discordrat | hxxps://github[.]com/Mrspaidy/Discord-Rat-by-Spaidy

Analysis

max time kernel
62s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Mrspaidy/Discord-Rat-by-Spaidy

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
4644	msedge.exe
4644	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
5320	msedge.exe
5320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	Discord rat.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4652	4644	msedge.exe	85
PID 4644 wrote to memory of 4652	4644	msedge.exe	85
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1572	4644	msedge.exe	86
PID 4644 wrote to memory of 1688	4644	msedge.exe	87
PID 4644 wrote to memory of 1688	4644	msedge.exe	87
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88
PID 4644 wrote to memory of 2492	4644	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Mrspaidy/Discord-Rat-by-Spaidy
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa44546f8,0x7ffaa4454708,0x7ffaa4454718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,5430138654827219876,12926890299169694622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5580

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\builder.exe"
1⤵
PID:5948

C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe
"C:\Users\Admin\Downloads\DiscordRAT_Build-main\DiscordRAT_Build-main\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
81208eaf03d324e73442a6969a7b636b

SHA1
88689c3d7b7cba4bb5b1e7876f960bff8d40c491

SHA256
b4c88d29a59dd3326605cbbbfde23a9a71b77f5d7ccc15df6e116062cc925f48

SHA512
e2fe054699c5cdb25019951d4ea3ced2fa6f6ba1d8fff442b81bd32f69a42f21b8bfc4616738fc88ca2a4e24660a20c5158db5e2d9d8326d935197f99fb08573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
392e92dce39453612d818f57ec8c6fcb

SHA1
ac72f5dcbe2e316e2f7d4f7c58d5501e1e24878a

SHA256
1a2a66869093af3fb0221e623038e9efd4af6884a8287e50c7262c2ca051f034

SHA512
5305285195370f2d2ab61869575552b9d245f8de94a4023b2eff6e0c984d01da526e439651ba80dfc64c6552fae91371c59a5047476b1926bbed93632dce72ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f70ed5d6d03c39b2206cc742b62d1513

SHA1
ab95aec81d1012ea461fa787084c35a1e442f9eb

SHA256
442eb12b290a7724946fe44aeb217957c31e456bbe9ce88d51d079b50dfdc2d9

SHA512
6ba4f640b7cec66741ecad9d6cc28bf1d6cad53d6723b78f0b32cd4c7e1f4714a5cd214c764be2ee4ef72e9d1324f989ccb6a6966825398c6c37e4047f4d2762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3bbe59117c3d50cc42a2a78e786f1cef

SHA1
c523c7dd27d464459079693e4878287cf4e1da44

SHA256
083bca1aba9b6c396a13a92805df8a488815b01e9d269b0aaa21c253e1d7bda7

SHA512
5995b68d270d055e26f1877268c6cc8357ff9dc0319f98fb4994c150c4ccbe14fb084a1912ced4d6bcb4db213227c490c57ff46553caac834b1ed1091e74220f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c82a4bdb37b1e9df7dbd3581805d816

SHA1
ebe805055cce1af635b4e0adbe66c8f9da6f117a

SHA256
52eadf03c552442ea0fafc1e33c1464ee44147da3ff1f0054bc4c3d98c390669

SHA512
a01ee758bb5cb3f927336d2827d14816750e0e07cea10f9e76a28f63c632e5349fc123b4ff98ccb091955b0d567579f6b6df821e6dd25495e913712cdf212eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578378.TMP

Filesize
874B

MD5
3178b0f39166119fde150caf3d92b112

SHA1
686a7bb4719f159e43afa5f6d4885b1b1b038d9d

SHA256
0c472348a3132b9c9b5902e63856aa33ea332411695f561f3502329a2759132b

SHA512
a154e058c0f95eb60cf8e52dc0d3a505594ff737eb236a0853d9064051251a52ed81f677b00c2eba2c3f36dbc1472644211c75b99a2a80958ec8a54350f7d678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d526da2aa517ba3a22f86b17f3e75f8

SHA1
3d34bc528b8ea3b2dfe0ae5cfd4fff3f6bff9923

SHA256
2ab3c715e291bb5104e9d2b93171736a1d0249b30e7c9798ad9773346ff7586e

SHA512
7fe3647aab58f50db8782c0f92ec374cb10cb1e902e4732305ccb5db3c2996e612c2768b2cd41209c7184f8ac5e3df6bc4965a2e53c7792565e03772e3aeac26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81ec83b8696fc235faf62b11f4d9410b

SHA1
9ff5e59a27613d6088c6d6d7da726839da84597f

SHA256
943aaf8641df55e4e46dfbce40ebd8197edc32a49b4fd49a81bfc36f2fa80a36

SHA512
2d304658ab4e6d301ed32c1929b0c2ca0b74fe60d504892f8f5870008670ecc782ed01bac790614327d9d1c0c6f8c333d10c60af551deda966fdcec1f7c3e025

Download Submit
C:\Users\Admin\Downloads\DiscordRAT_Build-main.zip

Filesize
448KB

MD5
2c872f60249d147fd2cff9e4f70c564b

SHA1
8fd3f767ae28186ffa9e1a845895686c9ac389b4

SHA256
013f20bd69a697b452e2461bbab012289cf28398e2590e6d4938ae188330169d

SHA512
251836f0b8adb81c289583339ecf704c833489dd118f752ab0f02f910e1d0eb7bb7adc98a3ba2538d1b6147fa250e7f0633aae37ce36fa10c8092632f5d03861

Download Submit
memory/1788-259-0x000001817C3F0000-0x000001817C408000-memory.dmp

Filesize
96KB

Download
memory/1788-260-0x000001817EA50000-0x000001817EC12000-memory.dmp

Filesize
1.8MB

Download
memory/1788-261-0x000001817F250000-0x000001817F778000-memory.dmp

Filesize
5.2MB

Download
memory/5948-254-0x0000000000680000-0x0000000000688000-memory.dmp

Filesize
32KB

Download
memory/5948-255-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/5948-256-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/5948-257-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download