discordrat | hxxps://github[.]com/AizenSosuke101/Discord-Rat

Analysis

max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2025 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AizenSosuke101/Discord-Rat

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyMTk5NDk0MzgwMzQyODk3Nw.G7hRt0.tsvaJSgO9QCXFDWq0chKEu6Jsm3XDWEWHH41wA
server_id
1321995666821484655

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	BM4Refl‮gpj.exe

Executes dropped EXE 5 IoCs

pid	Process
5340	BM4Refl‮gpj.exe
5500	Piercing-3.exe
5896	Piercing-3.exe
5244	Piercing-3.exe
5724	Piercing-3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	Bilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	Test.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3016	msedge.exe
3016	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5500	Piercing-3.exe
Token: SeDebugPrivilege	5896	Piercing-3.exe
Token: SeDebugPrivilege	5244	Piercing-3.exe
Token: SeDebugPrivilege	5724	Piercing-3.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5276	OpenWith.exe
5176	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 804	3016	msedge.exe	83
PID 3016 wrote to memory of 804	3016	msedge.exe	83
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3324	3016	msedge.exe	84
PID 3016 wrote to memory of 3024	3016	msedge.exe	85
PID 3016 wrote to memory of 3024	3016	msedge.exe	85
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86
PID 3016 wrote to memory of 4368	3016	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/AizenSosuke101/Discord-Rat
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd38d46f8,0x7ffbd38d4708,0x7ffbd38d4718
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=180 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17878603622466606155,11759296475283717134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4772

C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\Bilder.exe
"C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\Bilder.exe"
1⤵
- Modifies registry class
PID:4532
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BM4Refl‮gpj.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BM4Refl‮gpj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5340
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Piercing-3.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Piercing-3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5276

C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\BM4Refl‮gpj.exe
"C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\BM4Refl‮gpj.exe"
1⤵
PID:5648
- C:\Users\Admin\AppData\Local\Temp\RarSFX2\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5896

C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\Test.exe
"C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\Test.exe"
1⤵
- Modifies registry class
PID:6080
- C:\Users\Admin\AppData\Local\Temp\RarSFX3\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\BM4Refl‮gpj.exe
"C:\Users\Admin\Downloads\Discord-Rat-main\Discord-Rat-main\BM4Refl‮gpj.exe"
1⤵
PID:5444
- C:\Users\Admin\AppData\Local\Temp\RarSFX4\Piercing-3.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Piercing-3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94c21b89-ebab-4d08-8e22-481ff2f6c4e5.tmp

Filesize
10KB

MD5
e23ea8299b78cce5d2361357f3b0d757

SHA1
7c7b33156134828c4307e8440034008f3af0e152

SHA256
471e03bfc4e913118cfcb330f9bfdbdbbf4a630ae6849a265f461a02886b60ab

SHA512
38b6e062a2e86a9426ea9434b43191e04ba1f254116bcce1be3c5ec328cdf3b9ba73d6330a7897474ff8348e05f48269091e0492f2f287244a96e216af39e179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a782a3ace08f65f37f67d61e6d1922f4

SHA1
b0d388e91b898b527a90510a5af2fc0c67d072f6

SHA256
defe2fbb480e788d989591585564a57128d38519cecdc16925cab358d00594c9

SHA512
47db2a35740b5e19d7bfcc98cef57a250e7bc45c7fb165f5d0511b1f3c6a4f261d8c61f99de95df2a35b229686910fa57f4771145f1d3754934f2fa0aa1b357c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3e7524e8638776d1a84132c41bca0d4

SHA1
b918b59e45cac491f15b429673c4e60f5dd0670e

SHA256
0dba9c72d6ae261b2224e33b3e9dd519ac43d7e7c21809bb29f8ce899c1d2cbf

SHA512
9b8fb356cf7700a3989688b2697e05ff097a58914453f46dbf3aa783d7256e7cef1322e43eb64be6deff2d3f8c44bbb8e2097b5373daaea838c49f29bc80bcdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92f333bda410da2c0bcc93f95b615b72

SHA1
a244869f34ae1c68c19b96c8de40e7df2d751f49

SHA256
745944bf18f263924896ac72163c138f97d4642882d93003831afbe9283aa67a

SHA512
3261657157923092233f378e49bf743ab1410664977d77295809ed240bf550711febe96f11f074e3695b0f498c6a3eff6085990ebcdf9d73a5aebe89971738c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
79d520613db6669f2ebcedf8dbad9e09

SHA1
bd1d3563612f63def9549ae69ad3f184a150b130

SHA256
7fe4fc7438d3b7d760d8944c126d95939bcaa048fc6466a772b008ed8491b013

SHA512
508aa7d78570c74e2a12bea950f24a66691872816cc879c000a0b015ab97086e65bd7a6c31e2460dd0ff23d89da1380920ad6ee515f1b55a665b65ffb4980c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\BM4Refl‮gpj.exe

Filesize
529KB

MD5
d7746b44fff33140ee35be0cf8635098

SHA1
93d8359ebee5849abddec1d66f13f867dcbab214

SHA256
ab1f5565ec87d83344a85ea76310b4cd9f82877a9d39ff55977ca5f96f5324f4

SHA512
befdb09a8f1b66c30c2f9eee5d75f0547f40f6d66e12e484aaaaebea6d5f09629e00b16afdd0e3f54bdada3a371f88dd24a54befdf5497a0c0cfe42128de5522

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\AV_Bypass.py

Filesize
6KB

MD5
a152b166fa53ed1efbac71133670f48c

SHA1
dc65a442414440ee7e23a0519335574d8b053f74

SHA256
bbef61d27046a8322ab9625ee0fe71c4ddfb298f8743248290ec6bbe1bf65025

SHA512
e3fc957510a6a1888d9547bf5d3205209e8c62a06cafe103d98d7eb2104151fdc0f982fff7dc38bdf7ad21ad39d49eec81722d75684c46b2e44c86883fe78fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Piercing-3.exe

Filesize
78KB

MD5
b7ccf7b812bb770c597725179857962f

SHA1
67ea478ef8c7f502576620821d85521197a5e533

SHA256
8438e6e9643604ca36f6d5196cbe4c417f61c69adf43ae2e8a991ce9ecacc005

SHA512
48b22d57758511e38b26e2404b4be03f2bc4050e4906a8f4f73bc2fd91efb4bfd9069effae2e7dc91843ed3c28751020db2e62335163f4e770400b94f40a0721

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX4\BMWM4.jpg

Filesize
51KB

MD5
00b4b86dce5bb543ec50185c907cb0ba

SHA1
5b6e61b08d30df1c43b559401a974d818be06f09

SHA256
007e74dd888c14ef8f1733db3589235767e6ac6383898a498d3b2d126e15b868

SHA512
a88864863a906229501d62277c92293020541ea2ecdbeb7ebc213f72a149d49c7770794c293f498b9372075ca24e5a627a399b75d56a34eb654a38d15aed5ba2

Download Submit
C:\Users\Admin\Downloads\Discord-Rat-main.zip

Filesize
1.2MB

MD5
679809bf4fbf0377ea1cd813a44e873b

SHA1
5f21343a0a58749846f645432530f7a713a532ea

SHA256
a13e31488567c569f811e660b947f0192682fbb0f9cc867c1ada71438c24a838

SHA512
fef43dd4975a84fc8432acae6c5fa26a9ce2dc5dd208ab43bca0f47aaf74d08fa62b0ffdd9eada06ca4edbbff562b175978f18ffda6458f78c7c158dd7ccdeb3

Download Submit
memory/5500-244-0x0000024F3AB60000-0x0000024F3AB78000-memory.dmp

Filesize
96KB

Download
memory/5500-245-0x0000024F55190000-0x0000024F55352000-memory.dmp

Filesize
1.8MB

Download
memory/5500-246-0x0000024F55AD0000-0x0000024F55FF8000-memory.dmp

Filesize
5.2MB

Download