dcrat | d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Size

2.4MB
MD5

16be4b35fbc59aa471fff4ab77f53c5e
SHA1

5d31d96f0562309fc24294ecfdb3d2a26b238764
SHA256

d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf
SHA512

29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45
SSDEEP

49152:pCZ/7MmTJP/uNiZ4qBpWVPW6dKiXGRhuknLwFPy4Eiw7m:aDMmTJXui4qBpWLZgukLwkiA

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2472	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2472	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2472	schtasks.exe	30

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2692-1-0x00000000000D0000-0x000000000033E000-memory.dmp	dcrat
behavioral1/files/0x0008000000016c4a-19.dat	dcrat
behavioral1/memory/2488-21-0x0000000000300000-0x000000000056E000-memory.dmp	dcrat
behavioral1/memory/476-35-0x0000000000030000-0x000000000029E000-memory.dmp	dcrat
behavioral1/memory/824-48-0x0000000000BC0000-0x0000000000E2E000-memory.dmp	dcrat
behavioral1/memory/2352-61-0x00000000003B0000-0x000000000061E000-memory.dmp	dcrat
behavioral1/memory/2340-73-0x0000000000010000-0x000000000027E000-memory.dmp	dcrat
behavioral1/memory/1692-85-0x00000000012B0000-0x000000000151E000-memory.dmp	dcrat
behavioral1/memory/1584-133-0x0000000000220000-0x000000000048E000-memory.dmp	dcrat
behavioral1/memory/1432-146-0x0000000000AE0000-0x0000000000D4E000-memory.dmp	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2488	audiodg.exe
476	audiodg.exe
824	audiodg.exe
2352	audiodg.exe
2340	audiodg.exe
1692	audiodg.exe
2916	audiodg.exe
316	audiodg.exe
2628	audiodg.exe
1584	audiodg.exe
1432	audiodg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
18	pastebin.com
21	pastebin.com
24	pastebin.com
33	pastebin.com
9	pastebin.com
12	pastebin.com
27	pastebin.com
30	pastebin.com
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2816	schtasks.exe
2852	schtasks.exe
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2692	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
2488	audiodg.exe
476	audiodg.exe
824	audiodg.exe
2352	audiodg.exe
2340	audiodg.exe
1692	audiodg.exe
2916	audiodg.exe
316	audiodg.exe
2628	audiodg.exe
1584	audiodg.exe
1432	audiodg.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Token: SeDebugPrivilege	2488	audiodg.exe
Token: SeDebugPrivilege	476	audiodg.exe
Token: SeDebugPrivilege	824	audiodg.exe
Token: SeDebugPrivilege	2352	audiodg.exe
Token: SeDebugPrivilege	2340	audiodg.exe
Token: SeDebugPrivilege	1692	audiodg.exe
Token: SeDebugPrivilege	2916	audiodg.exe
Token: SeDebugPrivilege	316	audiodg.exe
Token: SeDebugPrivilege	2628	audiodg.exe
Token: SeDebugPrivilege	1584	audiodg.exe
Token: SeDebugPrivilege	1432	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2488	2692	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 2692 wrote to memory of 2488	2692	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 2692 wrote to memory of 2488	2692	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 2488 wrote to memory of 1992	2488	audiodg.exe	35
PID 2488 wrote to memory of 1992	2488	audiodg.exe	35
PID 2488 wrote to memory of 1992	2488	audiodg.exe	35
PID 2488 wrote to memory of 1636	2488	audiodg.exe	36
PID 2488 wrote to memory of 1636	2488	audiodg.exe	36
PID 2488 wrote to memory of 1636	2488	audiodg.exe	36
PID 1992 wrote to memory of 476	1992	WScript.exe	38
PID 1992 wrote to memory of 476	1992	WScript.exe	38
PID 1992 wrote to memory of 476	1992	WScript.exe	38
PID 476 wrote to memory of 2596	476	audiodg.exe	39
PID 476 wrote to memory of 2596	476	audiodg.exe	39
PID 476 wrote to memory of 2596	476	audiodg.exe	39
PID 476 wrote to memory of 2296	476	audiodg.exe	40
PID 476 wrote to memory of 2296	476	audiodg.exe	40
PID 476 wrote to memory of 2296	476	audiodg.exe	40
PID 2596 wrote to memory of 824	2596	WScript.exe	41
PID 2596 wrote to memory of 824	2596	WScript.exe	41
PID 2596 wrote to memory of 824	2596	WScript.exe	41
PID 824 wrote to memory of 900	824	audiodg.exe	42
PID 824 wrote to memory of 900	824	audiodg.exe	42
PID 824 wrote to memory of 900	824	audiodg.exe	42
PID 824 wrote to memory of 1444	824	audiodg.exe	43
PID 824 wrote to memory of 1444	824	audiodg.exe	43
PID 824 wrote to memory of 1444	824	audiodg.exe	43
PID 900 wrote to memory of 2352	900	WScript.exe	44
PID 900 wrote to memory of 2352	900	WScript.exe	44
PID 900 wrote to memory of 2352	900	WScript.exe	44
PID 2352 wrote to memory of 1480	2352	audiodg.exe	45
PID 2352 wrote to memory of 1480	2352	audiodg.exe	45
PID 2352 wrote to memory of 1480	2352	audiodg.exe	45
PID 2352 wrote to memory of 2896	2352	audiodg.exe	46
PID 2352 wrote to memory of 2896	2352	audiodg.exe	46
PID 2352 wrote to memory of 2896	2352	audiodg.exe	46
PID 1480 wrote to memory of 2340	1480	WScript.exe	47
PID 1480 wrote to memory of 2340	1480	WScript.exe	47
PID 1480 wrote to memory of 2340	1480	WScript.exe	47
PID 2340 wrote to memory of 2280	2340	audiodg.exe	48
PID 2340 wrote to memory of 2280	2340	audiodg.exe	48
PID 2340 wrote to memory of 2280	2340	audiodg.exe	48
PID 2340 wrote to memory of 2564	2340	audiodg.exe	49
PID 2340 wrote to memory of 2564	2340	audiodg.exe	49
PID 2340 wrote to memory of 2564	2340	audiodg.exe	49
PID 2280 wrote to memory of 1692	2280	WScript.exe	50
PID 2280 wrote to memory of 1692	2280	WScript.exe	50
PID 2280 wrote to memory of 1692	2280	WScript.exe	50
PID 1692 wrote to memory of 992	1692	audiodg.exe	51
PID 1692 wrote to memory of 992	1692	audiodg.exe	51
PID 1692 wrote to memory of 992	1692	audiodg.exe	51
PID 1692 wrote to memory of 2316	1692	audiodg.exe	52
PID 1692 wrote to memory of 2316	1692	audiodg.exe	52
PID 1692 wrote to memory of 2316	1692	audiodg.exe	52
PID 992 wrote to memory of 2916	992	WScript.exe	53
PID 992 wrote to memory of 2916	992	WScript.exe	53
PID 992 wrote to memory of 2916	992	WScript.exe	53
PID 2916 wrote to memory of 2572	2916	audiodg.exe	54
PID 2916 wrote to memory of 2572	2916	audiodg.exe	54
PID 2916 wrote to memory of 2572	2916	audiodg.exe	54
PID 2916 wrote to memory of 2596	2916	audiodg.exe	55
PID 2916 wrote to memory of 2596	2916	audiodg.exe	55
PID 2916 wrote to memory of 2596	2916	audiodg.exe	55
PID 2572 wrote to memory of 316	2572	WScript.exe	56

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
"C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2692
- C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
  "C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5accfb1-90e1-4926-a1ac-3cf3899b259d.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
      C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a550d8f-5704-45bc-b7c4-0fbe730140de.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
      - C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9bdae8b1-267e-4c01-acfa-c766a2ae8cb5.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8df2e02c-a48d-40d9-b1e9-be9c08cc834f.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2eb2e551-e65e-4a98-a5f3-5601ecf980c5.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a19a8a06-3b80-425c-befb-59af474038de.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef270543-6aff-4250-be73-903f950ef92f.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\367298e9-99b6-4344-8064-1dc2da558041.vbs"
        17⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97b6cf27-caf3-42c1-9553-33c4bef6cdde.vbs"
        19⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ec886a6-9506-49e2-bbce-237da05bd169.vbs"
        21⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34c25aec-67a5-403c-bbf6-801d6a8a475b.vbs"
        23⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\058c0907-df88-4076-93b3-ab60154ff6e7.vbs"
        23⤵
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3bd2a29-634a-4cc6-ba19-3687695f4182.vbs"
        21⤵
        
        PID:1544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\306cf373-fd31-4925-8b2c-17d2264d0bcc.vbs"
        19⤵
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c2d84f3-6ffe-4879-880d-da46b71a6180.vbs"
        17⤵
        
        PID:1460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\931f71a7-5b4d-44c8-8a7c-87be6af87fe3.vbs"
        15⤵
        
        PID:2596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\266572d1-ea26-47d8-9638-dd9cad256ade.vbs"
        13⤵
        
        PID:2316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1ae5a67-6ed2-4f67-aec7-b1bfecd0385c.vbs"
        11⤵
        
        PID:2564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0371ef3b-3356-4fec-8688-68a49ab3f25b.vbs"
        9⤵
        
        PID:2896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c122f7b1-9810-4d86-98f3-70dd274e0d1b.vbs"
        7⤵
        
        PID:1444
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02c80c81-1ae0-463d-a967-261a30b35321.vbs"
        5⤵
        
        PID:2296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81adae96-b0dd-401e-be4c-52495cd7dd49.vbs"
    3⤵
    PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0a550d8f-5704-45bc-b7c4-0fbe730140de.vbs

Filesize
731B

MD5
0c6840a1d12f0fcb8a6aac70012fc6cb

SHA1
d2a866b54307a44bbfedfbe44df3d8ec1794081d

SHA256
0e0cb7025fbdaa6a8ca90069a6bd7d0dca7dd82a0254bc5a220097b36ef6e75d

SHA512
055ef48e1cb00bbb9c240b978391f9132e5fe41d3eeee08f7da24f0f18071b1d3d0e20cc1d6ea4f277ebf694ab77e8b7d05234baf941f831b6008a6c6ad35bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eb2e551-e65e-4a98-a5f3-5601ecf980c5.vbs

Filesize
732B

MD5
9fd09d74f3ee0e4039abda5f95ebe204

SHA1
166405a7b6449c1f13b00b8f39125c05b0677b70

SHA256
2c7ca99527253ccc5e255dbb295b71517f739f2fe5ebd323bea51f75a8bd3c9e

SHA512
0aebda928b6728bfdd876673e6a1098fe36d497148738a044f8c050495edef15e49ea2b49dbf1a2f91177c6b206ae2bbd14220926cda1f93a006b50aeebbac60

Download Submit
C:\Users\Admin\AppData\Local\Temp\34c25aec-67a5-403c-bbf6-801d6a8a475b.vbs

Filesize
732B

MD5
c2146c6620aee9136f1066b221c30e4d

SHA1
1be54eb95999a09415b94e662acd009499b31d1e

SHA256
4062819458f3eccbafcd0726d7259676757fd426a62bc934fc03dde6e3c0feb9

SHA512
0107db4c31affe43acbff7405f365fb45a01b29d3724e57e674a999a969adf1107dd7719531dfa5ec3fcdf7e6eb8de31eb4bad7aaf0c9f109a6a21681675dadd

Download Submit
C:\Users\Admin\AppData\Local\Temp\367298e9-99b6-4344-8064-1dc2da558041.vbs

Filesize
731B

MD5
cca92bf1e6a51c6bd766e0f3b3eae593

SHA1
2e72c67616034c2b78472a5c98fac418738da4c7

SHA256
6256aef93bcec9a9d4c72635768c729f84950ce00c0dcc87aacb6a38f14e756a

SHA512
6f6af36271e8ac1794bf5058afcda3971c0942bd19a6f1e201111ecc80f6d029c6e66477a2193273bde8c3c0b7397b688d2e14e7e9cd3467139636f89b3b4f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ec886a6-9506-49e2-bbce-237da05bd169.vbs

Filesize
732B

MD5
eadc7aab02487a6ffe4841bcea2f6796

SHA1
4c0e037d383cb856b530ba21a5efdf904cfc07e4

SHA256
db5f90ad6ad71f7944e88a575161c80265aa35ac143af6d9f271108a7743bd54

SHA512
5c1f7efbb61888010bf628632259ed33bd26f9bbc2c76a0b6f213420d9b6f881fef25fe131d80e947c625d68001c6a2a860291e44d2a6b7917fd10fb08994a40

Download Submit
C:\Users\Admin\AppData\Local\Temp\81adae96-b0dd-401e-be4c-52495cd7dd49.vbs

Filesize
508B

MD5
f41baeef48426bf69be49991095498d4

SHA1
de4d1b166bcc75497b07639d09666fd085db5007

SHA256
60ba71a76b029d280ab72bdfdd5b43287c4cc38380b570ffa9383319d5359613

SHA512
1b7d3909c72a29fc587b977af889e4b1e32ec31cef57df7578c9201f22b69ab257aeae2d475a6f49aa5e89682f466234b10b8799fc8f1b524273c6056a74f9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8df2e02c-a48d-40d9-b1e9-be9c08cc834f.vbs

Filesize
732B

MD5
d4fcdc85688280fe2da8ecdc13ba23b9

SHA1
2f716a8c2bade0c2b7a2bc3f91099340eecb5476

SHA256
19285c5409d57ad331995b58c8409e683f4657b057eefac59a3b73509e108e72

SHA512
d7b5280fdf16df9179b4b2ce6d64b29a893af67a0fad1036b27d1976d68f2adc17ceca65e400af88d474ecbadec839861af3e94099d6070cc812e9f7c1745f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\97b6cf27-caf3-42c1-9553-33c4bef6cdde.vbs

Filesize
732B

MD5
9f67233b935d34bc604fd28860612862

SHA1
d6eb8678a39e2f13a614d5023030dec737df6f7f

SHA256
d4ac934e959a4d4e2c5236f401ab456ed247979e9e48b60c1627a6fda2f0cb41

SHA512
dd9ceb4e022e00ebfac3fecfff3853325c80525c9f89df03781256d236811279df9b15133642552a12f432bf92d1ee256e9d791e39fb28e06a744a8acb084180

Download Submit
C:\Users\Admin\AppData\Local\Temp\9bdae8b1-267e-4c01-acfa-c766a2ae8cb5.vbs

Filesize
731B

MD5
a5100d4d97b8e61b568a863d6964e496

SHA1
3f67ea0884352a2728b11bc75876551f8cc81456

SHA256
1ff66702259a68e352933362cad4fbed88a603f31e019376d00fc6b47296efe0

SHA512
5f5ee007a0cfb3c28f50ed3c35ee9717e094daefc497909af4a7ac5d7c9cb467a04dd096854c9b21a522e6b267251c8275987e647630302f1977f648a68457c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\a19a8a06-3b80-425c-befb-59af474038de.vbs

Filesize
732B

MD5
6ed506301d79a61b34c06c06db46ca7c

SHA1
56af1f9b55c515da7fc71c2cf4b1426c6a489651

SHA256
e543b467c19a951a45c4590da042fd487222c3205c2242cb1e0bdf7997bda935

SHA512
68c09369501b9c3d2b5e85fddc0c80c36633bbb033a04d1dafc110e4deb4b3952e81673ce7e1fe115090d4e738e52a9cdcd63a2af392c958c01206683d616b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\ef270543-6aff-4250-be73-903f950ef92f.vbs

Filesize
732B

MD5
37310577e1d6d8eb52f3aa6b04d6d827

SHA1
ff412570e855dc18be5a05b4b04cc45d7cffca41

SHA256
4d91a22fdac3e7b2e1fea8161d3dd447c6eec3d71ba75c2e18665e05225a363e

SHA512
669920e39bdff1d53baa2ee7ccf88bfcaf0d0a2e8f774980505da3d279976f0e5d9c228c82f33bee26d5269fafaa452935df7af02b0cbf5c9f76b5a2388b21f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5accfb1-90e1-4926-a1ac-3cf3899b259d.vbs

Filesize
732B

MD5
d8cf8a61b9867bf63c04cf69311cb22d

SHA1
96a63ae1fc934e5588831636d3be18b48e444d64

SHA256
80b88f1b2eb51a7fc39d0ff795cfcaa33faf114ddee40fabd80b88046757eb88

SHA512
84d310bc3e085af8352540de11848de9f6ca4662a5378806e69d1d925458a9e1e0ca614b713c5ae33c0d73616750280cd78a5d8697b2a5431416bb801fe85dd3

Download Submit
C:\Users\Admin\AppData\Local\discord\Network\audiodg.exe

Filesize
2.4MB

MD5
16be4b35fbc59aa471fff4ab77f53c5e

SHA1
5d31d96f0562309fc24294ecfdb3d2a26b238764

SHA256
d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

SHA512
29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45

Download Submit
memory/316-110-0x0000000000AA0000-0x0000000000AF6000-memory.dmp

Filesize
344KB

Download
memory/476-36-0x0000000002460000-0x00000000024B6000-memory.dmp

Filesize
344KB

Download
memory/476-35-0x0000000000030000-0x000000000029E000-memory.dmp

Filesize
2.4MB

Download
memory/824-48-0x0000000000BC0000-0x0000000000E2E000-memory.dmp

Filesize
2.4MB

Download
memory/824-49-0x0000000000740000-0x0000000000796000-memory.dmp

Filesize
344KB

Download
memory/1432-148-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/1432-147-0x0000000000A90000-0x0000000000AE6000-memory.dmp

Filesize
344KB

Download
memory/1432-146-0x0000000000AE0000-0x0000000000D4E000-memory.dmp

Filesize
2.4MB

Download
memory/1584-134-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/1584-133-0x0000000000220000-0x000000000048E000-memory.dmp

Filesize
2.4MB

Download
memory/1692-85-0x00000000012B0000-0x000000000151E000-memory.dmp

Filesize
2.4MB

Download
memory/1692-86-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/2340-73-0x0000000000010000-0x000000000027E000-memory.dmp

Filesize
2.4MB

Download
memory/2352-61-0x00000000003B0000-0x000000000061E000-memory.dmp

Filesize
2.4MB

Download
memory/2488-24-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/2488-21-0x0000000000300000-0x000000000056E000-memory.dmp

Filesize
2.4MB

Download
memory/2488-23-0x00000000005F0000-0x0000000000646000-memory.dmp

Filesize
344KB

Download
memory/2692-5-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/2692-0-0x000007FEF5983000-0x000007FEF5984000-memory.dmp

Filesize
4KB

Download
memory/2692-1-0x00000000000D0000-0x000000000033E000-memory.dmp

Filesize
2.4MB

Download
memory/2692-6-0x0000000002260000-0x00000000022B6000-memory.dmp

Filesize
344KB

Download
memory/2692-10-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2692-4-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download
memory/2692-3-0x0000000000990000-0x00000000009AC000-memory.dmp

Filesize
112KB

Download
memory/2692-7-0x00000000009E0000-0x00000000009F2000-memory.dmp

Filesize
72KB

Download
memory/2692-11-0x00000000023B0000-0x00000000023BC000-memory.dmp

Filesize
48KB

Download
memory/2692-2-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/2692-22-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/2692-8-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/2692-9-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/2916-98-0x000000001AD80000-0x000000001ADD6000-memory.dmp

Filesize
344KB

Download