discordrat | 7896e31c4d4530334ef0ce3bdee08ff23585a917ecb08e9cfc9388366522fe2b

Analysis

max time kernel
562s
max time network
561s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-08-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blender_cpu_check.dll
Size

20KB
MD5

9f92d056f2137ffbc5732913ab50cae0
SHA1

b0a639d0f4b7a29a01f99c94a2e8320a2eebb1e4
SHA256

7896e31c4d4530334ef0ce3bdee08ff23585a917ecb08e9cfc9388366522fe2b
SHA512

8d65fb3fabb0a79e4136e4d88aba3ab7f5c703da9681c10b3bea3ad87faa149000da0dcd098bff7da35509c0504b3eebac0037b0b108430e7b15f5b81f8ca3e0
SSDEEP

384:p87aDEFh6h2zg4NrBlv//buu2Z6kkDhCm/Rq:p8ODU6b4Nbn/6u2Z7TKQ

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
nigger
server_id
nig

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 2 IoCs

pid	Process
3852	Client-built.exe
2932	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\羅ἀ蠀ذȈ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{F7214FC9-00C8-45B9-BB9F-E01C47ED850C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\羅ἀ蠀ذȈ\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\羂谀耥\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\md_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\.md	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\羂谀耥	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Discord-RAT-2.0-master.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NotAVirus_v1600.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3348	Winword.exe
3348	Winword.exe
4044	vlc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
780	msedge.exe
780	msedge.exe
3828	msedge.exe
3828	msedge.exe
2256	identity_helper.exe
2256	identity_helper.exe
1316	msedge.exe
1316	msedge.exe
1512	msedge.exe
1512	msedge.exe
4612	msedge.exe
4612	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2408	msedge.exe
2408	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
716	OpenWith.exe
4044	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	Client-built.exe
Token: SeDebugPrivilege	2932	Client-built.exe
Token: SeDebugPrivilege	4640	Discord rat.exe
Token: SeDebugPrivilege	3664	Discord rat.exe
Token: SeDebugPrivilege	2960	NotAVirus.exe
Token: 33	2276	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2276	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe
4044	vlc.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
716	OpenWith.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
3348	Winword.exe
4044	vlc.exe
3348	Winword.exe
3348	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4928	3828	msedge.exe	85
PID 3828 wrote to memory of 4928	3828	msedge.exe	85
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 4136	3828	msedge.exe	87
PID 3828 wrote to memory of 780	3828	msedge.exe	88
PID 3828 wrote to memory of 780	3828	msedge.exe	88
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89
PID 3828 wrote to memory of 3956	3828	msedge.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\blender_cpu_check.dll,#1
1⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd6b2f3cb8,0x7ffd6b2f3cc8,0x7ffd6b2f3cd8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1652 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,8579615351843855914,8630659146421509499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:716
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\Discord-RAT-2.0-master\Discord-RAT-2.0-master\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3348
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:4932

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1788

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\UnblockMove.vbe"
1⤵
PID:4600

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SplitSave.mpe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3944

C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe"
1⤵
PID:1464
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PlaySongs
  2⤵
  PID:2192

C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe"
1⤵
PID:1708
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PlaySongs
  2⤵
  PID:4056

C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe"
1⤵
PID:200
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PlaySongs
  2⤵
  PID:4832
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /SerMolesto
  2⤵
  PID:4824
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /KeyCaps
  2⤵
  PID:4456
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PocasCarpetas
  2⤵
  PID:2352
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /Hablar
  2⤵
  PID:4444
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /AnimeGirlWantsCreditCarInfo
  2⤵
  PID:5076
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /AnimeSomeoneWantToKnowWhereYouLive
  2⤵
  PID:2492
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /ItsASimpleQuestion
  2⤵
  PID:4604
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /IsJustCAPTCHA
  2⤵
  PID:776
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /IsJustBSOD
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NotAVirus.exe.log

Filesize
1KB

MD5
8e0f23092b7a620dc2f45b4a9a596029

SHA1
58cc7c47602c73529e91ff9db3c74ff05459e4ea

SHA256
58b9918225aee046894cb3c6263687bfe4b5a5b8dff7196d72687d0f3f735034

SHA512
be458f811ad6a1f6b320e8d3e68e71062a8de686bae77c400d65091947b805c95024f3f1837e088cf5ecac5388d36f354285a6b57f91ea55567f19706128a043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
37KB

MD5
a2ade5db01e80467e87b512193e46838

SHA1
40b35ee60d5d0388a097f53a1d39261e4e94616d

SHA256
154a7cfc19fb8827601d1f8eda3788b74e2018c96779884b13da73f6b1853a15

SHA512
1c728558e68ed5c0a7d19d8f264ad3e3c83b173b3e3cd5f53f5f3b216ed243a16944dbe6b2159cfe40ee4a3813ca95a834f162073a296b72bbdedc15546be8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
37KB

MD5
93acf02790e375a1148c9490557b3a1d

SHA1
78a367c8a8b672dd66a19eb823631e8990f78b48

SHA256
4f2513f353c2cdd3177e3890f216ea666e4eb99477a56a97ff490f69a9833423

SHA512
e6354f4e4d35e9b936a7ddaebdd6527c37e6248c3f2d450c428903a32d77439cab78020a45834379cf814a79149c3dddf4e1280b9d06a7f972e5f8e61c463d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
a6d2a865e9f16ea305950181afef4fcf

SHA1
082145d33593f3a47d29c552276c88cf51beae8e

SHA256
2e5d94863281987de0afa1cfd58c86fde38fd3677c695268585161bc2d0448a2

SHA512
6aa871d6b2b0d1af0bda0297d164e2d685bc53f09983e5a4e1205f4eb972a2017323c99c3cc627c3fb01381b66816e570f61d013d3775cddad285ac1b604cdc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
20KB

MD5
c4b8e9bc1769a58f5265bbe40f7785ef

SHA1
07ff14df16d4b882361e1a0be6c2f10711ddce50

SHA256
2786986a3139e9722e667f81b4902609a4cf458e1c16206cd11feceee0254192

SHA512
a39157460b523ee2b9e1eacccf7aed99ff002767a8f87287c1c4662b6711b97f7d4955df64a86a882417fe71e598719e3934e14f787c1e6b3348c8a4c813e3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
17KB

MD5
109a8cceba33695698297e575e56bfad

SHA1
2b8c6dce1ccd21a6eea2dd9aef2a8a6bde389053

SHA256
dd82d9ac034f0a06524fc1d5ef884c29a7e4d586a1e7db66e339dc54fac3636d

SHA512
6d51ed30c45560838df921212370a0044640a8e3c0433922106225cb6fec8cc115ac6191c753da13def21c4e0db4deb5782fb7a75ada822ced1db7c7d13beaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
57KB

MD5
919d13ecf08e3da7e9f337e7b60d6dec

SHA1
3d9bd4aa100f69cf46ad175259edd6ce9864830c

SHA256
9d4575044d2efd5e90503beda65571b5158a3f32d999191ac1f82d1a5ee62ad0

SHA512
98d8236ed1c44826b4489b9fb7b76c62502a032547374446c53dcf2eee2f5fe3548c6587fce66df9d075294bc2ab6be97c3cb21457bc899451ebd3b476715985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
19KB

MD5
f5b631335f170065edf1b148e10b34d4

SHA1
ca34f82af577fec763ed38f0436d20f1cf766f62

SHA256
99be964ed51ca453ccfaa264a1ea9490da11e32b53765919172b6d3749a9f846

SHA512
c66791cbdc7c0d12e7295eb26eb583b26e03692c8986ab7d5dac0e6a561b8b68a8a9e33814121efc700ff6b472aa4f685162b0c75439b144f12286c9e28c7cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
137KB

MD5
a336ad7a2818eb9c1d9b7d0f4cc7d456

SHA1
d5280cb38af2010e0860b7884a23de0484d18f62

SHA256
83bdfb7d266fd8436312f6145c1707ddf0fb060825527acfe364c5db859887a3

SHA512
fa69455b3bfc162ab86a12332fe13322dfd8749be456779c93a6ab93e1d628e246a31a0a55cdba0c45adb3085acd62ba0a094b2115529d70cb9f693f3b1da327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
23KB

MD5
bc715e42e60059c3ea36cd32bfb6ebc9

SHA1
b8961b23c29b9769100116ba0da44f13a24a3dd4

SHA256
110ccd760150c6ac29c987ee2b8f7c56772036f6fe74ff2fb56c094849912745

SHA512
5c0edd336a6d892f0163aa183e5482313dd86f9f5b2d624b3c4529692d70720f4823808f10ee7870fd9368b24de752b343570419fd244c33ad2d9cc86007bedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
ef7c7eb0c2ce70bccea9d4636ae5f9d8

SHA1
613e093b53b568a41354025e29af71f17ab047e9

SHA256
b23b9753467d21c3c1362d46e487be83a5dd49d69c14a839e46b81dab42cd6ab

SHA512
18e2a1ee35959af23551a329d4bd70bf376d04c67508503b1553b3a1a27712eb427c41f12ff9b099f8a5badb97cc8dc106a1698e5ef55afd6580edb76546ad71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
38790ec666d44c50253c25eae5782d4d

SHA1
c84311d96d5b62a7dd649347c925d6242621dd8f

SHA256
b3ad694849bc389451210535d488984bdd3c54d54c378161f1edff8c2a41a7bb

SHA512
4124379dbcccefe2b3a33c0dcd1a17f3c5d927f1f80a89271fbb428ff261bc929906c2546376ecab12e72165966429549f9bda20e7abf422acc56884299b8031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3794f25ea477db0e6f6a1ece483fa337

SHA1
e416d51dc2f0c8989a82875fe32d4de8fe8f13bc

SHA256
fbd020c47b3170c649818f23a5f0e20e39731c8f36c9e614c9bf9667e2aa14bd

SHA512
a9d61c6e486b95f99b17d4379be20a0512d34baf7099abfc713805d548514fbd74bc12d4207484a94fbc1197156abc6ab54798232a400d3c24454fbae2448004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
723ef8c795bcac2ec1f69868a15acecb

SHA1
5ba685573f67eeb4bcd2c43503b8b8c0f095d221

SHA256
8b4d094dc493b23d7204d820faea9ae31a8c255fb617cfc8c21328db6a13df2f

SHA512
6c530bb9e8c3ba3c0fd89e3c545760a9f8f913b4086efee6ba97432aa39d442267a24057c1ca976fbdb0f00c2c9f5c1f65fd3d3345752b851c1b99547536ccf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8e605f841cbb43edbcb699e4815fb260

SHA1
7d15d72c64ca9539223306af6a9e4a1359ee9a45

SHA256
87f7ef5c55af584e58c1dc3c75aabf68bd8cdda980c9822e466a0ed6fa74a328

SHA512
b03ead8515c7d8f7c0e25476afb74cea75c933e2892fa9309d7e7a9eaebb31c6d7b6a61a7198d6431d0ce12c9cf9ed7b9ae77edeecf764069a1a8e1e3338de76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
14e2c74236a405ba645f0a8aabaeda43

SHA1
198f38d43ea3e5dc493f4f9b6834a54070fdf2c3

SHA256
9c5f3bf960e6e74cc20560549d325afa7b92951f3d2752ca508a4df0508245ac

SHA512
af3f02706bee47558a7d50bc511165ca67075869a1bdac31d30dd9d5bf82651a0704f15921d52e42903cb4bb920fa3485c89026e93bb013795c37766b78221eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f8abb6af99adced5858dd2b113f15fb1

SHA1
fd2fefb67517e08c1c89169735e2a952bfca7905

SHA256
87887354dade6aabfe2809e0b4d344feda1f69518e27fb56c926be835a6d1ff9

SHA512
4fe8db5616cc020f8faf7b13a2236a2dc1f80e868af453cc03ddb92da251f9ba18670c101b3a298ef506d6120b078421496b202a564e156969499ae4095c0938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df07b0eabb114e6cbf97336d92fc4bf2

SHA1
576da608f1caaa1676d05681236fc822c4e5bc42

SHA256
6ea29c8b429e6dc8ef9f130119b52b49dcd3e7a275c679041ea3061b00f010a0

SHA512
4b34061ef7047e814c9613591662d5bef1fd898d60e51ed42351d104d566eb92f39d0784f451825f45c667db1db6727e8aeb30277a6e2cefca330e776ddeac11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2aaba2e2f7d5996f3b6745056ed692c

SHA1
65595f108626e4c4af52de8823ec04d64b3644ed

SHA256
d53380bd2b961306975039307b3088f0522d1e6af9f5ea88085ed09cfda55256

SHA512
228409e0946933659fd46b07d4744c54d966a3764a2562f328e2a1d3e6f42ef5ea1c212fc00c1d41d691411e1c6d2ff51a66a479784550f5c66dc64b591cff28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
902fab01b46b78d9f700622101f81031

SHA1
15a759d325ef31237bc736b13fc6537207b58021

SHA256
6a80d132b3a0c4918029d3a71e4a16c7069c8d3d509a94b98f845104a88a1c7c

SHA512
8fdb2606f4366f72c21edca5edce2551cb812d1189f7cefa41872aebbb2e2db8ced93fa450edd4c80ed360475e86f2f0783802fad27eae526e40999c3c6c2599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d2af7a4c89644af06c2b45d5d236524d

SHA1
fb690cf887af75a6a8d168e110756898e91d0b11

SHA256
81c5717123dfa5327830066f43a8a2102b077a7698183e9a380806bfcc9a52fd

SHA512
a846fdf838f2d61a591f6d5e07f6831a5f9ee9ebf32c0187dcd81ca4a86a82487a439f042cba054092ff730556fd44cf4f2e8ad38dfc62897697962c3e71c5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0e6e7b1daed1100137f799bc5b399e9

SHA1
8f9f6a4699d924219cd8359da5791562f6523912

SHA256
931f3cd706653bc30eb4e783a09ea5d8f402ea64afb9440b27202d9d9e4c9d86

SHA512
96aa1715f3ffe726100934623abc1f42ecc69425d27876c201f15f3e972d137bcfc9adeb75dd391e179c2cba77e0f7251d3930d4a90ba5f6f834d4c2eb7e08dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf60344398fd7aa34b53695584f9c146

SHA1
1d3f271f6978729d9e85e144675f1ad4a2608533

SHA256
2bbd058c77e23ed6761a434982fef072b1f7a83e274c82eff9d4c96092aa4265

SHA512
e298e92c6f4fa303ddf3359883dce89af6a8aeb2de9dafe8b77a680ec699fb843550be9c1180419e663c8335885d6788e9cdbdc5b74e4e2caf17e96b74ecfe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
357e081b5383931ebf209af77375204a

SHA1
e3280dc46ded08f93ac7910e6962878dd030a479

SHA256
b27b1cb677f9cff3d635a84104fe161c837b568bbd1814731ccef054895cca1b

SHA512
6156b3d0c77fce007ef35f69bb173ad2d3230e1fdeb19ba75b612004b072fc245b7bdd7ca9eb87df5543105c5e101e0e49cd4cb8f6cad506a25a0df4af6b22f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
420dc930b20cdc1203132fc577e9bb8f

SHA1
13b56edf50d6d93707fe3cfcf7603bfe53b55b69

SHA256
2a93e3fd4ebbbb3f36e3da1d6473d538ca9032450e3655c86826eaa687b361a9

SHA512
b9b620827099d10e83689c0c019c03156169618e4d5ebbf05bc2997ad2b036a4702d627eb16b7b0249094e1cf56dbfeab5795c3ac9fa2f08e626580beccbe90b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
224bdc020062e5876ddb47efaabd34d5

SHA1
c73e8fce741be305e325f40b35c8671c3c1bc8cf

SHA256
ddb59c26ae6030b9c851bf6144f2ad522d3d483fb262a59ad87b7e1ec32048e4

SHA512
2f0d0a7fa142ea5a3dc068bf0edc15ff0f78a2ee76089d54999d5f9f53268a7916bd8e1a297f9efb944f482524caf55c24c6eb907e095d9eb7dbe8b06d660e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4afdec8894881234937ec5326121e84

SHA1
19b4771056fb1d5b317831507ce22955fc9fe261

SHA256
273182a0ce2166a67b94530247608fad5cde20b0c3b5518bd77abd2e109437ea

SHA512
85cb8ebb7bc58864f0e5ae39c0096e5363287406b039c4da5349d71ae82b4ae12a8d1260a8ca260084056929654dd03619dedf4dfe4264e41788b9b5a013c40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
94f96952555ed8f49336518b1c89bb52

SHA1
4e328ae68dd546dd5d47045d004383ae1a978ae8

SHA256
58291e608e14e9c66c8b4c670635c163895db89e4ff43e432e8b0032c6fc1098

SHA512
fc21c766461b7258fb34be7d6962ed47894b425bba16fc1d471046ddae98e118ce5e4aade802331124aec11f4ccbf781474914f13f73be6dac4f0bb65112fb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bdf59a3036264b47a04856acaaad69d5

SHA1
5f18cb93daa3c4fdab415d1aef234f51f386f3d2

SHA256
48b4d047e7fa1fffad6f7ac63f9f0d3446eeb82c4e14ceb268ee7a7050a2ecd2

SHA512
840c4788416d3c7aad94ce06f705e2be205c72470d002da73e9679ead52807c05cc89c45b86bd0dab4bfcbe7327f4f3d47949f48acf4742aaf671b20dc4cb27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67628563555b8bff2ccd47dd6741764e

SHA1
6a3664c5a1c214b06476eb0240cd282c623908c4

SHA256
5640baf2854cc9baec9b6907f380a17b28dd0b7cb9c0661dc47d3ac8e4b1a66a

SHA512
f4c5b6c08859f4a7535089c5e3c4a8a03a7ad754f9587455786ed05fb2351db94bec0fb551343a36ac9ded8231427f52646c0a9f28e7e0e6a716a5d619875779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80429cfe7d86f692341079569cdb37c3

SHA1
c97f1fe296bf37eab5ad5052d0ea9609ee824b1a

SHA256
1b5372a548f5dc8729b8017ae05046f615af4376323ac1d2e388d867c697cb15

SHA512
171a6c078c8d0a19e2a1153ca7590973a7c1b8f676a3e38993cf966284b14a428f5a7d0658090507c1fc6fdc0b63040ce2c1b6a8a2a9debe931c2cb3735d0fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a834b2775caf4891f61b4fd5c0a90f16

SHA1
2e6d2cc13c2e849356317d04f0ae937157857f83

SHA256
66aacb15d54c48b3657b9f365b664ca55d90f2fecdad824e27e01ef9c1d74e9f

SHA512
3120de1816a102784a821484d125da3474b2e3215d9a5c385b0fd72c698e74d00fe1899f86116dec256b055e42b8a4fd5d6daa491c8f189da7cdd2b624c84990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6ea520f722964c0d5636e949cb00041

SHA1
6d452572627f663410802fc224c3bd9e88a9f1e9

SHA256
9aafff7f1aac2b8e401bbc5d630d23eb5ac3aad56ad805302f9ff45eea624f09

SHA512
c225f3d4e4f7873913beae0483b1b6a3d396aafb4bc40483d2cfaf4dfe1b9d622c4330ac3f51fa11d4ac582673b913f30581006707dc55d29253a8dce2ca8bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73548cac24b697354da3ea90f614b39d

SHA1
7731a0fff24dfb8ca46a098078e01d58e10b1f98

SHA256
c470ca3a4a4ace3604e4082ce6de7ecf0dc74db21f7bc6217c7a9c24bba85864

SHA512
c78d9047c21f1d1b59825272e73b127b3320341a4acb40c3a93564902f54e89aec701399bca49bd3f47e0579b562fba0387e190ccff4ca1926fc4b27486ed6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
760efdeee8fefd1e946fe11ab012dc8d

SHA1
bf918a50873051956b7e45199e1c380f2475adb2

SHA256
1a75f5807b61bdb5589b3a251eb076d912519cd61c2c732cfe4c844d98765a72

SHA512
7f2d70b7053d78c100cd6a4fc9385041446a34e4b4184bc3e22ffd10ebe36b580e9814738f385d8e3b3040a8c526e0eebb313d0b97436356b892f63f2a467d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da7c0793b071f08b698bc509cef06caf

SHA1
671b08844e57568beeb67236eed0bcac02402b58

SHA256
ab6757e053c239dd8656f5deca97fff80c033cd8dc8f89e4c25e10b14192e473

SHA512
b1de83d0c0c1aca5af0ecbe31f97168dc5b1adc95d2bb561f90dafa75e6961278d5ff825445a5adf4c426c9a2f99813a1eef26d6021b04872eccec0cea7c06dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f185c8a2e48864c3846d2d925443d85a

SHA1
516d0b05a713bed2f1abd647004073608d34fb65

SHA256
91af3b8501171e58427507eb160b9c1d2f81150925a27662ce360a1372af1239

SHA512
5788ef21b09a64c50707890610ca871e56edc3a520fc88e9e3f0beb71582aff3748746c3c3485e2d357ca2351bb613cf3fb87979d397ca4410536617c0988f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587829.TMP

Filesize
538B

MD5
d68abd35ca36cf5baabac3a7bbf390bd

SHA1
16b21c62b2ec50aa1a07e15ebe044405e5b54033

SHA256
dde9f0efaa8079435ca0607b242a66094fa189eafb8fa51f4a09515bf284d994

SHA512
636f77d2dac5890ed323c6ded3a1f6990ad219dd149dc3478867f751cc82d6fe8ba5d5833d3bd23a8d01d3ccfb438f2aef16e210cb061726b12d3f4e696e579d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe2600cf-da21-476b-afd6-85c9f5e3b569.tmp

Filesize
1KB

MD5
4a57b944d78159cf75617fcdfe78b4dc

SHA1
737acb85970ebda306e3fcc2c0668e1c6e16c21b

SHA256
8bd48a59f6c004acce03d922687df7a939eb9ff21eae6ccd3444c1a7d52b6324

SHA512
0b94d230e07caca7cb8502a6c5ce61cf4e3cf4c5f72ba608f898c69bf00b7a91e3473c4e1744ceb84105c94c4b57832877a2795a715206e89edff86216eaa6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d63193e991daf8c50a70548d5a2b296e

SHA1
1c9e2f37ef633e3316c7dc9f6f6307c0fe6ceff4

SHA256
decb7b6a6b8f9adf7f6ac59c7647383a1a4c8be332cacd9437dd13700c60ed17

SHA512
d963cec9e5b5ac200c0832eaa0151fa0b983cf47e915ccaed0ca308c40c649a533fac201172df57ba09df26d0cc23659299f12d265b0c5d3d42d587ce39d1e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d92ef94cabb772721e122c5a6566e85

SHA1
e2b685fbd7ca4a31de2d30de8a715cfc612bd44b

SHA256
614a335e7123835abba51c8101849bf3437f60b336d3fc1df2756ebe4eda75b0

SHA512
1722cd749af0329ca9d4dced151101e8b00370229449e10ecbbac6b7a8495b548000ef95d63f338e705fe1c0b04976901daba4e1728d8eb4be498be534f454b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3526a5e4b00774bc554fc040877a6f9

SHA1
10ba55628b8ec0544a84b81c00d8a822211d900b

SHA256
999017876844890f78c3c2af7d4ffd837c82d1c997f712cbe5ad8c417bfeae04

SHA512
727d3a4c5d3629aa24a6e5faa9782ed42cee32ccaf9600c5c95ac8628ae4e447f2a1fd3f17ccdd04fc7a48fdbcc2491c511da18dbea74c44c79ddc5d06a49b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5fdc286ca55ecd8bc529924c8dc46466

SHA1
343eeb3f3d5ee7d2b7654eaa549f1eec9406c418

SHA256
1dba772219a4b0ae089d6bfb008ef8979e619c2b1a2b3623ce5d9593269677ad

SHA512
0b2f73112693dcfb7ff058af71ac8abacc8b4fc54ef3fe77a6cdf2dff04b1ea94166c1b937d43ccc2092dbbfc88c424c58630b8d0e84fa7f159898b04aa0f749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad2987c0057846413f5116c4336eaaa7

SHA1
26c96cc06b550c0ad54f022d806bd1aa03b66ee3

SHA256
b47d1f074275bf215cdb27d31072811c93fdca6f6c7e906312dc4ed50a1c988e

SHA512
b7db47de8c71da20856dd19aa4eaf1cd7db58e20f352cc8a87b16a9e51a93ecee193effce0a0d37f52a3034260858a65b9f71d581a7d0d25f40093167834081d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0001.docx

Filesize
11KB

MD5
1c89cf28b9668a36419f93c73e1c50de

SHA1
67c80b1199eee82e6947c9a90b9a11a951a619ef

SHA256
72b6f3d014994ff909a9c6af61945c8803f2e901778d020feb552b2748257266

SHA512
808f61632849472a55d6159894d5e2c0696f4469cb60f0c9846366febec3299f53ea1232baf0538a5bc2a2396c3e26932a8723ac7f1f56a68af9ee85d4f485d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD0003.docx

Filesize
11KB

MD5
413300dfc93e7691f718172c966af447

SHA1
c0251cae2e1c224e34c6729fdb6f1cf06f7160a0

SHA256
25502c73dcd2ae75513c5d6078568db4cad95674bf44bafd20e7587ad4ad3ecf

SHA512
26b9bac754fd453ad9434f46b9d8b43dcce0dd35e7e2eb662daa9113fc3be18834881ba66b520fcd8fd2ac713d3bda947d1d6d31ac2baff9875717b93a42a9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD5233.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
407B

MD5
1ae449a9cd2b9ee7e7939c95d00969af

SHA1
6baf9e4fb5ebe0bb1c14a2f27b91def06aa7b620

SHA256
2b504f77af95237426026259e852257b4a4fb67e3bee3aa2785b350a3526ed28

SHA512
5c32ccb5be7b531d0dc787bf3fd8268c6e1be86df90900381a8c4fc037d7c6c3be8c7b4006cb486940fdf0ab2108ed436b12491325cb3a20adfb7a2711a191fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_F312DE4DB6FD46D0A75D7A4F37D9803B.dat

Filesize
940B

MD5
a72f4c2d02c1ad85ce08b83551982485

SHA1
7579bba49fa880abcd1bd1fb4c775998c2bf3adf

SHA256
3b1286652abb65d2e52efd3be5fd50944f8c5f6fef8791868f4b202031a04b3d

SHA512
b55c0a1a4d4c3cd499d677fbf70431c4ac7f263ed0a5e26320f3bab35d6c7cdeafba1bb44ce414e16cad038e97e09124dcba164ddb06ac9a2e72fd2204a181fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
4d3321d89d653a2035f95e67079fd651

SHA1
08b94fcb9c5201ce6df0f6d58efb1f015ef4f894

SHA256
b2aca47bf027b03d831fdc491922e03333fb20d774e810c03cc17dd4d7492a19

SHA512
c8f36deac1e85b1d8280aba3548fc6a80407304463bac671b897e03ba128fbbd968da68b6608c6fba5e7d602d4885e6bf2a68a56e2e0435f0f962e112bc3666b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
cfca079726268176393e8d3a6901ad67

SHA1
9490cefb42ddc7cad5b11923c664e5bd4514d7cb

SHA256
5d8b67831a6ce5d0e9d8683d18170417543f1fd7fcf77678c3055a473114f191

SHA512
e00d79dd843f55eb53ba6100946c2f5c2d8ffc9b615d937796e38322d2816d7997368de42415511f91bbef04d52228bcbd4999c6454519e205f5ab284968aa5c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
77B

MD5
51957cae31ef42c14ca38c9a96c064ec

SHA1
bea4bd9c6d298f194477a63b2956136606a544fd

SHA256
b6ebf7940b9046eddc8e4e2c7f4e7fc1a3a627ad1c1235a09227bfc05865c5e1

SHA512
e5a2c653055c945c0eb475af2006e35d8a4e7779f9bb1bc134b82e0789188ade5093a5a2307d84031ef8d348bbeabfe14773e9e12a4600ed07f6913a2e04d540

Download Submit
C:\Users\Admin\Downloads\Discord-RAT-2.0-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\NotAVirus_v1600.zip

Filesize
209KB

MD5
3d217eb384a6a77373654da57884d019

SHA1
923e8fc1a80b33709466e9cb9334bff4dc9d90c2

SHA256
456ab7bac5d5d632925a18e247ea50e4f668577fc4ea4d1f28d52e57b355efc1

SHA512
7f93dc1ffe1ba0182514ad2137a74f4f2932a517c1e36dc0317466974b3779aa34f09fa8d1c73fd88c2ec9d08e8d382d8a9fd1aece01bf0d1c2e296c65ddd11a

Download Submit
C:\Users\Admin\Downloads\NotAVirus_v1600.zip:Zone.Identifier

Filesize
664B

MD5
9003921120c7fcef36e45412f8d4fdc6

SHA1
f4b5eab17234d952ab2f2caaa1c526c38a87f415

SHA256
eb11999285af69d3a65ced0b9522fc57be315819e63f0635e5f3a93ddb605da4

SHA512
7d118243d9f5d501fb34d9d172096590af5f87a16fb536ad97a31462d8d6af15d32cf1558c37c880cd7da6d279cb7768124657cb54b574550ec25d9a6907faa4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 908718.crdownload

Filesize
12.1MB

MD5
017e28cd77905a0bd918d7e725632a2a

SHA1
d709e343f64d93ab00c6fc0aa4ae6ab22aec9f73

SHA256
c8de0e92e603214114f8800dd99ecf8cb69ac85caf8010a99ba3f66afe70fcbf

SHA512
0ae6f1dea994d879043b0ef63049cdbd68dd7671b1df53f3688e91a7027dde8de6d193bafeb12f4c6b7f97909d116f06811a29d13c56ada2c774e78dcc5f1a16

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release.zip:Zone.Identifier

Filesize
655B

MD5
1cd42929f7b3a3c7103ede5ab23e3dad

SHA1
1bb7f9535247527b139751b0699af4a55164d31d

SHA256
159f58ce3a847e391989f94caf02b29f017a86b08e3d5cd3af004eab49c9696a

SHA512
a210f82dd92cde053b910a149e0f98f2ae8f1cf3a2d956cbcb8f7ae9ba6f6f3d0e65cb89e202b5eec618cba35fda5235b7612314627a69138b833ca6699a1384

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
37cc1db192ec953a9371b86b32aec641

SHA1
b2a53443e2e3496ddcded7b1417e5d21901cfb0e

SHA256
cba7313d002e126ffc2dd5c79601b13ad07d79eeba2015421614ea4b712d8a36

SHA512
40cd5dcaf49ea3aa64a6317376688e23ee78a75884dc00e7dea97a5229d81c6ed5d69ff14b97afd79c1e404c564d26f7b6de1cac5ebd195da66200f493315c58

Download Submit
memory/1464-1690-0x0000000000C10000-0x0000000000C2E000-memory.dmp

Filesize
120KB

Download
memory/1788-1028-0x0000000008330000-0x0000000008452000-memory.dmp

Filesize
1.1MB

Download
memory/1788-1022-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

Filesize
32KB

Download
memory/1788-1023-0x0000000005D30000-0x00000000062D6000-memory.dmp

Filesize
5.6MB

Download
memory/1788-1024-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/1788-1025-0x0000000005750000-0x000000000575A000-memory.dmp

Filesize
40KB

Download
memory/3348-603-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-604-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-601-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-602-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-605-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-606-0x00007FFD38210000-0x00007FFD38220000-memory.dmp

Filesize
64KB

Download
memory/3348-1161-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-607-0x00007FFD38210000-0x00007FFD38220000-memory.dmp

Filesize
64KB

Download
memory/3348-1158-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-1159-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3348-1160-0x00007FFD3AC90000-0x00007FFD3ACA0000-memory.dmp

Filesize
64KB

Download
memory/3852-1042-0x000001D221120000-0x000001D2212E2000-memory.dmp

Filesize
1.8MB

Download
memory/3852-1041-0x000001D206A50000-0x000001D206A68000-memory.dmp

Filesize
96KB

Download
memory/3852-1043-0x000001D221920000-0x000001D221E48000-memory.dmp

Filesize
5.2MB

Download
memory/4044-1090-0x00007FF7BC440000-0x00007FF7BC538000-memory.dmp

Filesize
992KB

Download
memory/4044-1091-0x00007FFD60580000-0x00007FFD605B4000-memory.dmp

Filesize
208KB

Download
memory/4044-1092-0x00007FFD4B930000-0x00007FFD4BBE6000-memory.dmp

Filesize
2.7MB

Download
memory/4044-1093-0x00007FFD38270000-0x00007FFD39320000-memory.dmp

Filesize
16.7MB

Download
memory/4640-1060-0x0000020580110000-0x0000020580128000-memory.dmp

Filesize
96KB

Download