discordrat | hxxps://mega[.]nz/file/3rAWkJIT#vuytfgYZNxqdIDTHrmHRHMdP_k9Ctx4yd0tUH68nODY

Analysis

max time kernel
185s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/3rAWkJIT#vuytfgYZNxqdIDTHrmHRHMdP_k9Ctx4yd0tUH68nODY

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5NzU0NzA0Njg5MDI0MjEwMQ.GpNv9i.SJv6-N39Bqebc01pjgPnXj6e_aDoCfLJl5Krmw
server_id
1297609577092616285

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 2 IoCs

Processes:

Obs Studioes New Version.exeObs Studioes New Version.exe

pid	Process
5840	Obs Studioes New Version.exe
5296	Obs Studioes New Version.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
78	discord.com
80	discord.com
83	discord.com
87	discord.com
89	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 681686.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	Process
2884	msedge.exe
2884	msedge.exe
4520	msedge.exe
4520	msedge.exe
2848	identity_helper.exe
2848	identity_helper.exe
5524	msedge.exe
5524	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXEObs Studioes New Version.exeObs Studioes New Version.exe

description	pid	Process
Token: 33	3916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3916	AUDIODG.EXE
Token: SeDebugPrivilege	5840	Obs Studioes New Version.exe
Token: SeDebugPrivilege	5296	Obs Studioes New Version.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4520 wrote to memory of 3280	4520	msedge.exe	85
PID 4520 wrote to memory of 3280	4520	msedge.exe	85
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 3792	4520	msedge.exe	86
PID 4520 wrote to memory of 2884	4520	msedge.exe	87
PID 4520 wrote to memory of 2884	4520	msedge.exe	87
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88
PID 4520 wrote to memory of 764	4520	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/3rAWkJIT#vuytfgYZNxqdIDTHrmHRHMdP_k9Ctx4yd0tUH68nODY
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba1446f8,0x7ffeba144708,0x7ffeba144718
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4598836455712413092,3433936162731467324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x450 0x2c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Users\Admin\Downloads\Obs Studioes New Version.exe
"C:\Users\Admin\Downloads\Obs Studioes New Version.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Users\Admin\Downloads\Obs Studioes New Version.exe
"C:\Users\Admin\Downloads\Obs Studioes New Version.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e823ba3cacf8f5fde10f0e2295ff6db3

SHA1
f4e30f137ff2a1d5b6654cc1bb36cdfe23a3b715

SHA256
65775c43d7a8c2fa696ba1c72f726d410484ac99beed5bb6b21ab51705810e3a

SHA512
14f32cc79675b4a7d7d33fc479207fc951e6fabe50ec68d3a2290ed278ef65da4d55c588cee977426b9ea65ae42a3d102fb0fba352cbeb5ab31b3056d81e6d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81dff82cbbed20673622ff4fcfd71cd3

SHA1
a62a0ac290615301a2aec6158635b2b361be9171

SHA256
725f5728eeff964e450749a943505bf8abbf00b290be84bd1d11948bf12c40cd

SHA512
58f94cb856c6531faaa4074f8c421ccd18d57afd9941cfaae8585a79016306b8b46cabda37f23cd07677e7b5a88a1a94a3770c5246d622f0655a7d1135480c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d19a78b4b7ea15708894c127b78154fe

SHA1
3d868e52ad0a7434e3ccc4d170ab9ea9ed3724c0

SHA256
c1b5b299a2b8da32b9f1ed69d5d8fd4ff7299a37e3d1360436218f0ac327a839

SHA512
a954346e97ee6667f4ba9ed0fa731c1ba88b2cd9150f76302f3f898f33b29c402c984fe4e9c8d9d09348242ddf06b961b809fd2864e213b2b76bfba5d696db04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
271d6e18c12001271da82c3a81ac73c2

SHA1
37f3bd5128789a6f1a1ac08e3a463583f12f2b88

SHA256
12938781a321fb94f21b08809a79b5cb6fd65acd6a048e920f2ce031bb3d9be7

SHA512
d9a184ef778a3c2c967b6bc5533bf233a1ee57f63c56112fd2434ce69129769f0711f28e333a44cfa0ffaa7fee163ec2fdc3721383d62a3ec9334f425681974a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaa0ac770489d808255b4a0531ad9bbc

SHA1
47b1ecd5083ea19eed98217d2c6c34fc7e8a773f

SHA256
855699707f575a1be79b560efd6cef611f14cd74b9a1b6c8cc1538f82aca3677

SHA512
1744a808806a10915550a88d5beec8f8b0370a4281a0fca9676970cf7a9a468f1c5d15083489fcc61f3a2d51f0c3a63efcd57907188a72c3e239d3e9a287f8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
65a92adf6508ab6200be9cc797013b65

SHA1
de635bae076d52be479bd069c1d812f621259809

SHA256
72398a6d393a5196f7c3fccb39a20227bae601d1044bb06e0e440185e10372ef

SHA512
c4c34fc0f1742269ea422f574f1f1acf466a9579b93d7ba072719b2a828cf3df604c51568802056f003d18c8fa2d461022d4da1da3cd684ce5f12326fb684786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e474.TMP

Filesize
48B

MD5
68b36850b588a8aa92bd977c9c81ff6d

SHA1
9c001e798a29eccdd4c25b0c1eaad2aa7bfbea1a

SHA256
c87d5788e1005ca83c31804a4824caf0294a1e81ea4ca42dcaaf286ffc00ed35

SHA512
bb83eec1a75d9f091eb0e04a6a7c0c58add4bfd96fc19e8c3a3b3076b0900eeb234ac7ad5fcd6706109eb612aa51ea73f0611bf0bfcc26ee2df8b399e1fa15f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed0cfc2dd6381e3a8c72efe63708ebca

SHA1
8cc6fb53a33afc7b7c4b885f518620163c822b77

SHA256
ed0aecee596eff32fa7dd8e75a4731acac0f5210d5c9b0f987345d7a9e540b56

SHA512
a382d64f23097930b34d052a3cd62ffb0f8bac82d81f5de583b1b1b4e5dc7bea6bf0ffd855bff6fff1fecf56eb7233869f2d29b769c134178f672ef0a12cc419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
65c98b6c540a0b6aac6a772f28fbb3b9

SHA1
920b49b9bd47155eaae3aeeb166f1d10836fe9cf

SHA256
9e109cbf5fd2ddab7717be12100b6dfadc482c60cec5910e256a1a254be6329b

SHA512
beab574ed8cf4e40151640d17b7d33b1f5b3f7b076cc73ab506b674760c6280817b8ebf0cc937fc79a9bc3239bd532b39223be98b51f56cb66405308cec2466f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6fae42edd6c75c6d5f2edf2227f3c58f

SHA1
f35fc3d4312cb850d73f88460c56b1a8fd77070c

SHA256
839098ba83c8871478ac46c4d06d855e012ae284e65592b769fa1a69212601b1

SHA512
e486d7d696c95a64b273f3d540531ee05cd6ca1419863f7b00d351631ae17c4619ca1978fbd94e4750256aeeb7e78c6e0d1470e6b2b5d711d979a8929633f8ac

Download Submit
C:\Users\Admin\Downloads\Obs Studioes New Version.exe

Filesize
78KB

MD5
d8b024f967c2bc9331ec8e8cc119b9d8

SHA1
4d2445438b1afba88b6425b25b829388a9e644ff

SHA256
2e61200b6d816e2abcea56ed34a29156174931c4e29e06e7989e93ba969dbe05

SHA512
b7c915620427df2ca963026d6687f6a9c33554e56552c6546616145df8c7f37f0a4af1f18205380f55aa7e596fca9155c08886e83e0b69919b77440a004004fb

Download Submit
\??\pipe\LOCAL\crashpad_4520_UPZABVGVKCPZHAQX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5296-245-0x000001F9D8E10000-0x000001F9D8F12000-memory.dmp

Filesize
1.0MB

Download
memory/5840-209-0x0000015DED090000-0x0000015DED0A8000-memory.dmp

Filesize
96KB

Download
memory/5840-210-0x0000015DEF750000-0x0000015DEF912000-memory.dmp

Filesize
1.8MB

Download
memory/5840-211-0x0000015DEFF50000-0x0000015DF0478000-memory.dmp

Filesize
5.2MB

Download
memory/5840-230-0x0000015DEED30000-0x0000015DEEE32000-memory.dmp

Filesize
1.0MB

Download