discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Analysis

max time kernel
162s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/08/2024, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
Sample240812-rmbsbayfpf

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
3380	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
3016	msedge.exe
3016	msedge.exe
3456	msedge.exe
3456	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	Client-built.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1600	1584	msedge.exe	78
PID 1584 wrote to memory of 1600	1584	msedge.exe	78
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 3972	1584	msedge.exe	79
PID 1584 wrote to memory of 2744	1584	msedge.exe	80
PID 1584 wrote to memory of 2744	1584	msedge.exe	80
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81
PID 1584 wrote to memory of 2576	1584	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd63973cb8,0x7ffd63973cc8,0x7ffd63973cd8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,4218110526777363641,13565204879345692392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2840

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:896

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8
MD5 d30a5618854b9da7bcfc03aeb0a594c4
SHA1 7f37105d7e5b1ecb270726915956c2271116eab7
SHA512 efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53
MD5 03a56f81ee69dd9727832df26709a1c9
SHA1 ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b
SHA512 e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 64b3f36362cb43bcb67ddd43435b837a64b7d2c0967aa48abded48b3453579c8
MD5 a2a9b1b4a18ebd6c5984aa0418902e1e
SHA1 1859e621ab0af814ecfa3dc37b56515036f8bb5c
SHA512 913a6c9e5ab08c6c4e0c295620bf7e5c7b5592279742fc7f1da0c341feff21f8cf97a90b7022282d183b4c84c1cc663f62100f70b454f4d74b689977f0963a8f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 346B
SHA256 d2f1c28122333beabb631ed76a77400e79c61df3a6ae84f27ad460b67e40c959
MD5 bb519884fa134af09272e11778367548
SHA1 cb1ff76e6250d315a50a51a22802143a3353c853
SHA512 9332bb62e30c0b3c3af84fd9ada44c5a1bd2cf0168d421401fe6cd533804e0db3a426a4348677ffac21297721f32662fbe03059b1e70d46a5d8d79f1da8dbc06
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 594d8125fc9d5d40ab6f34d110d875fb0033e3c250c5edb4ba2d0ae8b5146511
MD5 f4306e90eb1cc86766dc92ce9eab8e46
SHA1 af003c2524050f34ce4ff0ba2ba6034bd9e7910c
SHA512 1175abe0451bec5939ed3fbf0610ca1a54948620bcbf191cc8b6118f44a6674e77b5cf907ce79d49874d7c9bbc348d298aaa5832530568f05315b62bf3c56c67
SSDEEP 96:n1k3XDxm/LkmtqdNk3ouwSv0MoiVmdnuj1jINJQf0WQyV+VpAiX3wI3:n1k3Xwjc7kZv0MKujhIXaLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e92669c873718fa0c46b3bb4cd105d026ea32b21a8f0468aab735c47aed84ddf
MD5 750d9cfb683199cb45e361ad76baeeb7
SHA1 4435970572fe7dcd3b4bdd4a359ec74e3cf7535c
SHA512 e9037178864e9a45b26c6bafb759e5ccadd3dbda2afbe36384936ca1fa4f2ced501a777a1a8a879405c55ce56944ed779832d7a45a33fac9de15605dc55844eb
SSDEEP 96:n1k3XDxm/LQYmtqdNkNouwSv0MoiVmdHIvJQf0WQyV+VuziX3wI3:n1k3XwAc7kTv0MAIhaLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 311f73fd1306505e5bc34380942f64734c785af9d8e16a71ffd1c76c6bc0727a
MD5 aedce114f4fcd4557c2c37d60ecd540e
SHA1 b9f7e557fa8011b036b5704a0041434264226755
SHA512 b949b2f62c47528f666276359d8fb28d6f84806fd1e1295bccb9509a31c9c960e11be4def947ba21f6c834a17cbc0ec629878086a811d731a80ba1b1d7cd0bb9
SSDEEP 96:n1k3XDxm/L6mtqdNkNouwSv0MoiVmdHIvJQf0WQyV+VuAiX3wI3:n1k3XwFc7kTv0MAIhaLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 32bb4cea8a0669073d5d08b32b9eea8f04b01119676daafb1d12f126aa780932
MD5 ef1874e68ce51c94c1e199432191070a
SHA1 0813dcaeeb577cc17ad9d3586039860dbae75691
SHA512 b8996a4fc6026e2d8011a68b468091d997a97ea7d3415106816493d81d13df6be4831ad9baa4ef1713ec717189441169770f0c303a8e53aa92f74f80188bfa4f
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3MwJe2RUmjRRrQQHO0u0RlD:M9iIxuERzA83h09RZxA3XdLrrQV0uClD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b5f1da6d9de788e6f42f24aac80a35970ccebacfb17bfaebe99437b379fee2d6
MD5 42eabe97181122e68d393bb9c5e70d83
SHA1 64041f107aaac2b50858678a35ae9d2ca30be7c9
SHA512 bdae725fef7b63bd7c77fb3db535d4ca745a77d04dd5ba122bf495b2bd95079bc7d93fd8871f6f1ffd48fa1795699009b93b70a90c1f8eb16d66ad4d9d2311cb
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGJwJe2RUmjRYiQQHO0u0RlD:M9iIxuERzA83h09RZxASGCdLCiQV0uCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 07d1430dcac6b2051f05e16b709e127760f3e09dea1779045a1ae39dbb8319fb
MD5 83809448936509717687d622354f0ef3
SHA1 2c672488c7af9479c59ab983367a3e7d411c910f
SHA512 a3a5f627d46c5614c220d39ddec06adb03695d67a98555f7370b876d5fcf6dc82e83af58c7370f73cfe88800b655e51c7bd5f04d119d6a9a3d5deb1418117b74
SSDEEP 192:3goCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGJwJe2RUmjRYiQQHO0u0RlD:o9iIxuERzA83h09RZxASGCdLCiQV0uCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

release.zip

Path C:\Users\Admin\Downloads\release.zip
Size 445KB
SHA256 c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
MD5 06a4fcd5eb3a39d7f50a0709de9900db
SHA1 50d089e915f69313a5187569cda4e6dec2d55ca7
SHA512 75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
SSDEEP 12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
MD5 SHA1 SHA512 SSDEEP

Submit Download

release.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\release.zip:Zone.Identifier
Size 655B
SHA256 8fa6fa6f5c48e7cacb45304a49fbdeca3af71adb0ecd7107af8c3098a469fe80
MD5 80dcc3dfb67d54ffe6ac1d67e8c31957
SHA1 8966990e72e866acde8daf978f98fa7d9aedcb06
SHA512 c30071bc3ad452073674dc9d0ddfbaa68bb1872bb69c213cf8086c95b54271edf4de10a22d0d3607bdd6b192f61639d238a9231c2dba18368af099a3b81fc5c7
MD5 SHA1 SHA512

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\release\Client-built.exe
Size 78KB
SHA256 1d4914ee768fbaf1b82a860ace972a01338c12a05ff7dbdde42bfab43b21a4d5
MD5 5fa78b19ae158350ead3ef50feb6a7a2
SHA1 57d57ca525968fd9d5a9ee38e783e288896caa01
SHA512 c0d0803b5ceaa4c3013132ead8d8a95faae4a01933c41cb4c998572c2a31c971faab5bb2c488aee8d73a16a0037a78e09130e1ecd2804c40f0665399c404c00e
SSDEEP 1536:e2WjO8XeEXFe5P7v88wbjNrfxCXhRoKV6+V+8PIC:eZQ5PDwbjNrmAE+wIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/896-230-0x0000000005DA0000-0x0000000006346000-memory.dmp

Download

memory/896-232-0x00000000057A0000-0x00000000057AA000-memory.dmp

Download

memory/896-231-0x00000000056E0000-0x0000000005772000-memory.dmp

Download

memory/896-280-0x00000000015F0000-0x0000000001712000-memory.dmp

Download

memory/896-229-0x0000000000C40000-0x0000000000C48000-memory.dmp

Download

memory/3380-285-0x0000021D76460000-0x0000021D76478000-memory.dmp

Download

memory/3380-286-0x0000021D78AE0000-0x0000021D78CA2000-memory.dmp

Download

memory/3380-287-0x0000021D792E0000-0x0000021D79808000-memory.dmp

Download