discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Resubmissions

26-10-2024 16:48

241026-vbabwswejg 10

Analysis

max time kernel
51s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-10-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

builder.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
3160	msedge.exe
3160	msedge.exe
3476	msedge.exe
3476	msedge.exe
2372	msedge.exe
2372	msedge.exe
4032	msedge.exe
4032	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Discord rat.exe

description	pid	Process
Token: SeDebugPrivilege	604	Discord rat.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3476 wrote to memory of 4076	3476	msedge.exe	80
PID 3476 wrote to memory of 4076	3476	msedge.exe	80
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3716	3476	msedge.exe	81
PID 3476 wrote to memory of 3160	3476	msedge.exe	82
PID 3476 wrote to memory of 3160	3476	msedge.exe	82
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83
PID 3476 wrote to memory of 4728	3476	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff9f2cb3cb8,0x7ff9f2cb3cc8,0x7ff9f2cb3cd8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,4885810734789625669,18193649201660065711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1604

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4036

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
22ea2fda31b5268a64b643dea9d5e987

SHA1
7e3821a6395de5bb3d845bdc4598551d6fe2489e

SHA256
a51f72f6da8e8ce07c8f6f95ab89a4a2c9b3aa319578b00e2389cfd2cc0f6639

SHA512
a67df713ccdadf71554c26c76c8df6a5c27d51d2a45b2714a76723431c51151e07a03721c9ee84b73b910b357aabcfe1b8fd4a58f47d396ef5318be63b57bcb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb156957bbdb36b11e1fe63607e5e4ce

SHA1
a03d1b15b69b1746920db6bf88f1dcc04458a766

SHA256
825522b4624e58da8f6f741d6dd4f307a4ecba7571de4909f359a13e1b042f9a

SHA512
fb0cf962f2492e9da4169f9f0ad7c6a0c57047d94656239223ee331f9a70e436c0e034608b75b81d3a676f55c1381487da2c866eae724c995c6292fd3335e66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a0bc486fd1f72d2eb1e8583d5223854

SHA1
a1ad222a39034a79bbcb542e0ed66ad115222d58

SHA256
57f4de39ac23dc34157c0eed9fe9f29f29f6e55dc25e86bf60ff2166e0d21b1d

SHA512
13aa8a82c7bdd48c62f3fa9bd1bc849a13189fc36f72d6553ce22bda12664cce98e7404743c9405e7193b705f294862593943bf0477f81913c47d147c800dd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20daa839117d1d781d03f50dabe4c2f3

SHA1
bb9ee2fd2296c3e8b417ae2a5fc3d55c12f19bc5

SHA256
e16c3f9ecce5b5999faabca6990303c20b3f559d69bdf32b6a88d342a7711820

SHA512
4c970f057614dd5ff7ccdafc679b20e975e388cd463ac8ae89a409da7ae071a515750851840976180114c4c5736bd7da9a4208ec85604f4c7ca333e07f194a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f1fa2d0dcee4d86257a8ca6e0c4c2cd

SHA1
75407c7e8506719dc0568c1bac7c21013158d5c4

SHA256
18f25c010ce4fa182355c2a50ba02e5cab25310cd51ab7d3f5e0c1b10ea19405

SHA512
ab857e7231f7ea48de3cb994c0c0a6d213e76977cb4912c03cfbc5641f01a5910b8f79570fd1599495bf6af24e62a9f37a71bf19e13d44e3fd04010a2dcada6f

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release.zip:Zone.Identifier

Filesize
617B

MD5
f1158d5f7e6aa446e30fcb0cf7577c91

SHA1
169853e55a23683d22b0c7a6a7239d3a938aaecb

SHA256
36dd046db15accdac6497a235940b03c356703e557ddf2ff3d1d3943e3ea3949

SHA512
343adcf4f031cd488a858386845333aa0d670bf608be190078348f818c9cbe31a1d54a74d7ede9eb69b003b491628cea9b3b6fba0f951ffc6c3e7feb76baff1a

Download Submit
\??\pipe\LOCAL\crashpad_3476_SEHCMWIKKACGNIWM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/604-195-0x000002A42C860000-0x000002A42C878000-memory.dmp

Filesize
96KB

Download
memory/604-196-0x000002A446FB0000-0x000002A447172000-memory.dmp

Filesize
1.8MB

Download
memory/604-197-0x000002A4477B0000-0x000002A447CD8000-memory.dmp

Filesize
5.2MB

Download
memory/4036-191-0x0000000000880000-0x0000000000888000-memory.dmp

Filesize
32KB

Download
memory/4036-192-0x00000000058A0000-0x0000000005E46000-memory.dmp

Filesize
5.6MB

Download
memory/4036-193-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/4036-194-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download