discordrat | hxxps://github[.]com/GTboiye/discord-rat-bot

Analysis

max time kernel
84s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/GTboiye/discord-rat-bot

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE5MTM2NjE0MzI5MDY1MDYyNA.Gjvgan.P2Ej6EMWRB5jmz5dlC1ECgyzzi9nhhHr-JFW2o
server_id
1191366447579025468

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 3 IoCs

pid	Process
6040	Builder.exe
3716	Builder.exe
5644	Discord Rat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
75	raw.githubusercontent.com
76	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
1620	msedge.exe
1620	msedge.exe
3096	identity_helper.exe
3096	identity_helper.exe
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5920	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	5920	7zFM.exe
Token: 35	5920	7zFM.exe
Token: SeSecurityPrivilege	5920	7zFM.exe
Token: SeDebugPrivilege	6040	Builder.exe
Token: SeSecurityPrivilege	5920	7zFM.exe
Token: SeDebugPrivilege	3716	Builder.exe
Token: SeSecurityPrivilege	5920	7zFM.exe
Token: SeDebugPrivilege	5644	Discord Rat.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
5920	7zFM.exe
5920	7zFM.exe
5920	7zFM.exe
5920	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1424	1620	msedge.exe	84
PID 1620 wrote to memory of 1424	1620	msedge.exe	84
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3012	1620	msedge.exe	85
PID 1620 wrote to memory of 3616	1620	msedge.exe	86
PID 1620 wrote to memory of 3616	1620	msedge.exe	86
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87
PID 1620 wrote to memory of 3756	1620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/GTboiye/discord-rat-bot
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecda146f8,0x7ffecda14708,0x7ffecda14718
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13361658957225888947,6791303328826293980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5876

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Discord bot rat.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5920
- C:\Users\Admin\AppData\Local\Temp\7zO0278B458\Builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0278B458\Builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Users\Admin\AppData\Local\Temp\7zO0279FF38\Builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0279FF38\Builder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Users\Admin\AppData\Local\Temp\7zO027D0638\Discord Rat.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO027D0638\Discord Rat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c14dfd4-63cb-4475-b2a9-866b260a3f5a.tmp

Filesize
874B

MD5
84750fd93396ce5c25a3a76d82a33602

SHA1
4c49d641ed625d36349304e99e3e973582231fee

SHA256
76ab9509a266a6ab72f8d7e93c0cc2d6a3e3f012a13485edc3d82ab430044fb0

SHA512
e75970e729800c3d87370ef24d212d9a18266fc8326c407d30a525dad3a18a80546151bf03948db35ae8aa94be2dde9278020e87bf9d5ccb744ac99ace5b8666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
20f2fda08b4e9e6107e46682c14121b0

SHA1
ac7d604b9b9aa0c993c1f103d3bbff6f4b15cc5d

SHA256
3278d76c5d4bcaa4141613feccbdca6d655f3a6fbfb0b0318a88f71708e073f3

SHA512
1029d6785d973cf9e2ccae7e1adb39654388d7c114da66fb8ece0e0d9ecb396e5a71e4e85e0c65e4ee67c62bdf0f03ecd87088e408d96f8d1c08be4a101bb7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
8bbf66ae9ec386af4152e640d99ee79f

SHA1
6eed11e2861ec6509f508ae7197d0338897fb869

SHA256
63323b56c49b79c0cc4e1d4860f2121f462a4813f256a028c777604470013209

SHA512
fa2ca0c0a7a8f8d3396001a6e23113ed50d54ae83af55b5b0f4db40fee7d04590eb316f315eadc08677fcb6a731d9b662d1bff18faea70a66f566a1136792ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b01c73eb9575489cd97c0e426bdb6ee8

SHA1
a5fb4b0b1855e6340f3157ac6a0d453207c23a1d

SHA256
f6da5f7f6de7b6385655a10a1b9c24afbe4f913298229f07d60af8fe23319ebb

SHA512
79d161d421d1558a2b0460cd8102d44440db9e9481843d16509f60bd5b7a119ccc112d61dfebb4f0e0fe01f6c06ba4ca30b4d2fbfd56cd1f5649cec30a0f7dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d5229b5438e0c04dcddda5220f4a46cf

SHA1
24a4d78dbcc4bd06f859645bea1959d8a5000d95

SHA256
bf63ce0c805cc0243b92baaa988d50bfcd6631e3ddba19a4a6e01149cbb2d019

SHA512
e8190eedf8f4dbae605302692000adb32569bb8e4395a248ebe8f41110a1619f137b9152ae6eca9d6cbb08e0e3ef4be19e02d9087aea9ccee7e6dbdcc20cafa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b570e1ac6c84622a718bd7b3439bac16

SHA1
fe443393494bf325c72c0b7e373daf5e6b58bcf6

SHA256
b1a13ec23bb783c6354a31df1c145c7b8ea006df97ecdfd89187514b85820a24

SHA512
5f5b7c14996c0e9afdc408a490d67f370b18b2a4fca637bab396e72bc6eeebf93d7e0b159723d03c422c0bc98c60b07f6ad33525f65b3b6afb91886bc60b4b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f92a6441927a1f1e102ab4ebbdf6aaf

SHA1
70478fef1a7fb3bcefac41df38eff8e9e76b9cb5

SHA256
2ee8b2b25b635a4baea093537ace266c2136e33d3237690d2b0bd36f4157bf40

SHA512
62d710929f6d296ee74973a35c8956b53acf376631d4397efd73cdf8aba425da10f34cc2aa94a80a91dd17d425aa5d9444e768e0524e5755bef22adf415c4d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4daee8e580a29d187be1c810c0c83cd0

SHA1
5d05a9baefebf0a849ab6ba84eba6c515f14bd31

SHA256
5559989b96be57a1d5ea3390d7f14dd3a5f192e8aa4289d8f2ca32670e020829

SHA512
0c65e24dd8ee7e684238db65e0c8e5c4c598356f916d3483bc65199b5999afb7fac4bd02bcf8fcf5560bcce70d30e02f3646e99c05a36112340f23912d603562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579f0f.TMP

Filesize
371B

MD5
3b9fca315ba303233a16cf24e497ad11

SHA1
6646a134d51685e33c50648cdbe794e0e486573b

SHA256
9c650264c9c7e96d0420e6d78f56e4794fd2be0c37b44aca52f4d6d1538010e8

SHA512
cecc385988b60a8e2b606e2f335d2edbed3d7b4d2bc201c17887f6de209885688bdb2dc341119db2d25884876f5eb4a2edf787d070e66868581990620fa559d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc9a54515648537db5bef9413e65f32b

SHA1
04aaeb92e00ff53d971d38dcc4142e382331a3ee

SHA256
d79216a874b954f082657444c03804657757c18341fdf9f7b028cfe77459c400

SHA512
ec7364e8130a853c20dad515321e470917d95edc6e2d5de46d1a5c93c60f67423452c637eab0fe58aaa392f0e7c03f098199ae990d803712dc62c8a50e75bb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ab1b840aed4f29a99a289bb4a5029ec

SHA1
2382bc191d828cd0049bbb48940ee4b9266c2e7e

SHA256
5efeb9fb8448d8f62ff0968ab1c7315bf320ad79e105cc50996391edd4d9cb5c

SHA512
6e1f1c780c6d995deba502591b31d3fa4838b93043a438333674962ac69ba7653c2729ee1df5279aaa8e7afa4a195cd1fe33651ae21b540fa58016ee92369581

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0278B458\Builder.exe

Filesize
78KB

MD5
3d8a1e6bd9fabb1ce2e469456e1e0692

SHA1
9d95c25effd61ee8ba2199f75a766f9f12840dd9

SHA256
a20a67b229de8af688d695514d47f23e4f77a690352f327688bf5bcf87e93e1c

SHA512
9cb7ba8653cb6c145e82d58e52e2ff2754046feb5222d80005e5000dd6f1375e37ce51eccd5f48eee8e40ccfe129b05f57674a240491d77d5f762b0367994c57

Download Submit
C:\Users\Admin\Downloads\Discord bot rat.rar

Filesize
52KB

MD5
fc621498c401870b15d60c832e84f5c8

SHA1
a9612572100552fb6c347b8caa5807cf57ad508f

SHA256
4c59c57055b9a82e2c89535a9717c9df19ae7ac23f6f7f01982bfc1263f4d997

SHA512
77bd79d7da99ba50ea860b808d38ee5bee3866ca3652b1424c0de2f7267f852c9aa55301357b8c788a882d8d9b05ebc9e758eded322ec4e710c13006b170d6ec

Download Submit
memory/6040-297-0x0000020577A60000-0x0000020577A78000-memory.dmp

Filesize
96KB

Download
memory/6040-298-0x000002057A0E0000-0x000002057A2A2000-memory.dmp

Filesize
1.8MB

Download
memory/6040-299-0x000002057B650000-0x000002057BB78000-memory.dmp

Filesize
5.2MB

Download