
SSDEEP

6144:lPL62UN2BRLvehowE4wFFrAuROLFgCRofacyfI5IhdgDJkihg8T0t+:d7A2DvehXwb0uRCg7fa9w5KCdV1b

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI2ODUzMzQ1NDI3NTA4ODQyNg.G2Yk2l.qXauoqCUKPZJjdMsKjg7slxu7u2NIHtJs8nDoY
server_id
1268521650513772607

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 2 IoCs

pid	Process
4712	Client-built.exe
4968	Client-built.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
110	discord.com
111	discord.com
124	discord.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	464	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{0F39C6ED-8213-4CD7-8F10-81FD5DD522A0}	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{368D16E2-712A-472C-98EC-ECCB66300380}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
3568	msedge.exe
3568	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
5632	msedge.exe
5632	msedge.exe
5512	msedge.exe
5512	msedge.exe
5512	msedge.exe
5512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2156	unregmp2.exe
Token: SeCreatePagefilePrivilege	2156	unregmp2.exe
Token: SeShutdownPrivilege	464	wmplayer.exe
Token: SeCreatePagefilePrivilege	464	wmplayer.exe
Token: 33	4384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4384	AUDIODG.EXE
Token: SeShutdownPrivilege	464	wmplayer.exe
Token: SeCreatePagefilePrivilege	464	wmplayer.exe
Token: SeDebugPrivilege	4712	Client-built.exe
Token: SeManageVolumePrivilege	2888	svchost.exe
Token: SeBackupPrivilege	1268	svchost.exe
Token: SeRestorePrivilege	1268	svchost.exe
Token: SeSecurityPrivilege	1268	svchost.exe
Token: SeTakeOwnershipPrivilege	1268	svchost.exe
Token: 35	1268	svchost.exe
Token: SeDebugPrivilege	4968	Client-built.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
464	wmplayer.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4032	464	wmplayer.exe	84
PID 464 wrote to memory of 4032	464	wmplayer.exe	84
PID 464 wrote to memory of 4032	464	wmplayer.exe	84
PID 4032 wrote to memory of 2156	4032	unregmp2.exe	85
PID 4032 wrote to memory of 2156	4032	unregmp2.exe	85
PID 3568 wrote to memory of 2952	3568	msedge.exe	95
PID 3568 wrote to memory of 2952	3568	msedge.exe	95
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4536	3568	msedge.exe	96
PID 3568 wrote to memory of 4524	3568	msedge.exe	97
PID 3568 wrote to memory of 4524	3568	msedge.exe	97
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98
PID 3568 wrote to memory of 1400	3568	msedge.exe	98

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\gothymilly76b779.mp4"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 2272
  2⤵
  - Program crash
  PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 464 -ip 464
1⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdea2746f8,0x7ffdea274708,0x7ffdea274718
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8804996609418385402,10506330198203993496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4220

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
c61edb3a1c7fb4cc3f42a267b1f3627c

SHA1
f37a12214ec10b5567aa3e7eedf22993cfdbb1aa

SHA256
f459e1282d0f4de05fca65946bbbb34742ab074839bd36c6f5feadc474ae5b18

SHA512
7de03ab2d2e05e3fc90b7381eec57e9ddd286aa9f073412181af299305891d5f908f06d8f635bf83fba55f2d56e68e8529087eb596131e1d5370bab1180ef26d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2605fe50c270fe062ae1d5ca0bbcbdbb

SHA1
127f17af475ce8eb6e39da17f735fb6825f21083

SHA256
7dbed60aeae57f04df39dd6b2622d9bab892e3b79278fd3c88417199784743cb

SHA512
51a6cb8fb197ebe75945cef70c68e75b09d7e9fdbbfb6a3d34dab19e59cd580a20f19bc35ece166299c37be3026ff3aceea4edc3fe69af58c71a4374f22070c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3e038d57edd0a0dcbb62ef1f7dd90312

SHA1
ab79b1918d94659cbf895be5e1e0a8902550d725

SHA256
c4c0c2b27a92c61ca8fcbd390388012909d92d78a2f9c93fa22042dbbd913c1e

SHA512
f4fa58bcf181364679e6570e22aa1b4e7024d69e1036e901d31992de9de3bb125ed16e6ae631eaa19aca686b3d6c7d86940e3298f0a12eda9a2b230df305bdfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
713B

MD5
bdf38879652ce0c3d4006f8b0b311972

SHA1
2bf401bc6971910b2418c3e37d9b4a9a6432ef17

SHA256
9a124644d8ee8974df1041f1294557915845671747eae9000affe3f7186ca183

SHA512
37722a7badecc641b9076d9dc057f88a710a03852c67b25f0eae065a58a7032691d5b86894dc97d00d780918fdaeee1065fe8ea729c8a77d51c670a1b1d439d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0ab075d616de2b118fca253c4ba31fd

SHA1
20e16195ac733647ab82bb3814bf9ae073bcd40d

SHA256
7e30a3390a89296acbf4a8ffb55f6e597de87da69fc6c4046e79fc46b21da362

SHA512
7e120faa2b6003e633f31fd076695691519d1a853d7c03904be366afabbe6d66f0d64f3d0ce9ac7dc6be002e14035d69f4e41cca603a86ebbe88e580eb968314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26c2b0d8a9337c73b780a7c655126bf7

SHA1
3a41d646510dad955e1ff21625899f342fff822c

SHA256
7e09bd13aa2a3bf3e624e3fb335417b8e0142cd099f44890cf0310e1684954a3

SHA512
7c1e007ec5b6eb2eb0d34ad67cb7375b0c1f3e33058cd832a9e0bed6ef5c31fc45f7ebe946118d7e8f69c2a2b81ca16aad2eeb4c4d84f6261b31eb615d1d51ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d2f23c1840a6b31aac376a11c06dc82

SHA1
320fca2f35d1e56278deda072e7c4b03d1f41a87

SHA256
da18aadea677c98b8ffa6f7278c5ab55a6153233882f1ed2f88e67845e50fec6

SHA512
37e21a44c8ba60ffb9ea8296a583ac809175bc61d8960c12e793138512d6d382045baa14be40ab1d3a10a665676670b2e6b38a329fb957ece51881d002832678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f08a1b67956b8e3843c3a2e49d035c3b

SHA1
553bfae9e24d7bc6c94a4279317d91ab1d79ab32

SHA256
d8d6960772e0eb1f1c6b9741f3f511ac86e5cfac22369b01252685e1268f8ace

SHA512
6a5831d8e9656577b69f00248dbd10e3d2ef43afdd8026ac8e1fc34d5e8c739da504e7f8cd0528fdcee765c345dc1caaa249689dd10f3fe3f80b10dcfc37b0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
220dae0f5be7167fd016f53e6788bb6a

SHA1
ba8150355f31150b1520ce04a76b0f2c8e3d4350

SHA256
be60a9f5e1510bf044a471005f39fa664eb24d0b3c134463930202dcd7d6f1c8

SHA512
cce2c8cd07e2795e39bab23d2f93f81eaeb1e1e2e910e5ca0577537cb33c1a6edb7b25008777244a5ae1f271f604167ba538e5ea2f4ad2d09890b6cc0532251f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7276904639215194f93ae8650e58de46

SHA1
ed367c7961216dda0e785d088ee9e0e561e4e6dc

SHA256
69d464d0f0d9ff3bc78c6be975552f6f472c8cff05785e9042a4eaa8d439bc7e

SHA512
967f9f9cfa809bb16fdc088154fafa4b16adaad92bb0ff6e151b4a97ff3d4866f20693432feb1403e23aa991885fee6bc02820a5f8bf48a4d1669628fcbd2e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e831c426f8e856516d1e323023104ae

SHA1
6fd725198cc6a71a4420d45cbfc2266bb177d5c9

SHA256
54d8eb16b81725d702cf779075f390659a2bf17a3299055f909c8737db0207a7

SHA512
0410fcef9c173946ddd7ac578665c3495e63ba2bed7d5b3389890e9bd765c85851eac0547813e465a5f9b88373cb6f476bc8edeb084f1e908e14d0d953b8752a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582054.TMP

Filesize
1KB

MD5
e1b81a399797c96f15add58c6c8f4ece

SHA1
d50397070012cc6885e9cf05fa3b6dc3f6f191b8

SHA256
4ce6e8bcab7dfb1cb33f422307122a66b2bb65a82ff80576c414da00cf55089d

SHA512
d7dbd03bbe1fd6825a28ff8207c476c6a8daf10abaa54d8f23a794647276c1199ee4d5a0c4a634baa4696b87282929c978a8fd12097e5cd584763cfda118efec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef5748aa0c68e15f92718e33d653eed9

SHA1
208cf82d522370b79be28e62f306e33cd8fcbd7e

SHA256
b7977126d1cc0057fe68739e0d8ce86f851b9602968bd69640c547f230f13540

SHA512
e9faead3eb5efc44275ef7fc9e946f1f790e3807ff2dd14599fecfb76a5b62e3a358bbe83e0bcf1df334ee244ed9ad4a27122f9a0946c16d7463062a72fe159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60bc4a4c3ea654dcfb4673370d7aac8e

SHA1
1fa41a11f21edd044c24d9b7678a8edc23249b05

SHA256
d84070b6fc7aff340485147a509adaa92289b4eb2d93d3e4afa9f1623fc8a0a4

SHA512
569cb4fe671ee34c6220864d4031f3bd11406b7961371da98093414209c56134ce50a6562c069542df66be03348a4be8c5345c7eb085b3d97aa28808a4293226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3422df2f4fa74bb0e786f6800a414d14

SHA1
ec33dd58b756fe2ec1229d9fba8c210cd404e8ed

SHA256
ad3c2809c755b3ab3adb90c80e29fc30d957da6ba287471769c30cd03e9b0c57

SHA512
d1d0e72fa95e616d752c0f617ec0724118de5ba7d674ec3f6a0bfe4e40d78624e666e8530989b1df333bd0df34e1db4a7b67748744ff8b5c61448165aa30f184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
a9582cb9912fd847e8bbcba947ce4987

SHA1
c05ee133c580bd97ad8c050b8b3a8f3fbd9b7566

SHA256
9d6d60adb6cbafe9d3e0af91ccfe8bae7f105db861763292ba777c3684056465

SHA512
5cb7dce29e9802d86f78843aec0907da4ed704989d3a1a507e5424c9386ebfc6f27115399cd9d12e8738e647099ab03b4e281065dba98d2e06100aeb34ab35cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
169af63a69cae6635a2d4de707a8e874

SHA1
cf9d42920cf907a0d42e9ef0a0e4a8d38777f9e1

SHA256
90f4e434f8230eaa3afb397d0399254fd7d84fc20fb6f3697ed123cd1d02c8b5

SHA512
17f9b0b57ad2d26574e2cd5f733dbfe0c0efc0398d993c575407f8313991da78c3a9697004895e6fb020b31e1accbbc5f36eaec323f4361be77fe2a9fc2a91cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
2b3e3ea3f89c5b5fb1b6221f5f9a5ebc

SHA1
fc1bb07be29de3ba89a577ed675f6da5dc5867c4

SHA256
0e4f1fffe4426d1cf174c92cf0bc9585055c17e9191928e2ee11f220c003b947

SHA512
2ad5a7a1fb44a91ce821c015e9cd2532c4d89a254fdfaa5fd7165dad800cf56a5b880a0fa2f09511b06cd0edcd7b1a5e1c4280d782c92c2c87ed3f35e2b57789

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
3a18e2a6c85b444c78b2b76f035e5b27

SHA1
93160f8f49b5d890a22b19555a783f450c23c53b

SHA256
08e04e89833847beee5b01ca5a7ddafdf1ce3c0099a43a7ad0bba2defc0dfd4d

SHA512
82ec037bc3591832b1e0ccea013b768d4bf066491c0afebfe45a979e694c0fbf0a7d23aebf4b6ef0594ca765538ebecba7b59fc004beec632eaa16022ba0d151

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
fe29f4b2f557debf60ab287c24be405c

SHA1
8855e2f0c505cdc617a27b76cc6c804cdd7edb9f

SHA256
637baa07df0a9861127f3b9ac6ef376320e0e9671b3bf82c209d3ea109c2c765

SHA512
c9bdf28f9a342da0c26084f7abd1041720b48f99fc2d44e5a808f80b48bae49db61e67e65b598b08db11c967c5a6dda775cc33ff664212f18caeed5058617e07

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
95abbac265aa3caa970602a5efba0e7c

SHA1
c93caee9b9b02f7b79844f280ebab6c39b9f2158

SHA256
69785c292caacbcca30b7cb90d4a23fd1a49dd9f58a0be2f60941ff4194ca565

SHA512
f2a0e6d4ec221e5564f984ce61e50ceb2a153cf879777a74e8e3400535ff08696d36d455111fc7027d9fc472c0e83b5aabf41e7af35d58c8f29b0cbb1bae11e6

Download Submit
memory/464-58-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-45-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/464-43-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-44-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-41-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/464-42-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/464-40-0x00000000071F0000-0x0000000007200000-memory.dmp

Filesize
64KB

Download
memory/464-39-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-38-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-36-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/464-37-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/2888-626-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-630-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-659-0x000001410BD00000-0x000001410BD01000-memory.dmp

Filesize
4KB

Download
memory/2888-658-0x000001410BBF0000-0x000001410BBF1000-memory.dmp

Filesize
4KB

Download
memory/2888-657-0x000001410BBF0000-0x000001410BBF1000-memory.dmp

Filesize
4KB

Download
memory/2888-655-0x000001410BBE0000-0x000001410BBE1000-memory.dmp

Filesize
4KB

Download
memory/2888-607-0x0000014103870000-0x0000014103880000-memory.dmp

Filesize
64KB

Download
memory/2888-591-0x0000014103770000-0x0000014103780000-memory.dmp

Filesize
64KB

Download
memory/2888-623-0x000001410BE60000-0x000001410BE61000-memory.dmp

Filesize
4KB

Download
memory/2888-624-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-625-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-643-0x000001410B9E0000-0x000001410B9E1000-memory.dmp

Filesize
4KB

Download
memory/2888-627-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-628-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-629-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-640-0x000001410BAA0000-0x000001410BAA1000-memory.dmp

Filesize
4KB

Download
memory/2888-631-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-632-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-633-0x000001410BE90000-0x000001410BE91000-memory.dmp

Filesize
4KB

Download
memory/2888-634-0x000001410BAB0000-0x000001410BAB1000-memory.dmp

Filesize
4KB

Download
memory/2888-635-0x000001410BAA0000-0x000001410BAA1000-memory.dmp

Filesize
4KB

Download
memory/2888-637-0x000001410BAB0000-0x000001410BAB1000-memory.dmp

Filesize
4KB

Download
memory/4220-463-0x0000000005840000-0x00000000058D2000-memory.dmp

Filesize
584KB

Download
memory/4220-462-0x0000000005D50000-0x00000000062F4000-memory.dmp

Filesize
5.6MB

Download
memory/4220-464-0x0000000005810000-0x000000000581A000-memory.dmp

Filesize
40KB

Download
memory/4220-518-0x0000000006B30000-0x0000000006C52000-memory.dmp

Filesize
1.1MB

Download
memory/4220-461-0x0000000000E00000-0x0000000000E08000-memory.dmp

Filesize
32KB

Download
memory/4712-523-0x000001EF2DDB0000-0x000001EF2DDC8000-memory.dmp

Filesize
96KB

Download
memory/4712-525-0x000001EF48B70000-0x000001EF49098000-memory.dmp

Filesize
5.2MB

Download
memory/4712-524-0x000001EF48370000-0x000001EF48532000-memory.dmp

Filesize
1.8MB

Download