discordrat | hxxps://www[.]mediafire[.]com/file/lzqh7a51dbxgq1d/rat[.]rar/file

Analysis

max time kernel
229s
max time network
242s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-12-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/lzqh7a51dbxgq1d/rat.rar/file

Score

10^/10

discordrat defense_evasion discovery persistence privilege_escalation rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxODAxMTg5MDMxMTYyNjg2Mw.GL2Ywp.IrZ_8fak_Vey9qZYWp8-oA_9ozARIvdVVsg8cA
server_id
1318011471380353114

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4184	rat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

UAC Bypass Attempt via SilentCleanup Task.

defense_evasion privilege_escalation

Bypass User Account Control

T1548.002

pid	Process
2836	SCHTASKS.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs

Web Service

T1102

flow	ioc
197	discord.com
198	raw.githubusercontent.com
199	raw.githubusercontent.com
203	discord.com
208	discord.com
179	discord.com
185	discord.com
200	discord.com
201	discord.com
202	discord.com
207	raw.githubusercontent.com
209	discord.com
196	raw.githubusercontent.com
206	discord.com
178	discord.com
182	discord.com
186	discord.com
204	discord.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\265bd038-06d0-4bd7-9db4-887307fc07f2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241216020144.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
1988	msedge.exe
1988	msedge.exe
3256	identity_helper.exe
3256	identity_helper.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4252	7zG.exe
Token: 35	4252	7zG.exe
Token: SeSecurityPrivilege	4252	7zG.exe
Token: SeSecurityPrivilege	4252	7zG.exe
Token: SeDebugPrivilege	4184	rat.exe
Token: SeShutdownPrivilege	4184	rat.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
4252	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4984	1988	msedge.exe	80
PID 1988 wrote to memory of 4984	1988	msedge.exe	80
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 4356	1988	msedge.exe	82
PID 1988 wrote to memory of 2940	1988	msedge.exe	83
PID 1988 wrote to memory of 2940	1988	msedge.exe	83
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84
PID 1988 wrote to memory of 3276	1988	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/lzqh7a51dbxgq1d/rat.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbd51046f8,0x7ffbd5104708,0x7ffbd5104718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x248,0x258,0x7ff62f235460,0x7ff62f235470,0x7ff62f235480
    3⤵
    PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15496797595077337842,17763323319491102600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4068

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\rat\" -spe -an -ai#7zMap7152:68:7zEvent7925
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4252

C:\Users\Admin\Downloads\rat\rat.exe
"C:\Users\Admin\Downloads\rat\rat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
  2⤵
  - Abuse Elevation Control Mechanism: Bypass User Account Control
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ba19ad910e6550118ddc44fb5ddcda8

SHA1
9242e1a78437953867d56a03ec7f61affbd4a193

SHA256
b65829904bf25b0d7ddba4e313adf82e7ee536748106a430758bfcb71ff1a505

SHA512
f963d0e56496f0d0078e429cb52f23a7046d78e830a79a2e086cd7c8d397d92118c4082b055b78433e75631c12ba85e69a6d52c73b9dbc5a3a8b55e0ba3f73a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3b681f1b553061b1d406dca73509e1

SHA1
1d0902a780b041766c456dca466ed6dd88db979a

SHA256
45099d50c298e321f628997d58aff82c1f91aa302cb6a46f5c8a2819a53685d2

SHA512
b6e59b2da8bce61cdb2f0bdbe6dd0486c68bb583a1066cafb979314c4c1baeab4136d9d958e9e9ef3a36b1d7988ae8518080b8aff9748c102d05646aea914283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
165b9ab5b6100e149d42942970795741

SHA1
873ef2b7bb080cee1f9eb80920edb54a235fc326

SHA256
fd01e423cf1b8c61bbc4e1c63f3cd70a81586a9d03a88eebd6ec3a16a1910364

SHA512
5ba31ba647b158325e7282ff6dc83e683b62895a1e3ebd5445a1f121d6d5fdee4b39164514f7c442bf67dbefcc7965c3ee946333e77047ced40df144aebef9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5e1077c01f67d01c7b45c0af47848581

SHA1
aa3248a4318d4d80a774e448ef4672cae1eab0ea

SHA256
049c21fb248cb0fd708ce365e8349b424621b65981443e6d0fe90d59976ef7ef

SHA512
a9875266aa243e2864dee74a00ef466f0ed56ba46f92e84c722fc68158926ba579c8d62e36800a1dda55092bede1877d973d4d269939fbc2c6480565520369aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
a6caea8142b9654b4c74d5bb5f6149df

SHA1
f0aaca70da2482bca4834e95129022690d2ffb42

SHA256
164d34ceb264c53da354e500598bbcd479537fdf648d3a98df19d092d8bc50c1

SHA512
2cada45633f5fcf1351b7f9993524f82132f8a55aae4616c1f4bf05dc085168084f25b62ba01d24e9b3549017c8b704e8fbf930bf94d73c3550f0550c57d8b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
35cf00de996766024b22f5066b2fae38

SHA1
d3ee4a5fabbd367cb800c72eb71192d164d579da

SHA256
b34b8d1da0cb31bc1de1573371d05e6bd5b19c742575c2cd4bc10635b69b196a

SHA512
d6f383048270ca035519c0ba9ee37c98a9c63b26d0d9dad5ec9504ba03f078bd58820625c019e191e5dda77d07275a7a77107e44441e11d20b9cc00a31df02eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ae1c7f6189017be3a2307ea9d9ee01c1

SHA1
ab5c38d2ecf9a3f4551c76f14e2158078d520b30

SHA256
b9f0b35721b59e17d5faa6679121b5a65248d2809af09195b227b2ac40cdc914

SHA512
63c98264c6502ea283696ef98bbcccb0af5dc48a39ebf233621ae8222ba135ec1d685529374e91fa2668854f4a263fe707db41641a4bf5cc309c9d7ae8a29c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ddcd5647f94149533c22d5f6d731701

SHA1
cfc6e44fc39400a882f0242627c9b3b1961ce9dc

SHA256
04e799b1315c7847311030db853dbdf649e011ca778e150fccfa38119903bdd8

SHA512
efe486ac94fa987de2b87eb12d26655faa04999adf9595b19215501ce742bd495ec73cc9764358efc38ea2c47a6b14b58057d87791e8549e44203f14d3aee69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
25942b68c52bc3cfaaa98feeb7103114

SHA1
e0acc661accfe1e7b3a506385331cc82cf77b629

SHA256
735cdaf7216dbd2d533a20589554fe2768d2db3b0b1244a0914aba2094938975

SHA512
36c064afafa29de6bfce5b4f4935621be282eb681c0cbc65050020c3b0c6b0bee60d2d95162f27da47844d4b7a89ef5938cd7058030e9dc033d97e6531c03081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
524c0eba78201e8faad29c29d0a611ff

SHA1
b8d23f3f70313f9f0f8c1e293e70a3f8173adea9

SHA256
693ac11a04057152b30e8d26dc646186c3e54bbe397122b457374d92620fde52

SHA512
5481d83540551f9999d6dbbe94c7ac200b53bb81e5d9a5a94761274332a0b4e4aad05a9689fed5b9ad6fb2c1d06f91e2730eaa4f53950f8e14cef5cf2af452ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
eeec2e8fdb3d10926be7f7f005a6add4

SHA1
ef91d915a57451a526ffde4634f1152c6a751104

SHA256
3a35c99ef359936c246b01412cf6c3bd0a7b190fbfefa584d62cc27e6f6522b1

SHA512
c2044601211d75abf5bea962e73760289ec660326f7e8fce5a588a6a7672923682fa45a0876f197ec75c943d780bd06649d1810edb8331a293365dcc415cb4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a31f0041d2fba35606ab154919af8489

SHA1
beabdf8778ca86749e04cf56b7ed917d07877230

SHA256
015d52f99a198f5d1ca0b4026046615e57edb29bff1671d32996e1befe00be87

SHA512
6cc0181534f855057a3c3fcdc6a54f344d3fa5d7e7e5bc222aee06d743376ca231d8b9647469bb095877cab0bcde45660bf0e94ba058497d3cd5130b3a20d975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4a035a9759245913113f3a7f7ec9b2c7

SHA1
a0609a8b21c418773517939b5e88ec397c70cd48

SHA256
661b62179f5384909b0386fd14384d62ce6401270254cbaf0076759356214c4f

SHA512
e68da53c2fc4bb457aef9b5483fb717c6fe9cfcd3bf14d3c7ff0a6e2a56afb4d9c8f29205ccd135dbdbfe095e9431c05e7d9aff27f86967d9f2fbf2a0f6cafb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
cf6d93288cacf3aaaf052cd056ff6f65

SHA1
294bac4fde439748fdb8da4b3ea8fc169b12d1d8

SHA256
f73fc59b4a9a547ebc444c27f5459a0e14b217648c1a3732d2e3a400ee41da0b

SHA512
67cce1320b105e6c113b3ebdb25d82e7c96b0dc5308925a009b87b0c29aedbc50b9d7ae4cd70e692b49e177322e9c69773323b5dfe2253e034ffe574cf221d7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1d1be5265bd1053939247a838e65f0d8

SHA1
f3b0d06db7f4311f011dfc9350508711e53fb8c3

SHA256
60c361f708f1c4509be189b9726a8f18b32e0ba5dbbd705350fa4ab9f110d18b

SHA512
06a64ff4ab4f37594684d81a261847d2fbb321da706922e522f53e1dd6b48aa1d7c38f845ae18d99d3817bac28a7e0d16cfbaf95496c620d43fc41b4441c514b

Download Submit
C:\Users\Admin\Downloads\rat.rar

Filesize
26KB

MD5
7a657d2b737b017e9dd9791d06e76bf0

SHA1
999a3d986d1242104286f907586c73db64905092

SHA256
087ce53da0115c1d516d3036e3af502a70b557797841c8f2041abef1c074e8bc

SHA512
4d7e7341cabc2fe6a37f04ae5c9873eb8eb870648d3f84c5d02a483be8f4c04d5510782488dec6db218daf81fda74c031d778a428088887a8244fd71146f7d7e

Download Submit
C:\Users\Admin\Downloads\rat\rat.exe

Filesize
78KB

MD5
9568da5f77c9ec9c44d4c3d9b41260e2

SHA1
58fc7cf28f4787a7fb6dd2e559f98337eb1ebbcf

SHA256
b282452a5f33b76f405508f2d26f2db2ef354807daa7adeffc6163a74e633dad

SHA512
b4a9ec1bfd13d3589982ec9e28ddbfa3e3e90dd36045fca7e2d4734fb175d9e535a7e79b143c4d887d7e9893cb31bcbc67ae6c1e1b63ca49238b61a48cc3cf00

Download Submit
memory/4184-441-0x000001C4D3230000-0x000001C4D3248000-memory.dmp

Filesize
96KB

Download
memory/4184-442-0x000001C4ED820000-0x000001C4ED9E2000-memory.dmp

Filesize
1.8MB

Download
memory/4184-443-0x000001C4EECE0000-0x000001C4EF208000-memory.dmp

Filesize
5.2MB

Download
memory/4184-444-0x000001C4ED7E0000-0x000001C4ED7EE000-memory.dmp

Filesize
56KB

Download
memory/4184-445-0x000001C4EEC40000-0x000001C4EECB6000-memory.dmp

Filesize
472KB

Download
memory/4184-446-0x000001C4ED800000-0x000001C4ED812000-memory.dmp

Filesize
72KB

Download
memory/4184-447-0x000001C4EEAD0000-0x000001C4EEAEE000-memory.dmp

Filesize
120KB

Download