discordrat | hxxps://github[.]com/hassamohammed/DiscordRAT_Build/archive/refs/heads/main[.]zip

Analysis

max time kernel
576s
max time network
533s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/hassamohammed/DiscordRAT_Build/archive/refs/heads/main.zip

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMjA1NzM0MTQzNzAxODE1Mg.GWAH25.5FzvF79_Vn0d0ykafZ8NvmWZYUOaiFmXhskPg
server_id
1212058084990517278

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 3 IoCs

pid	Process
3140	Client-built.exe
2812	Client-built.exe
5044	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
74	discord.com
77	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{D4A84E9A-1402-4461-A27D-F2222883C788}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000050ec1371bd68da01fa26dfabcb68da0157e2dee89e69da0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
1440	msedge.exe
1440	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
1476	msedge.exe
1476	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	4248	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4248	AUDIODG.EXE
Token: SeDebugPrivilege	3140	Client-built.exe
Token: SeDebugPrivilege	2812	Client-built.exe
Token: SeDebugPrivilege	5044	Client-built.exe
Token: SeDebugPrivilege	3328	Discord rat.exe
Token: SeDebugPrivilege	4244	Discord rat.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1048	OpenWith.exe
1048	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2956	1440	msedge.exe	28
PID 1440 wrote to memory of 2956	1440	msedge.exe	28
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 1988	1440	msedge.exe	89
PID 1440 wrote to memory of 2848	1440	msedge.exe	88
PID 1440 wrote to memory of 2848	1440	msedge.exe	88
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90
PID 1440 wrote to memory of 3520	1440	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/hassamohammed/DiscordRAT_Build/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9153446f8,0x7ff915344708,0x7ff915344718
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2176,13827147936606969428,14585481268504456982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3200

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe"
1⤵
PID:3768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe"
1⤵
PID:2924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\builder.exe.log

Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54f9c50c-00b6-4bb0-baef-bb5073704d4f.tmp

Filesize
12KB

MD5
00a79e0d7f67034024549788aa953fe3

SHA1
3e3462fa93077d79ae25b40dbc551639ad46fba0

SHA256
326a0e139b09e0aae153835a2ff29e347c46e8349a2bc01d7ddbf6680e717cf3

SHA512
934046f758d2958d2253b3e8f0251d66572c3c7d0b26d2f1d6d9bb6bb0164dd0be666b388f6fea0032766b5ce76c668eb677b7bf194b60b7ded1e91e05857626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
30KB

MD5
3ad5f392b7021b34b28bb8ba7e4e74fd

SHA1
0f2117970c6694380ad5957eece0d004eaf520bf

SHA256
99e2448e52a1b3a638a7455dcda4452a267e7dd8efa0406e41547aea14409e9c

SHA512
f60bf0c8cbf2b184f255e49f5f39c44921f6098ace6a6e7aaea26a42ffd29d0a2d7a77b2abdaa294550bc74ae3438a5fb7a981c562c399a42608857171161c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c5adac19e09a5691f0c09f1b4f2ab174

SHA1
68774c2d8c74329eb13f5b672a5996e2fa643a56

SHA256
3c9f9a676a243356a2ad10105b516529959b2a7c132719e6ae0659742da53da3

SHA512
2ade120ed6a8c0ae177f5e8ef5c73f6ef1cdcb7ccea95efe2aa433494cd360cdfb6a58e06dd5c0a53166e737b2933946c7322cbd14a33faa9ba73c6e61ac8b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ee027b90e2dbe0a24d0f5c2a367e254f

SHA1
b727fe025637369717893a64bced08bc24256d86

SHA256
c94f20b8b6f654dac5ad4d736c3860e0821a097f814c0941554ace2632c43d4a

SHA512
64db3e8fc7c4903b8b88b80e3e50bfb629d75930435b27bdcf7240f51a9153847af6474d04e3be0dc3c0681176146f012ec3c61aac32a603585dc99f82137ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5f946414fa6c2cc591c80f552981cf30

SHA1
b5de5062ada5e895d3c4fbc69b5956a521a2f1a7

SHA256
213ee16f3c65649759154eaef62635ae1fd266aa9312c8e45c08daef86ad6c2d

SHA512
8dbbd4709e2870ec7898e92589150d888beee49beb0e880e6b5f9bbec4c10f7b1f7e6460221e4df7d409c9cf9f8d9131a8a8bb60bc9fd1df52f4f375652bc909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5641be14efa399fd7e7993fb07a0a8df

SHA1
8669370d8040e13cd5c6afeffa8c330a68c9b55c

SHA256
c7bebc059ad5837776908e87ae3a464f71f02de21655584f1379054e62fa45be

SHA512
3dceb21bd63d2d4f17630f6ff15c5c1e08f618759b266a7d86773747d01acd54ad582c0bbd10b3a807ec99d0183f222584dc8757c8b48752b9307876aeb85712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
33d8113f8c6b7354ee1a895f00f6b0a9

SHA1
944b6421f0c7197c3c030c299af0cf551ef3330a

SHA256
1dc10bc2be5d74c948948c87e6b8bd086ea8e10a94218714c3ff43c4c0dc33ff

SHA512
8722bb96ab953c2e731fb1878aea4a91ac59414e1aae2576dce899949ecdbb49efffb06449b4369d5768d2acdb55fe4999e1597ac2e047d96088cdb2b0f06db5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
68e3eaf348b09b307ac7e4927c34af7d

SHA1
ced7348718da2a9fac46d034d5bd20f321854f26

SHA256
7a1d8888361bbb9a09cc6654690ca46ad5e6505087e0e10730002f873ee3d235

SHA512
b4b1e4f9fcc59afbbd1f1bafccc3e68e38e0a162715fd9484ca56089cb5bf15b3da964ed855cbde78b7cd1e887750401636c9ec7ce3abd416653ac7e82a644ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
23c1a7a42990fbe6ef226a40b8176e02

SHA1
b0ecb15faf21a6d2ecdea021c5802332d51633fa

SHA256
9462d0499e87cb29c34db6e9d8e2e93739525df45e77bc79534bb6d40ac6e8a9

SHA512
b7c15f7593ca4fb82a69a14485c0ad44d598bc5672afd14900b7a6e875410f0578f76d1d19f448be67ff5b3d3b0c5241af756cd1f7bbf43df94a08f6b11b1792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
d11edf9e08a127c768843acea41d0bc5

SHA1
ff1af9b39de4a3f547407fd9864ffdd2bb6c7354

SHA256
217e4d9d1412e45abf7a653f72a5ab8b53bc8fc6f377f52a042668a41abc7478

SHA512
92c3f0def567b0e2f2523ed25eb9d4abff06070b8be744fea4a6678f25f292439d7bc0c8015eaa6281b7f43149eebb3d3821cd6d6436598481113694b11ddea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f02ce8b3bd90c70e5c6adddef8768f1

SHA1
a43062183b2b19d248cb33cb102c343da2904058

SHA256
2008ff560643ddae3300555f046add497f36a28a81810e49e590107a48e48de9

SHA512
96753e23ee6a4b188d96e2ec3688881ef079e041caf25b19159376278e0a81297d4440e3c7fc1ef4996dea8f6e6bc5b81471ed272dab0c406cceb8980027a84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
523a39f64e456c34700780e06ef06d0d

SHA1
dff8f41008c0da0067a55ea74b032273d4dcf924

SHA256
3debe0cf95fec06f48814bae6328d930b6a39a58a90701c13e6407f6b0e16896

SHA512
43723c5d43ccdc5f35d43e842a381a5238633210aa9267053f96e1000bb048c1e07d9e26ab0044fc42639056bff7e8ae89cd9b7f824717e8882ea527e86928c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c72e24e2928e607e535f4c0b276e4eb7

SHA1
b98efee45beb163019224f599b47acf66e269f7b

SHA256
2051577e5eafbb9983fa402cf4ff50aa9a1e583b2d42e0b844e3a90ca0be38ab

SHA512
312dc11258a9a7b01252884d2d8a26d78c837e72ee0f1e26d04d19edf5f99986618a4d4bf83f963e6ed9365a0f793fdd462b02ae5575f06bf0efc2d4ed6898ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
674fbfff3f14372b7b2123a5b659e117

SHA1
cf4b0ef476b9d2fd26e5ffc3723c8a7749dd9307

SHA256
cd042b753568c55557fb05d8099d6df3b66fe96c98e067de758cd784a1369cb6

SHA512
9b9fbdedba6904a42ab9af3f85421d442ef2eb9df7d354a9d83dd64dfcab11015f4dd0cc49759d5d8a536bffae6d034ae8a6627d93e292d174cc08f1e02e6324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
390f1a43a474928aefe1829724d40bf7

SHA1
85dcf7c282268ef5dd19ebb9b3f36420ddb44e88

SHA256
3e214d6605b007a0b65476e5bf68678de332a17fa842af02134b1a7af782fc3c

SHA512
69fe97f80d43597378fce2670708a0b87bfb24e53041e1b279296ff48da38ef0c02a883f4a432cdae2c4d2d395b02ebcaea755f40a1884cf326083373f46d279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b9a3c6700bc0458ca31f4a00edd00f1e

SHA1
ca5ebb8fab54fc0dbdfca8c49d6554c9b8ae12ec

SHA256
adf50ef8bfe37c084a458daf4c6834188b59927050d45cef743fa434b12fbff8

SHA512
489baf9ba8e057938cd65115b98c1a7adc3a890e8a97c6a4e78dd9bbf19eb462b8a3c1746cab5dff4f4e734fdcb5aca577e053d131c023f714fc5522f5c3dcc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6cbc1df39a21e7628cffad26fbf3951

SHA1
aac3370e2dbd016d4de1a09c863dc8cabacaadf5

SHA256
45ea9dbb2c4a56aacc5943816f580c071dce5acceffd330e22959d9cadaf6a8a

SHA512
4f3068d69a86c592b0708c4728e5df0daa6d9b232662592d25fa0341550a751c7ae2a45a614580e710ae9d827607dd9ab9f32c39d7f067114d8b8a18c63ca0be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c259530cc21ce07aec4acd2fcae4088a

SHA1
cac59b0b1621adf24ccad5b3d44aa8b118f994c5

SHA256
499faa2d573f071508536ff0a571072451fdef6fb864c758c026739e202b8b9a

SHA512
5b3d3cd7dadeefa1548049809cd6853169b85e8e56e6c060f80746b3c632b14813991ab500d29a9ab0da97f35cc1a54e5f178a0a4691e097b5536e73432e4c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
52f0f90c8808eb1db29311cd4f33f171

SHA1
de659b8ee0d40b989d9891121d84d3f51ddf3dee

SHA256
340fbb4938f0a498b9333e2864a0aad8e7d357a496f469f278e4aa208e68d9b0

SHA512
d6fc9c04b7ae2d2647ed6bf59b39d14f7bbb9488a840f4732119d8d299a34cc1a649fbb9d3dda3572d2ff79889a531361d58050c92e4de6c2a47f3e3ac01478d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d786f06bdf666fa817a187b8b0b3b6f0

SHA1
a120cf1dd9a3c891288453ba211dcd45a8948cac

SHA256
5c354a54af5d130f330a8f8ff301ee925582b91389a7359a5ecbc0feabcc90d4

SHA512
14b64acad1f0fbf50ba87db10e6646a48ae249553ded98bc59bca1b8b97f4d3b2a1309d7f433ce65e94b250f5a6b33a81be836e09a20e254b4f68ec019de1785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
55f3aaa24f70feb35090f1cfdf3d8fb2

SHA1
55b99799b8745175e68c1029e657d0e8036b31c1

SHA256
f256bad9ae74a26a87e0d9292ed36a688790e8358dd791e05a982f9bb0199294

SHA512
d0b08ef9a3b7961c6163340405b9642acd1ba1ac382c93f4818d9c27893ab9c7518402f2c4bff5637323e090d60d8436276cfae5d47f609581c73bbdf1f3c5ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c3f2bb91e5ab4ad86e3d097385f2d7b6

SHA1
85aceaff46dfcdb394f17063c5ca2582108eb0ea

SHA256
6eae59d00775d7a4510aa91cd10e1cbc0f42379fa55ac25186ae7e9b0ccd82f7

SHA512
786ec27c4ca6e91a8bac63e0a89caabc7877bdc00b8169c14e66774c6f523f401d626720777d2cf0f3b6503831fc1aa7e1b626697167b323e8951980939fff16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
df870f70caed76144f326e06170f17bc

SHA1
43355390aa6e55e3f73a8b0bb6bd222840b8101c

SHA256
5e0982750fde9eef71e0c0e41fed60d8c544c830b63c974f25d967bc829a349c

SHA512
b766aee78ad63f09848779764ceba62ab75014148147e4b1480b93e40ecbbfc3639a788a7e03bfeeb575f97735280dae519de49bc6613c3c2050db82bc2ba39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
69cf201bd442119de59b5fc6f5ee0c80

SHA1
0cf8c552faf50838544d0b2f3c25c2317cb06785

SHA256
440b7607356f5fd1b02616fd5fd831c04e39f6cb0344942e7edcb01cd78600ba

SHA512
b1f1ca90e1444226e4bce78f36db32f6ae350a2f1e6536074971736d0ef4b3449f4445af2ed50e5a3bf7778ef8a21bd5df980cca5d92df841d864ad8a2d37aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c08ae59ce1bdd5b60ad82022382d342e

SHA1
75fc92c2b11b81c6e5805ec5e7bedb1d4325331f

SHA256
2ca43960999137450fb73e09920bedb3fd4ffaff531665edc8ff3bf5a3a40726

SHA512
a45a10a75ac42c71b12e00d89e0a635e156d68138941da5a0003c70e40b8b4ba929b1e6220b5f8279a08d6894f29f891c8b6fbb0d017996e4751e7b6a4fe6d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cfbd99e8d5c92949edfb85acb21d94bc

SHA1
97304cdce5ea20c56ff66155320376524de42fb9

SHA256
58e6df10392df50b8b617f5fed9a4fb54607988837c34b84bd88c73710bf63c7

SHA512
6c09804b2ab0ff4f637cb4c6eeb73317917fc281ffdb4d52858d3d35fa6f2e9c0d249979e8d104f4a672570356bed740529de53ae7f42fa5bb71bbe5e78e5cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
caa023f0639567b40e2b939f2693bff0

SHA1
1cc23b051e2d3aded24698be85d30b3df3286d6b

SHA256
f2c267adee699fdbc96091bcef757a2376c231033aa5021fbfd7523c90f6d7ae

SHA512
1e4a4315809da0a7b7c4a3584185c67ea98b6840f95da07469e74f8c64059e559a7972d2a2bf0c16283d7f7d2019d777707356c3d345f918eeba805f2f85031e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8d0b35d6d24310d9ed8238f826c9b2c4

SHA1
1878d34326ea9e92171ee1656c1499f82eda6d4a

SHA256
9880b06ec36496afcb99e172ea741dac6e290d788bb0c53606e35885ea976061

SHA512
6829dc5f4138b95223185c95a0fdda5301abcac623a18f1c3fc12c88e6796e549797aeadafa01d7b9ebf1807f7c67fe4c5fbf62b0edeecbf01b067c759bfe301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599ddc.TMP

Filesize
367B

MD5
67e9b6d5db67b7e7fbb0d7eff8b8a2de

SHA1
cb2783d8a4700447283a4dba48e91f922433028a

SHA256
a2a036a88172055dd7c932b3349aabd1c466ce8183d481d383dcbc1a76cfa89c

SHA512
71c909807335a366bda45f747e104f8d405e00dc41e32f066abebec4d5ad7ec1cef472afd2826b565f242184ddd6d0c584930ef234a2864e10edfae0d4c9ed23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f23674e8-8993-497a-b1e2-5a26d9de62cf.tmp

Filesize
6KB

MD5
3220389fcbe1d038f9c45b3f348440a1

SHA1
f270a665ce9e54606a2522ecb243b23dd8e49664

SHA256
e02abd8b623f2a1a034c87dcb68936c757a7b1d337ac3427ae71cf75fe583946

SHA512
17fb59d6b0ad2e558cb7a3e73010c099e495d514544ac8968d11765d2bd8af7061459ccefcc1e87555b8ab91370118f06379e8a7425a8c403ec807a7922f208d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
76921028562ea0bfc0d8f7458d323642

SHA1
78ddbb8d2a811c8d47ab2a8ea74f5943c11b1d95

SHA256
ac6285ada493c0a931c2331235185eb1849d8b091ab31d078fea5f669d2b4ccf

SHA512
9e8d10e11ffa9d8fd0377e06283a7c9cd502394c332904dc151e19024b236291ffda12e6e788229dd85e45865646ad7bd3980c229aad99bb2ee74c7578e64b8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
10e5554bf495b3b3eafbbc1b4ee61ac8

SHA1
88e6f4b1033d48194e3df3dbab05496edec28727

SHA256
08c0a31424b0c259f34c77ee73aad7b8b82b20192bc9ae4e92c0a447f053c695

SHA512
4cd7e598f2230bb34f121c2965d1fa3eb4643eb655307aa5c08d5648441573953674a6e2a4868cbbbd792e89285acce5873b852c1ed9c0d8672dffffec7950cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cde01520675bda82ea9c83527aa8e4c8

SHA1
d7379ee4057e7234c8d47953dbb9b14604095b3a

SHA256
b325645b82475c89bb76c59e6cc49776497d08add3d506192223986b21415b4d

SHA512
9e22276c207c3c985bb3dd98797c29f7ccdbf95986b03d1b94551617a50a2ccc8b7fc9afd61ffd238d995d05a9b230184558e0e9156bb8c2402d14b1137516cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f71c694c-aa53-49f5-869a-f94285d322cd.tmp

Filesize
12KB

MD5
139f4b30a81eb2651c5863a7ab82e55e

SHA1
7a7d06c063b164c1d01857bf5996fe8a5abb01b8

SHA256
47be3db22e15c8c6a7f4a48dd66a7b6d97b7bcaae642152220473d110b7b12e0

SHA512
a5169834d51e6372e531ebb7bdd7f252f518d96415aeff6e2aa294185a43ad69e6a5af569ff5b5f3877bfe01dc6722dbec551e0a1606e8e1f121dc546b57ac59

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
9a620bf6975e30b3bc1f100801468b80

SHA1
3fbd688b5fc1ec88e44f30b399afbade9a3a1eee

SHA256
0bff882b159f7d0be2c70cb36fd09821773aa27aa6fcf813b06c773e44c0c81c

SHA512
230c823cd771303b50644dd32a9b396711f2904ebdc14726bcc2add9a84aea660e8530f8ab057928a5d6bb0200bfd08274b857bc55c1a3e1efc5c40ec1eaff61

Download Submit
C:\Users\Admin\Downloads\DiscordRAT_Build-main.zip

Filesize
448KB

MD5
fba48bc48252100a4789f714b7408fa8

SHA1
b07b8cb68d5ca833bacd495a4a3e577404c8d466

SHA256
195afd80fbc01d33334b27005de6c2c9e78c55220758f816c0a9f6ffba85566d

SHA512
f164941a11bd8b0c2b17a9ce91913cf2871e59247c3b2ae2c5c463d67f3c9ccee9cc4a87705a4d8bdaf2afc41dc1e6fe3288ee99769dcd1de066d6f124245288

Download Submit
C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Client-built.exe

Filesize
78KB

MD5
3b5fddb9ed613db6a5ae794f8f59b7ea

SHA1
e0e0f72a313a6ac36512c7c27bd949ddf56bf81f

SHA256
e5bb83cc65a193c0fadcb39413e628bedd118747d1ca4c689a8db04c496e4e65

SHA512
b30c96d62774a2826dd2ffe37d0690f1f11b49ac553ae1bbd30c88c953b068e802660116d81b0b00a7e1cc3c34d63562cb34b023b809327aa7b479f50a69fcf1

Download Submit
memory/2812-830-0x000001F2D4B10000-0x000001F2D4B20000-memory.dmp

Filesize
64KB

Download
memory/2812-829-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/2812-810-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/2924-1067-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2924-1070-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2924-1068-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/2924-1071-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/2924-1072-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2924-1069-0x0000000004D00000-0x0000000004D10000-memory.dmp

Filesize
64KB

Download
memory/3140-700-0x000001F1BC2D0000-0x000001F1BC492000-memory.dmp

Filesize
1.8MB

Download
memory/3140-731-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/3140-699-0x000001F1A1C70000-0x000001F1A1C88000-memory.dmp

Filesize
96KB

Download
memory/3140-701-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/3140-702-0x000001F1BC2C0000-0x000001F1BC2D0000-memory.dmp

Filesize
64KB

Download
memory/3140-703-0x000001F1BD750000-0x000001F1BDC78000-memory.dmp

Filesize
5.2MB

Download
memory/3328-1061-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/3328-1059-0x000001D1966B0000-0x000001D1966C0000-memory.dmp

Filesize
64KB

Download
memory/3328-1058-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/3328-1057-0x000001D196190000-0x000001D1961A8000-memory.dmp

Filesize
96KB

Download
memory/3768-68-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Filesize
584KB

Download
memory/3768-89-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3768-61-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/3768-67-0x0000000005570000-0x0000000005B14000-memory.dmp

Filesize
5.6MB

Download
memory/3768-71-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3768-72-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/3768-128-0x00000000082D0000-0x00000000083F2000-memory.dmp

Filesize
1.1MB

Download
memory/3768-100-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3768-99-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3768-56-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3768-1065-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3768-73-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4244-1063-0x0000020DF7C80000-0x0000020DF7C90000-memory.dmp

Filesize
64KB

Download
memory/4244-1062-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/4244-1060-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/5044-864-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/5044-841-0x00007FF9010D0000-0x00007FF901B91000-memory.dmp

Filesize
10.8MB

Download
memory/5044-887-0x000001A0F8B10000-0x000001A0F8B20000-memory.dmp

Filesize
64KB

Download