discordrat | 2180e15588a7ef82b71b0b63e7f93a46cd06c330b966e4a4ae858d20be0417ca

Analysis

user interaction
yes
max time kernel
346s
max time network
349s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Walftech-Game-203160 (1).zip
Size 2.2MB
Sample260703-v5r4ssh19n
SHA256 2180e15588a7ef82b71b0b63e7f93a46cd06c330b966e4a4ae858d20be0417ca
MD5 1cdbfaa1416b28150cdf1b764a2ffb16
SHA1 a324c86ec72a90146aaa60cb4bd419e738c34ff3
SHA512 ed187040575e6365b66cc0196966c8f63e898b5654d575cdfe505bd278aa5d95d3396c9867d28c14a20f31c72d1212cc780dd746d9fcde7c35418979b1d8e454
SSDEEP 49152:mazmzKWPEdJdOvmRw5QO4Daq2KwbvhwrLAanyvkwHz:mazmzKWwRD56bvy/n9K
TLSH
T113B5335A5F6F48AAD50177F14673A288E83DB060CEDD2F2C3D0BE0F656960EDBD21A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery discordrat persistence ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyMjU2MDYzMDgyODA0MDI4NA.GmBkUW.ecf779_D_ZDKQUGurzto5zRlgHkXBWfyK7anis
server_id
1522539518136422510

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
72	discord.com
76	discord.com
77	discord.com
1	discord.com
64	discord.com
68	discord.com
70	discord.com
71	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275737866609088"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2764	chrome.exe
2764	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe
Token: SeShutdownPrivilege	2856	chrome.exe
Token: SeCreatePagefilePrivilege	2856	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe
2856	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2036	2856	chrome.exe	90
PID 2856 wrote to memory of 4800	2856	chrome.exe	91
PID 2856 wrote to memory of 4256	2856	chrome.exe	92
PID 2856 wrote to memory of 4256	2856	chrome.exe	92
PID 2856 wrote to memory of 2792	2856	chrome.exe	94
PID 2856 wrote to memory of 2792	2856	chrome.exe	94
PID 2856 wrote to memory of 2996	2856	chrome.exe	95
PID 2856 wrote to memory of 812	2856	chrome.exe	96
PID 2856 wrote to memory of 2996	2856	chrome.exe	95
PID 2856 wrote to memory of 812	2856	chrome.exe	96
PID 2856 wrote to memory of 5016	2856	chrome.exe	97
PID 2856 wrote to memory of 5016	2856	chrome.exe	97
PID 2856 wrote to memory of 4388	2856	chrome.exe	98
PID 2856 wrote to memory of 4388	2856	chrome.exe	98
PID 2856 wrote to memory of 2068	2856	chrome.exe	99
PID 2856 wrote to memory of 2068	2856	chrome.exe	99
PID 2856 wrote to memory of 4064	2856	chrome.exe	100
PID 2856 wrote to memory of 4064	2856	chrome.exe	100
PID 2856 wrote to memory of 5820	2856	chrome.exe	101
PID 2856 wrote to memory of 2644	2856	chrome.exe	102
PID 2856 wrote to memory of 5252	2856	chrome.exe	103
PID 2856 wrote to memory of 2644	2856	chrome.exe	102
PID 2856 wrote to memory of 5252	2856	chrome.exe	103
PID 2856 wrote to memory of 4668	2856	chrome.exe	108
PID 2856 wrote to memory of 4884	2856	chrome.exe	107
PID 2856 wrote to memory of 4668	2856	chrome.exe	108
PID 2856 wrote to memory of 1804	2856	chrome.exe	109
PID 2856 wrote to memory of 4884	2856	chrome.exe	107
PID 2856 wrote to memory of 1804	2856	chrome.exe	109
PID 2856 wrote to memory of 1332	2856	chrome.exe	110
PID 2856 wrote to memory of 1332	2856	chrome.exe	110
PID 2856 wrote to memory of 592	2856	chrome.exe	112
PID 2856 wrote to memory of 1328	2856	chrome.exe	111
PID 2856 wrote to memory of 592	2856	chrome.exe	112
PID 2856 wrote to memory of 1328	2856	chrome.exe	111
PID 2856 wrote to memory of 2940	2856	chrome.exe	113
PID 2856 wrote to memory of 2940	2856	chrome.exe	113
PID 2856 wrote to memory of 4908	2856	chrome.exe	114
PID 2856 wrote to memory of 5784	2856	chrome.exe	115
PID 2856 wrote to memory of 4908	2856	chrome.exe	114
PID 2856 wrote to memory of 5784	2856	chrome.exe	115
PID 2856 wrote to memory of 5896	2856	chrome.exe	116
PID 2856 wrote to memory of 5556	2856	chrome.exe	117
PID 2856 wrote to memory of 5896	2856	chrome.exe	116
PID 2856 wrote to memory of 5556	2856	chrome.exe	117
PID 2856 wrote to memory of 1624	2856	chrome.exe	118
PID 2856 wrote to memory of 6080	2856	chrome.exe	119
PID 2856 wrote to memory of 676	2856	chrome.exe	120
PID 2856 wrote to memory of 4064	2856	chrome.exe	121
PID 2856 wrote to memory of 4064	2856	chrome.exe	121
PID 2856 wrote to memory of 4200	2856	chrome.exe	122
PID 2856 wrote to memory of 4200	2856	chrome.exe	122
PID 2856 wrote to memory of 2764	2856	chrome.exe	123
PID 2856 wrote to memory of 5296	2856	chrome.exe	124
PID 2856 wrote to memory of 3544	2856	chrome.exe	128
PID 2856 wrote to memory of 3544	2856	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Walftech-Game-203160 (1).zip"
1⤵
PID:1268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc69bcc728,0x7ffc69bcc734,0x7ffc69bcc740
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,10272148198850091247,8097422372022015563,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,13876851726808710211,10051936820420281434,262144 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,16296533117403520435,9041023993362776546,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,17705338424805594086,11167853318409640795,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,7943379682048194143,3708622256517805448,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,8540368291797947927,16972486472993689192,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,15264218248428589302,15978844074415471285,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,11128207538832486835,779951129681185322,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,5415613795175011150,8564109421794951633,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,7961227198367790531,14542584880937210789,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5348,i,13587163000661388549,15877586513294836871,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5560,i,12280012985756347240,13169069467914593305,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5608,i,4526636858376139807,10007104571937135034,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,681011069033815926,16825386385823609715,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6060,i,3042474943787489229,1350927653618392883,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6280,i,18046100369403951577,9488535675526682937,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5492,i,2107040691143427440,12888562011114057945,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,2954805625959994495,8889057844798624566,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5540,i,4080146579423272959,12375700203662855329,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6348,i,6528425060871782952,12242799336186034915,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,655931723021163344,9975772833547015036,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5540,i,82666615626784078,2900056431573990224,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:9
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6524,i,4676549724516838234,3500049662353452337,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6035288117243669678,8264674815499427747,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,4540400813361337606,13607033461321318352,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,5024715014458056599,15240412131627361640,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6332,i,13758202419908447762,11728242506179470855,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5808,i,12333470497943046751,7773327421600516761,2097152 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6688,i,12958912353624521390,8790657155682088574,262144 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,16892482344003284083,13036681089885983782,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1248,i,7161566683842612677,7791263225538289286,524288 --field-trial-handle=1740,i,963022022179112875,2551770260527054099,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:3544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\8ec49e0d-393f-43df-bfba-e0597a2eb032_Discord.RAT.3.0.zip.032\Discord RAT 3.0.exe
"C:\Users\Admin\AppData\Local\Temp\8ec49e0d-393f-43df-bfba-e0597a2eb032_Discord.RAT.3.0.zip.032\Discord RAT 3.0.exe"
1⤵
PID:2532

C:\Users\Admin\Downloads\Discord.RAT.3.0\Discord RAT 3.0.exe
"C:\Users\Admin\Downloads\Discord.RAT.3.0\Discord RAT 3.0.exe"
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 677f4e114758eb7815f1aa84a19f57d1b603486db2f8538be66f66ff63b050f3
MD5 95445c6c0e78b69bf6afa1b51c38ea13
SHA1 1490436c229de97ff8ec99f7f0ee2e2336a3f453
SHA512 c457e1e6bfd738ae8190562b503894ce7d1bf1db83abc75489d008c571767c1b50339a6ca5552f7ac2dd6564e2002cf440e0592757f0403644b1fd5fb2f1617c
TLSH
T14B31D630B7A2C0E6CF13D43ED2D6996131B0886ED0031E134048947C79273DCF2A8356
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b88e203624b5cd1cf9e7f78da5962e186c04a2d46574b4b9eb67a2469ef47630
MD5 e795de96634fd11af4802528af819307
SHA1 dac9521d7879451036058fffd1cdbe99dcc918db
SHA512 f8d9e8296c5769ee4d3a11f7449dc0833153f37530a67452aa320e54738d89aa5597e8bbd23a1e5d91088f8f92ee18226329d10f873ce40ac7a66e58c70ff32c
TLSH
T192716278A75E80E9D72BC03ED5DA3B21377F899CD04F4E1750BB4875344B32C9665211
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6ac9fbfec2873ec4237e3fa385219d16372debc3038f982d5a1aa2e6fdac37d3
MD5 9b24d49574545ca625cc161f16436d46
SHA1 086f7d302642e156631fb4f9378a5ff3ae31beb1
SHA512 58fdbf97842cac02735db11a4f6e121ccc0c0badb18f01ad070997432c3406ae18195e88cc62c18a8eb3f05c5aa4525974057f9b46c34e0dab0505768f03da7b
TLSH
T1A1518BB7C3D88A7DC81152E89B217E1BCD2E0A18521D3C22C8D8EE4F53F2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f4aaedf87c08bebd37ac7f1e055724659274b409db9dddd129ab8e9dc889b929
MD5 c1e6892dcef610d6817708eabde526ef
SHA1 ce9c313d315a381bd5133fd6257c4f5645b64b54
SHA512 0d1369a9bb4cadccbd14e1c4bd60d51bab72e46ddc98650e49399b8a2107523712eca4da9a32c0f24c62fdb811e5fa7a1e2480576044ba1af4bb274abc485ba8
SSDEEP 96:D8VSVqmgmtwYOE/UU6uIHm4mmmHmDmO+mgj:D8VSMmgmmYOE/UU3IHm4mmmHmDmzmgj
TLSH
T150A1ADF7C7E59A6D891156F4AB14BE1BCE2D0928431D3C66C8E4BE4B93F2872D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 90e7ebf56a5341d473424cf1c50622425878a8cc5ded9419e513bcc1c0efeb42
MD5 efd362ea03452466e763baf13b8fd1d2
SHA1 ed48eba85246246f8f58df9ecf65818f74aed92d
SHA512 bb6f0358d8eca4d14cb1c05d4551abba21e6aba709cae47f3e0470c1ef110b6e3759d3d6e6ec542dc57b9d38d50bf4aa9f88fcc67500956bb650506ebe93055b
SSDEEP 96:D8VSVqmgmtgWRYOE/UU7m4mmmHmDmO+mg9EC:D8VSMmgm2UYOE/UU7m4mmmHmDmzmg9EC
TLSH
T146A1BEF7C7E58A6DC91156F4AB24BE1BCE2D0918431D3C2688E4BE4B93F2872D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f2909a150a05ea57395dd8a91fea8d4ef488457ebaf394263ace7f1bc8c3985c
MD5 8f5b7a48ed7a167789786401b5bd0c7a
SHA1 e7b0c57990220584661603cbec48a9afdef13ed9
SHA512 81a6992b09689146312ce3d1d2a41be8b3181d47470b05308643029170e6a56be02a356f3af8f1d39b0e35e398201e0acb90821a0aab9e4f8f10b67b13670203
SSDEEP 192:FRWVlNqv722uIAPRp25i9gHsb+WNno0dd8eMEAVyIsnAUge:FRWV7ma9XDyw/dkEEe
TLSH
T17B32932EAD10A93B5CCBD31EFE257B57D2F5102131942E84EAF88A2C16E75CD721742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3703e01b28734078f4a123b4f6028b0965d9889a60684255e9cb8139472df1c7
MD5 0fb6178dfadf6faf1cbba981fd3d8afc
SHA1 0b47e1ad05fe323c6c0f6e3b65dc7b1c46e20220
SHA512 47df4ce53474ad3be6e32cf12d9bbf75e3d3f58e7365bf284830f7b582ee8860421fc00dcccb5f91962ad5a5a3314911984376113fc2a07f7b31133a64b449ee
SSDEEP 192:FRWVlAVv722uIAPRp25i9gHsb+WNno0dT8eMCAVyIsnAUgE:FRWVula9XDyw/d+CEE
TLSH
T19B32952EAD10A93B5CCBD31DFA257B57E2F5102531942E84EAFC8A2C16E75CD721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddd2fc7352ec52986af067823cbe51bfb2412e14c5a589b340095d9ad3cdb479
MD5 636ba88397b0b609fdcf9b0f1655a878
SHA1 65056e0fb9f6e80cdf36aa8b767be4dbffef0618
SHA512 1479aaecde2d77663814abc397ed3547a2883e78ab79f4531d35ad3d111c0a3601b86434e1e1ba969fa4a9d57d9365c96d9afc634d3c261d52e5e1b7446148fc
SSDEEP 192:FRWVlCOv722uInPRpD55kH9gHsb+WNno0Isd2G8eMkAVyIsnAUgE:FRWVwqaYXuyw/F2FkEE
TLSH
T18642956EAD20693B5CCBD71DF9257B56E2F5102132A02E48EAFC8A1C16E76CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b72a08e3302bfe6466d3cf534c05a25e3f1239b2efaddadb111808d77373dd1c
MD5 c4e782e21f6df5e3d3d45b4af62985e4
SHA1 9655b24d1fbc9b03a4154009a0a57d089eedf82e
SHA512 07c64d5dc57d4cd77b4de9c532d6ec9431124878ea6d8e96d66a336d548533c542a72078ec6bab706ad4b28d55eef76944dcb9e9658f3d92f88936fb78f7a8b9
SSDEEP 192:FRWVll/v722uInPRpD55k29gHsb+WNno0IFKET8eMkAVyIsnAUgE:FRWV/XaYXvyw/RE+kEE
TLSH
T15242956EAD20693F5CCBD71DF9257B56E2F1102132902E48EAFC8A2C16E76CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e994f215013b54d446d91619861ab9e911f6855714a0003e4e76533f4c4032d3
MD5 4e5d9e93bf5e4ae8242a3b83c48f8b72
SHA1 a557546796611776241bf39e710fde2994b2080d
SHA512 8b7695345dd304d1e1faa8c2d10a0904805cce187585608629bc966ef435aafe20079e253f1f93a78cc5c728b76c6565122fe4d2da14c2ec15c85ee5d4e49f24
SSDEEP 192:FRWhllsv722uInPRpD55k29gHsb+WNno0I51uu8eMkAVyIsnAUgE:FRWh/4aYXvyw/SutkEE
TLSH
T1D842956EAD10693F5CCBD72DF9657B56E2F1102132901E88EAFC8A1C16E76CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 30577848e01913d8109903d16803ae3aee296500dcfc6d1c37e6d4c50ed5eb86
MD5 2762b58d789850e54941dc7cf247b361
SHA1 650c2452e6ed9bcbe10b027ec215b83e4e7b76af
SHA512 2a4681bd487466a0fb9c6c99ab874302f8caf638893768d8197cbfbfab10187f0302bfbed40addb0b64166879c60107f66976cca6715b461a895a10ba42e81f5
SSDEEP 192:FRWhll/v722uInPRpD55k29gHsb+WNno0I51uu8eMkAVyIsnAUgE:FRWh/XaYXvyw/SutkEE
TLSH
T1A042956EAD10693F5CCBD72DF9657B56E2F1102132901E88EAFC8A1C16E76CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 522b1144b2d2c8106e7023654e9c2f65fd5dea0bbf57704bacaa8514954b88ff
MD5 90862299469a51f4b28268d35754f115
SHA1 e195460d31c32022409efda4e6458228b760253b
SHA512 00443eb94c823303c7e3f53fd0cefcadb51da48bcb2e1de73509d8803ac3ebe6d07972ad3c9335bf84e1d644081d0304806737f6f93dbcbfb316fc329727b17a
SSDEEP 192:FRWVlatv722uIAPRp25i9gHsb+WNno0dd8eMEAVyIsnAUge:FRWVkNa9XDyw/dkEEe
TLSH
T17C32942EAD10A93B5CCBD21EFA257B57D2F5102131942E84EAFC8A2C16E75CC721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 881ac1dbb30a4f980da3ccd6d536272bd6d41105096f62960df91403d63acc50
MD5 e5d2ca1a63fec7fdac70f03d5391f46b
SHA1 1c9297049318ed0052421413edd39cf5a9cc14a2
SHA512 3097d7f228e671f840257ec488a59ca9a09aaa4f9038aa1565c4117e352ebe02ef3991f7084257227450f9be9a40cf36fae5a094fc5798a273a8dfa5e3ba46ba
SSDEEP 192:FRWVlisv722uIAPRp25i9gHsb+WNno0dT8eMCAVyIsnAUgE:FRWVU4a9XDyw/d+CEE
TLSH
T12E32952EAD10A93B5CCBD31DFA257B57E2F5102531942E84EAFC8A2C16E75CD721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 4865ed4e7972d3799c5b9ecb440585d64e018682da12f4b0757152879d5acce2
MD5 9d2ad3e393a059f9eee69aef5b336bb9
SHA1 a301c1ec02f546bc5959d56d8d8a72f4603cad7f
SHA512 a7a5c0994e97081ea33bc891b6a37a9f30fc0ba23c5ab409867354e3b1419ed5ebdecd7485ab657ede8761b01e30e21d3f71f4f1815584fb8733cb4f4d6acba0
SSDEEP 384:T9jYb7KxkXqKf/pUZNCgVLH2HfgslNXXODYX+ErU361HGu11O69h:TdYb7KxkXqKf/pUZNCgVLH2HfgsjnOMv
TLSH
T188520927688D9A3F0FD8C64CDC166F4FADB5025766B8492896FA9C0803957CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4d28c7808ab99ee9246d2360db8370c9fb1dd068f6e5478fb187ae3806146b6d
MD5 61a984c61ef04839b1d772e2640301c6
SHA1 826ccaebe2eb5fb630fc3e595d52a826ccee7e02
SHA512 d2fc3e32c0e30c8671cd608f6a1c9e683473bc92970f9e66a68010422a81f46c9bb0600122df91c059089c05eee84fa2b0802dec96be89e286b06148d8518e65
TLSH
T100A0025049C24822CD0083BA657689413372A95475D6570358D2D448EC9B2C04101541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7b0d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a7b0d.TMP
Size 48B
SHA256 f58fa94d08d5c4711959afba58dd18baa080a60f05939a57dd6eeb484165a94f
MD5 c0c44c1da09b3e687fe2d1956dd8c145
SHA1 3dc9e0f7fc882f7c1524ab5877fabf321f6b140b
SHA512 3dd47cdaf84edae90afa47f5e42ef6bd7d7666db54d403ad34f0252d32c5a39230d615ec247faeeb34a86b26a331e134d8a8e767e05e16ff5658322b9de0729b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 6ae81b3b7c0afb87d97d4daad1ad6ee732e0d614bae0f37b8f6564cd31084878
MD5 370c412b0e72e6244861c8b8674f3756
SHA1 e0fa9930efd3548a152a17b77355034571da37ff
SHA512 3282202f1941ed19397bf60ee7b1a4c47370f0d83b4243e8e1a3b18917823ac54943dd9f0c357e81244f59cc3e5c98938e0469fd43de161a40873bcb5bd88b63
SSDEEP 3072:jj1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5t:j5mg1kQfATCFbzQACjC
TLSH
T154C3125A4EF40DFE171604A222422EB5F3D5AB3FDF522E9C936B07F616C7C8A2346412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 203KB
SHA256 89063dfe96584f4130f1d3d5979a25af7b3561d3380741fdee9704ee7a2fb89b
MD5 e7996b95cc22623c98188ad10d793c44
SHA1 c446c206358bbde07de4c10291bfe236709507c6
SHA512 aba86611c51a029fa72168c971535c5864997098341998ba66783aedd3007b6364ca3b488fcd3c0a56d06789ae5cad394fad0ea2f1ef09d5c29674475b704c4e
SSDEEP 3072:KKgYLovcNH88OQTpyov7iRQ1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5t:K4uWct+pzv7iR2mg1kQfATCFbzQACjC
TLSH
T10D1423998DBC5DFF2B01045AB04539763EDAA72DDE626D0CE54F3BEC658B4C213424A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 b73e10f03e9d76e8f60b42dd8bc2802b98f0e9be41104b4050e7cf392b32bb28
MD5 6fb34923d7f6930cd40063f128ded317
SHA1 8895f9376d025b4242b63d1015ef7cc7a516d45c
SHA512 17f76e8a348e2cf7bd8ec4d0ff4ee46a20ad1523575fb0360b9c213562a12c98224371012c8be1e9d8397683b0ce143fc33fa6e53fa1dae45b41e484d3c54f07
SSDEEP 3072:W21mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5t:W8mg1kQfATCFbzQACjC
TLSH
T1C0C3136E4DA40DFE0B12086521423D75EAE5BB3FDF162E9CA35E07F956CBC8A1743012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 95b37c377c625ea98c7ea945faa9de31190a34212eea91faeada1c9292d6af94
MD5 4246c2d94164409fca8037c07d177647
SHA1 a5a20661553576cb53dc927377061dee9c47a7e1
SHA512 dded6dab551db20ac50449f32b3c678ab8b3a8f4f74819ed588bba94d6b3268ca72b16eb1f23723ae7128c4df3934a7d8298483ee0a2577bd27e60ff3bae1590
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyoCdPRDotok5ZgDVB6XGyvSO8R9PEtvZF9v4a:eCC1YIcYkVK8Wyo8DUDArv88R9sthFh
TLSH
T159A1F73169684DB359B6C68976023F43CF64B06BAA71AF48DADD5A0C15FB0FD5302227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 83e171d8806b3fb9a7731d6bbbf099fa0a3096f3fb5eed38e3fa9b3d6ee49c34
MD5 c8f6ad860ce7e34b9b0aa3904804feb7
SHA1 4d9314348600cb77e1875ff2ebac9a71ef339aed
SHA512 3b068568261655557d26d568f782f4f1ee827f7de0ea686a75b5a92ebb77a09c98ea01300402d1e87525a33dae0c855368332398af3f7bc9b6c21ed09949f948
SSDEEP 3072:Aj1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5t:A5mg1kQfATCFbzQACjC
TLSH
T10EC3135A4EF40DFE1716046222422E75F3D5AB3FDF522E9C936B07F616C7C8A2346412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2856_2078209220\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.RAT.3.0.zip.crdownload

Path C:\Users\Admin\Downloads\Discord.RAT.3.0.zip.crdownload
Size 440KB
SHA256 15e857eeeb38477842e69473c932feb2069bb27172d56e6bb3f166e8d4765b9f
MD5 cb9fa34bdfc307594966daf6e1bb31b4
SHA1 80bcde7de3c7ec1742070fcf1c97fb161c57f726
SHA512 171c3240f726d9697606c2dadff59264bbcf866e543477e3e2cc3d496072dd31a9823415ce8e71dffbb47e047f6f8c39c312e9ffa85818e79281f66c6e5b3413
SSDEEP 6144:U23+qW/qpWfo9LYmgg6n4+ONlfMb0HBSdzvKpUb5ycqJGXWMqbXtG+34Ll8tIQ9R:Dh8o9LHx6n41NNQdsc7WTLtt326gk
TLSH
T160A4231485C3B41E49DB5C71369BEE7DCD6CA4CBEB9141AA750D020372A71D8AF20E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-947-0x0000025EBEF00000-0x0000025EBEF18000-memory.dmp

Download

memory/2532-948-0x0000025ED9620000-0x0000025ED97E2000-memory.dmp

Download

memory/2532-949-0x0000025ED9F10000-0x0000025EDA438000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads