discordrat | hxxps://github[.]com/MrJoy00/Discord-Rat-3[.]0

Analysis

max time kernel
33s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/MrJoy00/Discord-Rat-3.0

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxNzcwMjc1MDcyNTYwNzQyNA.G9hu3J.B9CU-pJc8VH6GyTBSeEAwlHw51VCGFmWrYpb6A
server_id
1217406552798007306

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5712	Client-built.exe
5996	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
82	discord.com
84	discord.com
62	raw.githubusercontent.com
63	raw.githubusercontent.com
73	discord.com
74	discord.com
78	discord.com

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609850487970792"	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 333502.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
3108	msedge.exe
3108	msedge.exe
872	identity_helper.exe
872	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
6096	chrome.exe
6096	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5712	Client-built.exe
Token: SeDebugPrivilege	5996	Client-built.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 1800	3108	msedge.exe	82
PID 3108 wrote to memory of 1800	3108	msedge.exe	82
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 3512	3108	msedge.exe	83
PID 3108 wrote to memory of 4712	3108	msedge.exe	84
PID 3108 wrote to memory of 4712	3108	msedge.exe	84
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85
PID 3108 wrote to memory of 4884	3108	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/MrJoy00/Discord-Rat-3.0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd092d46f8,0x7ffd092d4708,0x7ffd092d4718
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,3393659021969495812,1873565829664494996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf6cdab58,0x7ffcf6cdab68,0x7ffcf6cdab78
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2272 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4312 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4668 --field-trial-handle=1832,i,16191845855952334535,7910629984851480197,131072 /prefetch:1
  2⤵
  PID:6240

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
49bf23f3d6f19bf3715e5e7276350879

SHA1
dad38efadb59bec455fee686195c845ce236ce40

SHA256
2e4a7f18d06f70cecc50092a5bfcfbbed12f0c52429392785589b6d71a131983

SHA512
6e9db3103cc234e38bf8ae344713f1bfe53a780ed7cc492217dd6f6840675c89e3414df540106f4a47f80fb71c468ee02e3a71e554ed814df7b13897429e2e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c52b05e7a4a753240fc827a5b6acc642

SHA1
ea179fb96bff1e67d69f1253078d9a7b780cd680

SHA256
441456a1dfaff3d318877c3f054f3550768a6a049960371620cc056a00088275

SHA512
91ff53cea5d54e507c42ddfd4e57950c6f21d91aa0c131e6790bddf35053e0922073f611fd2b4974c49770c23deafec6a9b54ec7ab969fda185e795ef56d9a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43943d7653247a8141f43410989de8a5

SHA1
6d1d400166970d8def9019e7fb8dd8a6eda9a00b

SHA256
0e030a8e421bdf69109afd49a9d8a3bd6853061ad54f7597b34ef156339fea1b

SHA512
251a4b8a9a4a64f78ef0e17718ca774f47f6d30afa8e1ec569fa85d4e0f3390cf935326af903b60ccc07b7ca311818ecf481e7bbbb81ad027379812fec8ac026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbdd35da67ab2f6120d4586f9aac47d4

SHA1
c8ba628132c02f9fb96c802ab395489ad7915455

SHA256
eb16167b1290a4d7744ee78b0d7f4b04ab1257744e9a859dda7e68823ca6bcdd

SHA512
b99c3432cd8b22e111c175ed2d11a572744a9a0c3126d40fc73d2b9338677d9f0026b7b6d0948c54065e18402bb04e64cc3901b74e2018b748b9cc83294a0438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90432bbe7978a4dd0dc8452415e7f8df

SHA1
ce12668056391b6fd0f6d5c54f71da2cb2b65f95

SHA256
bbc8c6deeb898333aa174d3777c606c848cc0415dfbe3920632b0be1f47035b2

SHA512
7bd13f7efdd70e760988a101b76ec5cfad50922c22ea81e5bcfc5dedb246b3addd4fa78933b535ec23ef4e327c483c9e166ac837de7280c91212a79fff765f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4de8b1b923532134498ce89f6fc2f4a1

SHA1
45cf2e2136b6254dbd1945b368cb1d25d293f8a4

SHA256
6d3039571d6841cda01898e1509bbcf92eb9446b125b3c35fa0a8c6a37315ae0

SHA512
6de7887d2e0d6787b06ca564030a5fe1a11b0bd1cc4f2d49292798787e3a8b09c6b251771f74513b6a2f020f7b3eac99309d1ee2c89484aec72256e230b03774

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 333502.crdownload

Filesize
78KB

MD5
36836eabbdd3edf8269e4c74cbda5a2c

SHA1
9be9a323aafc7a1a5e102758635d28364bab943c

SHA256
5c93a22828b72f4280e4c429130a8f85fdae34ca1ce9c2a6e57f55939188aa84

SHA512
fe00c7492eba31c0b80961cd48bd1f8165498441303efcd39b2b0cdde6336b2a47eab051d175ebd4c2cfb9b443c37693297fd787514c2585d756300ff364b4a2

Download Submit
memory/5712-222-0x000002078FCF0000-0x000002078FD08000-memory.dmp

Filesize
96KB

Download
memory/5712-223-0x00000207AA4B0000-0x00000207AA672000-memory.dmp

Filesize
1.8MB

Download
memory/5712-224-0x00000207AACB0000-0x00000207AB1D8000-memory.dmp

Filesize
5.2MB

Download