discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/download/2[.]0/release[.]zip

Analysis

max time kernel
360s
max time network
364s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2025, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
1940	msedge.exe
1940	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
4112	msedge.exe
4112	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	2144	7zG.exe
Token: 35	2144	7zG.exe
Token: SeSecurityPrivilege	2144	7zG.exe
Token: SeSecurityPrivilege	2144	7zG.exe
Token: SeRestorePrivilege	4296	7zG.exe
Token: 35	4296	7zG.exe
Token: SeSecurityPrivilege	4296	7zG.exe
Token: SeSecurityPrivilege	4296	7zG.exe
Token: SeRestorePrivilege	4476	7zG.exe
Token: 35	4476	7zG.exe
Token: SeSecurityPrivilege	4476	7zG.exe
Token: SeSecurityPrivilege	4476	7zG.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
2144	7zG.exe
4296	7zG.exe
4476	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4248	1940	msedge.exe	85
PID 1940 wrote to memory of 4248	1940	msedge.exe	85
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 1300	1940	msedge.exe	86
PID 1940 wrote to memory of 844	1940	msedge.exe	87
PID 1940 wrote to memory of 844	1940	msedge.exe	87
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88
PID 1940 wrote to memory of 4792	1940	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f15e46f8,0x7ff9f15e4708,0x7ff9f15e4718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4414636330273290208,10319506307280167881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4932

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap31299:76:7zEvent9220
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2144

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap26644:76:7zEvent5419
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4296

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3726:76:7zEvent21130
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4476

C:\Users\Admin\Downloads\Release\builder.exe
"C:\Users\Admin\Downloads\Release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dece6c717c1c6a88ab10ed5d9f2f0257

SHA1
1ce1c431a5d2cd690b7a2b4f1ab5bb706f6eecb8

SHA256
611f0215a192bbd14d5a42d35f73e7bca48e1b718e1fae2107ebb1c04f11fe00

SHA512
80b14f0477f364864b3d4972382128baffae7aa6cb6df894ee27faf52aee1863a657e1299199a41cc99f20d2f278c2bbfb058bd5d820b0893aefcbb7408df4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f91980b62b90d41317a04af356dce089

SHA1
d24d7d9d58401c252aa827eaf85314679882dff1

SHA256
ef8000aef9ee91a897870d123c0ff9c5e880b1bd65721f07ce5cfa36c9b4d92e

SHA512
75b1ca2beac89adc1bbb783b9d445f29d356f6276e0c076454a572f84e517326234aa003caae802e39579f3250197f9332dbcd15620172e9784b62a1b7dc0726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69b3ae5f8330d0644ed0898d80658eef

SHA1
d10bbd446f6ad454a565fff271c48ad8087ac48f

SHA256
7d10284010309b07dc82f31b1689bef833900222c6cf0d09ad7a076bf2665f71

SHA512
991ab00f34029c5d36d01d31c3e4c1671a0256d2764d8a122f2a8153de705ed26f1a173108725a9b3edfc7c3b4dc0531288f6d1af94405c8d2f0e9716364243f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
565824f3ac04606823d8edbcdb1834d6

SHA1
0e493045bb326fc6f6171c077e012fa07423ead6

SHA256
664cae847a69e4ec3dd83ce7aa7777e5556c40889bc8146ea47a8401c619c2f0

SHA512
6fc856b961d4ee665a7304f7567b877960574a39719e67a8ce6022ae3f472d63ce07a194eb227893a028df15e520cc4a542173f237aec148bc562a155e0b8a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3bb9c8864893f1d8bed5bc55daf67f2a

SHA1
d29c32ab453d3f24d6f7623b21587fe6188d895b

SHA256
6d57e14fc9f6d2411c8a619d43062829192c31ee8d0c2598182f2a7ff0f0473d

SHA512
e19da877e9e056776a7ace575462a12536c38e61988c243fbc8cb255c1edb77ae609b371f8c7a081273f0463f60486c8290ae139edb3d97f2f0c6591cdd04723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8072c9c418e1624ce4146ef4509a908d

SHA1
484406afb6244e8da47c75b41ea647bdc6bfb9a3

SHA256
7ff5df052e934821222e87ac6721ed4b159b31f23d7b10e21d61d583a2346ce8

SHA512
e19226ce70ceaa76dd68ce6873bf4974e5484510019930613b6979b729cb38bd79b174eacb95555187a678395a5326a1809a54719b87370e62aed8f1d52fd7d9

Download Submit
C:\Users\Admin\Downloads\Release\Discord rat.exe

Filesize
79KB

MD5
d13905e018eb965ded2e28ba0ab257b5

SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858

SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb

Download Submit
C:\Users\Admin\Downloads\builder.exe

Filesize
10KB

MD5
4f04f0e1ff050abf6f1696be1e8bb039

SHA1
bebf3088fff4595bfb53aea6af11741946bbd9ce

SHA256
ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa

SHA512
94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12

Download Submit
C:\Users\Admin\Downloads\dnlib.dll

Filesize
1.1MB

MD5
508ccde8bc7003696f32af7054ca3d97

SHA1
1f6a0303c5ae5dc95853ec92fd8b979683c3f356

SHA256
4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a

SHA512
92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/1624-148-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/1624-149-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/1624-150-0x0000000004A60000-0x0000000004AF2000-memory.dmp

Filesize
584KB

Download
memory/1624-151-0x0000000004A30000-0x0000000004A3A000-memory.dmp

Filesize
40KB

Download