discordrat | hxxps://github[.]com/ppx1xxq/Discord-rat

Analysis

max time kernel
36s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2025 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ppx1xxq/Discord-rat

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4540	msedge.exe
4540	msedge.exe
312	identity_helper.exe
312	identity_helper.exe
4192	msedge.exe
4192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	builder.exe.exe
Token: SeDebugPrivilege	5468	builder.exe.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4876	4540	msedge.exe	83
PID 4540 wrote to memory of 4876	4540	msedge.exe	83
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 1984	4540	msedge.exe	84
PID 4540 wrote to memory of 4884	4540	msedge.exe	85
PID 4540 wrote to memory of 4884	4540	msedge.exe	85
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86
PID 4540 wrote to memory of 1460	4540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/ppx1xxq/Discord-rat
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff764a46f8,0x7fff764a4708,0x7fff764a4718
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7425226677697466250,10583362154678888810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1392

C:\Users\Admin\Downloads\Discord-rat-main\Discord-rat-main\builder.exe.exe
"C:\Users\Admin\Downloads\Discord-rat-main\Discord-rat-main\builder.exe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Users\Admin\Downloads\Discord-rat-main\Discord-rat-main\builder.exe.exe
"C:\Users\Admin\Downloads\Discord-rat-main\Discord-rat-main\builder.exe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e5ba7b5d624a5d05f0af939927a89c2d

SHA1
af1c001b0c0b44e6537902b90395603f6ba08263

SHA256
5a92b8ab426f07d73a1a5985c8a6538e6a5de2d4f5beed8f627ace0bf6beb541

SHA512
4bdb8d739723cf8f42169b2d2893c2e83976e5bcdf8f147b099be64f089dd6cf2a5ecabc972ad0e373b93639553a1ce4b5ff035a414a1d684ca25a5fc05cb98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb82901fc276ac2463ae7c3beb8664ee

SHA1
772f92a56239c31374b90fe4a58311b99090e0a2

SHA256
4ef70771332b1273b4014d20085aecdb6206e65a0d2cde9d84eca168fe37b8ab

SHA512
92105e45c9887205f190533fae6934eede94557d9db2dbdbd6db5f7995819fbd96df9eea104064d4230b100e8c67655cf0dac6ffb9277687629c3a347ef54979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b733eb092203b65b4e0f2933eff6e77

SHA1
3601fb000e935c5376eb1dbcc00c45f03b7d9dc1

SHA256
a336584af4b5763d08359447af7768bcbb86e5e1836d294db4577142dc715614

SHA512
c07597d29bd4e9ae1ccd44f0d6771ef98d150ea95f4ad168fc987d82ed5ddd3fa7737b40b22968e0d6e30abfbec4c4eac99d5387d112fdc5fd6d4c12d53dc793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
329444816b75f57a640480b6d744671c

SHA1
65310dea370cd364dcfbf0e80ebe9470aeb5bbde

SHA256
6b54aeb0013e75ea0ab8ac0d15d17322a3e0341984c403fc09af9acf77e7a3c9

SHA512
ea90c36a66348a0b3f90453a8b7eff8933690ecf85610c7ef8e52ac735710849f8724c68047a02d66c16977db7db4dccc9072871a87aa4a48637f381747f99f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1eed8674517881d8d61614cb689eb61e

SHA1
ed6eee2fc438a13f288cd3baf6a0431ab893da2c

SHA256
0e7825e9465a29d5348d86ae66d85a67da4d732add799750f4d8ea30875ef39d

SHA512
c5b8d7fed933e902a68842c88d9ddee10c4fd7a7b825465c33b91deb4381ac90cdba29f99893a2a9a8e398504e6a7da9d5f9dfc2c861888fb22c8447f831cb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5047002980274cbeb108fd1459232b37

SHA1
757670b5ea9e26adeadf07fbc050af8c4cb752f8

SHA256
5974935af9818fc8285dd483b5ae8449f6c11f43ad02ae63181bb171b1cb2525

SHA512
38ee71c02248a9fdb44ecb1117c9df85e761052c0caad7d0dbcba6d74afed5a73f13d6db8128bb98a3041f5fd5fc63825501eadb8be4d663c0dbc43537adca50

Download Submit
C:\Users\Admin\Downloads\Discord-rat-main.zip

Filesize
444KB

MD5
422b27ccb39fb6af7459cba4c29c45d6

SHA1
270aeb7cf51d14f072b80469ed17533f97a8e94c

SHA256
007df4cb1e8fce1fc1c731992aea743e977f6e71fefc0d45d59a1c0fc89b7618

SHA512
11d3c3267b0113b9a18ff4246bd0a75ebd39d2bb0a24f00d183e9b75899c570b52131389b4e0fe95e1328f8f7b32f58c5044b852b317345c50113b5536c7a8c0

Download Submit
memory/1536-192-0x00000207BCAB0000-0x00000207BCAC8000-memory.dmp

Filesize
96KB

Download
memory/1536-193-0x00000207D7180000-0x00000207D7342000-memory.dmp

Filesize
1.8MB

Download
memory/1536-194-0x00000207D7980000-0x00000207D7EA8000-memory.dmp

Filesize
5.2MB

Download