asyncrat | 8acb25487c6f9daa7da1bee38bac94c1bedc14d70b5ffff51d4010d8620d5e9a

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordUpdater.exe
Size 172.5MB
Sample260620-ddqm8aes2t
SHA256 8acb25487c6f9daa7da1bee38bac94c1bedc14d70b5ffff51d4010d8620d5e9a
MD5 f919c76f46613dd087c8fcb629ae758a
SHA1 3cc7c7745d9628345d80ecd6d8f554d5fe66cc78
SHA512 8b633f40e3c260d8573757778d81387f6d0a5d1597338e318b4d4f9371b3d2eba930343536e11ca362bc79746567cc2d4b5fdc7b353d4f417becd62a32cca943
SSDEEP 1572864:I7NR7Rm1DKEM9Lx4vpOzDE0Yyb5IcIZBVAM9gjMdCjWqgXVbRgTsndR0aL/9eO:hVxsOcY7TR79T
TLSH
T17E889C03E29A40D9E01DD1B58B9B9233EE71B8494B29B6DF275407522F77EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

maz5rIHKJvqd

Attributes

delay
3
install
false
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral7/files/0x000700000002441d-14.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1256	powershell.exe
4032	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4764	netsh.exe
1700	netsh.exe
3752	netsh.exe
4840	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4652	msrt_0e58605b0b4c.tmp
1636	msrt_0e586a7d0484.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HDAudio = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DiscordUpdater.exe"	reg.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msrt_0e58605b0b4c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msrt_0e586a7d0484.tmp

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1256	powershell.exe
1256	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
2892	DiscordUpdater.exe
2892	DiscordUpdater.exe
1156	DiscordUpdater.exe
1156	DiscordUpdater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe
Token: SeShutdownPrivilege	2892	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	2892	DiscordUpdater.exe
Token: SeShutdownPrivilege	1156	DiscordUpdater.exe
Token: SeCreatePagefilePrivilege	1156	DiscordUpdater.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 644	2892	DiscordUpdater.exe	87
PID 2892 wrote to memory of 3472	2892	DiscordUpdater.exe	88
PID 3472 wrote to memory of 3752	3472	cmd.exe	90
PID 2892 wrote to memory of 1036	2892	DiscordUpdater.exe	93
PID 1036 wrote to memory of 4840	1036	cmd.exe	95
PID 2892 wrote to memory of 3316	2892	DiscordUpdater.exe	96
PID 3316 wrote to memory of 1256	3316	cmd.exe	98
PID 2892 wrote to memory of 2840	2892	DiscordUpdater.exe	100
PID 2840 wrote to memory of 3744	2840	cmd.exe	102
PID 2892 wrote to memory of 4892	2892	DiscordUpdater.exe	103
PID 4892 wrote to memory of 1904	4892	cmd.exe	105
PID 2892 wrote to memory of 4216	2892	DiscordUpdater.exe	106
PID 4216 wrote to memory of 3340	4216	cmd.exe	109
PID 2892 wrote to memory of 4652	2892	DiscordUpdater.exe	110
PID 2892 wrote to memory of 2008	2892	DiscordUpdater.exe	111
PID 1156 wrote to memory of 1048	1156	DiscordUpdater.exe	115
PID 1156 wrote to memory of 2212	1156	DiscordUpdater.exe	116
PID 2212 wrote to memory of 4764	2212	cmd.exe	118
PID 1156 wrote to memory of 4388	1156	DiscordUpdater.exe	119
PID 4388 wrote to memory of 1700	4388	cmd.exe	121
PID 1156 wrote to memory of 4220	1156	DiscordUpdater.exe	122
PID 4220 wrote to memory of 4032	4220	cmd.exe	124
PID 1156 wrote to memory of 3900	1156	DiscordUpdater.exe	125
PID 3900 wrote to memory of 408	3900	cmd.exe	127
PID 1156 wrote to memory of 4488	1156	DiscordUpdater.exe	128
PID 4488 wrote to memory of 4492	4488	cmd.exe	130
PID 1156 wrote to memory of 1636	1156	DiscordUpdater.exe	131
PID 1156 wrote to memory of 4632	1156	DiscordUpdater.exe	132

C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1744,i,6256580484876466240,33566557993628984,262144 --disable-features=BlockInsecurePrivateNetworkRequests,RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="Windows Push Notifications Service (9bc1)" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Push Notifications Service (9bc1)" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="Windows Push Notifications Service (9bc1)" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Push Notifications Service (9bc1)" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DiscordUpdater""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DiscordUpdater"
    3⤵
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio"
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" /f
    3⤵
    - Adds Run key to start application
    PID:3340
- C:\Users\Admin\AppData\Local\Temp\msrt_0e58605b0b4c.tmp
  "C:\Users\Admin\AppData\Local\Temp\msrt_0e58605b0b4c.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord" --field-trial-handle=1936,i,6256580484876466240,33566557993628984,262144 --disable-features=BlockInsecurePrivateNetworkRequests,RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:3
  2⤵
  PID:2008

C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1776,i,1001354670819954717,3995574630336285833,262144 --disable-features=BlockInsecurePrivateNetworkRequests,RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="Windows Update Service Agent (8eec)" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Update Service Agent (8eec)" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall firewall add rule name="Windows Update Service Agent (8eec)" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Update Service Agent (8eec)" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DiscordUpdater""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "DiscordUpdater"
    3⤵
    PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HDAudio"
    3⤵
    PID:4492
- C:\Users\Admin\AppData\Local\Temp\msrt_0e586a7d0484.tmp
  "C:\Users\Admin\AppData\Local\Temp\msrt_0e586a7d0484.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord" --field-trial-handle=1892,i,1001354670819954717,3995574630336285833,262144 --disable-features=BlockInsecurePrivateNetworkRequests,RendererCodeIntegrity,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:3
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26
MD5 029fbf628b046653ab7ff10b31deeeb2
SHA1 93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c
SHA512 d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c
TLSH
T192112227F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fncq0ii2.g3f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fncq0ii2.g3f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

msrt_0e58605b0b4c.tmp

Path C:\Users\Admin\AppData\Local\Temp\msrt_0e58605b0b4c.tmp
Size 45KB
SHA256 ec290bb921b463398c68af42f9e0e92eab08ca1008a6a268b6ad3c9f4f63d745
MD5 ff9e5d5560a619a1580f78239f566dfa
SHA1 b5e966cd56c3150b7ac4a6f4112f01009e78e33e
SHA512 77085a936fa3c03f8a0276e7f8e1206ab764be4d3bb6b2759bdf050a651db0d4d2e4a8b006c166aa90e5a32dd3e505c5db60f794ff52af5b8dccc12b320998d5
SSDEEP 768:Wu/dRTUo0HQbWUnmjSmo2qMeInZKlL6JPIP8zjbVgX3/gCfKADyjtHKBsqvsBDZg:Wu/dRTUPE2a2YL6mP83byXvgUItKEdix
TLSH
T142233C0037E8812BF2BE4FB8ADF261054A7AF2677603D5891CC452DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Discord\Local State
Size 434B
SHA256 dec3e52b2aefb1bc5bd9bdc36df2e4db236c81aa3ff412832db7b53a1ed0391e
MD5 fd86d27d1e0e54bf1e306f18bebc8099
SHA1 c2d3bb069c5a32e3c9cc0932de829c7da164229d
SHA512 c5eaf8d63d1de46b533929c46708e3119e019327e3895b8ea0df0d364bcbd272393fb373439b0d5ad1cd648c7ca0d15f0bf2285582d71e5594ab1275c3249358
TLSH
T162E02B32F8242AD53AB486080A089B309C2800FB8185B482D48E092722F222F821AE34
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Discord\Local State
Size 434B
SHA256 81110d72b1431b89cd899088a0399940d5fbe86d6d6357ebc381c29658a6be31
MD5 cdb4c24d3021dbfb0c82727da602e55c
SHA1 534de3eecaea7290cb46d516583b9ad957cf7737
SHA512 1d826f6b4b1fc407f8992ec50acee80f3c74b102d1f701c410046d683daad28e504f271cb47762605b37d59158ea1762c4acf0019e7f41d6aa4854154e535d39
TLSH
T12DE0233260802EF9B69448914008A3050C221127C38DC721E71C060651B3F55D301C34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1256-6-0x000002241DA60000-0x000002241DA82000-memory.dmp

Download

memory/4652-16-0x0000000000350000-0x0000000000362000-memory.dmp

Download