2aa6a3e610004ea1d6124e1a23f64ebba4baeaa26d88508e01c8ddd48de35a0b

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord.exe
Size 5.7MB
Sample260809-bvxrragc23
SHA256 2aa6a3e610004ea1d6124e1a23f64ebba4baeaa26d88508e01c8ddd48de35a0b
MD5 ea7e734e8c5df32c3ba7959ecb794e92
SHA1 c57ea7e007bf39b29b0ee34c8d5c37b8ad2e1c81
SHA512 091450b6210eba7a4caf0e2f5e2b83ef786eca6e0356bacf098027eb07e6821b3d82f966ec8e09cba065b990df04bcb58f5489ae3f602e833765081059bd7e81
SSDEEP 98304:rYnbyxBrt+FXG5rG+tLww1vy+fKv3OYNiUs/auSGQNDhhwl/TYIcKsFKmrqbJ:Mn+/rt+FXG4+OwRKOYNiUyauSGQFrwlL
TLSH
T1125622C833DC3B09E2BEDF7C68B150848E71BD52DA61D74D5A8571D81A72B839A21F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 57 IoCs

pid	Process
4604	Discord.exe
2052	Update_8678c8.exe
2548	SpotifyWebHelper_8678c8.exe
4668	SpotifyWebHelper_8678c8.exe
3600	Updater_8678c8.exe
1096	Updater_8678c8.exe
4688	Updater_8678c8.exe
5064	OneDriveStandaloneUpdater_8678c8.exe
1848	OneDriveStandaloneUpdater_8678c8.exe
1912	OneDriveStandaloneUpdater_8678c8.exe
2856	OneDriveStandaloneUpdater_8678c8.exe
3964	chrome_proxy_8678c8.exe
632	chrome_proxy_8678c8.exe
3300	chrome_proxy_8678c8.exe
856	chrome_proxy_8678c8.exe
692	MicrosoftEdgeUpdate_8678c8.exe
3192	chrome_proxy_8678c8.exe
4188	MicrosoftEdgeUpdate_8678c8.exe
4604	SteamService_8678c8.exe
1792	MicrosoftEdgeUpdate_8678c8.exe
4876	MicrosoftEdgeUpdate_8678c8.exe
3920	MicrosoftEdgeUpdate_8678c8.exe
4152	MicrosoftEdgeUpdate_8678c8.exe
2892	SteamService_8678c8.exe
3152	SteamService_8678c8.exe
4828	SteamService_8678c8.exe
3928	DropboxUpdate_8678c8.exe
3716	SteamService_8678c8.exe
1472	SteamService_8678c8.exe
452	DropboxUpdate_8678c8.exe
4140	NVIDIA Web Helper_8678c8.exe
4988	DropboxUpdate_8678c8.exe
3032	DropboxUpdate_8678c8.exe
5112	SteamService_8678c8.exe
1580	AdobeGCInvoker_8678c8.exe
3408	DropboxUpdate_8678c8.exe
212	DropboxUpdate_8678c8.exe
216	NVIDIA Web Helper_8678c8.exe
368	NVIDIA Web Helper_8678c8.exe
4372	NVIDIA Web Helper_8678c8.exe
2756	DropboxUpdate_8678c8.exe
808	DropboxUpdate_8678c8.exe
2652	NVIDIA Web Helper_8678c8.exe
1320	NVIDIA Web Helper_8678c8.exe
992	AdobeGCInvoker_8678c8.exe
5000	AdobeGCInvoker_8678c8.exe
1748	AdobeGCInvoker_8678c8.exe
3424	NVIDIA Web Helper_8678c8.exe
3924	NVIDIA Web Helper_8678c8.exe
2852	AdobeGCInvoker_8678c8.exe
1928	AdobeGCInvoker_8678c8.exe
2500	AdobeGCInvoker_8678c8.exe
1040	AdobeGCInvoker_8678c8.exe
3800	DropboxUpdate_8678c8.exe
1664	AdobeGCInvoker_8678c8.exe
4668	AdobeGCInvoker_8678c8.exe
380	Update_8678c8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate_8678c8 = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\du_8678c8aeea08\\Discord.exe\""	Discord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateCore8678c8 = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update_8678c8.exe\""	Discord.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1020	schtasks.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1020	4388	Discord.exe	84
PID 4388 wrote to memory of 2052	4388	Discord.exe	89
PID 4388 wrote to memory of 2548	4388	Discord.exe	90
PID 2052 wrote to memory of 4668	2052	Update_8678c8.exe	144
PID 2548 wrote to memory of 3600	2548	SpotifyWebHelper_8678c8.exe	92
PID 4388 wrote to memory of 1096	4388	Discord.exe	93
PID 2052 wrote to memory of 4688	2052	Update_8678c8.exe	94
PID 3600 wrote to memory of 5064	3600	Updater_8678c8.exe	95
PID 2052 wrote to memory of 1848	2052	Update_8678c8.exe	96
PID 4388 wrote to memory of 1912	4388	Discord.exe	97
PID 2548 wrote to memory of 2856	2548	SpotifyWebHelper_8678c8.exe	98
PID 3600 wrote to memory of 3964	3600	Updater_8678c8.exe	99
PID 2548 wrote to memory of 632	2548	SpotifyWebHelper_8678c8.exe	100
PID 4388 wrote to memory of 3300	4388	Discord.exe	101
PID 2052 wrote to memory of 856	2052	Update_8678c8.exe	102
PID 3600 wrote to memory of 692	3600	Updater_8678c8.exe	103
PID 5064 wrote to memory of 3192	5064	OneDriveStandaloneUpdater_8678c8.exe	147
PID 3964 wrote to memory of 4188	3964	chrome_proxy_8678c8.exe	105
PID 3600 wrote to memory of 4604	3600	Updater_8678c8.exe	106
PID 2052 wrote to memory of 1792	2052	Update_8678c8.exe	107
PID 4388 wrote to memory of 4876	4388	Discord.exe	108
PID 2548 wrote to memory of 3920	2548	SpotifyWebHelper_8678c8.exe	109
PID 5064 wrote to memory of 4152	5064	OneDriveStandaloneUpdater_8678c8.exe	110
PID 3964 wrote to memory of 2892	3964	chrome_proxy_8678c8.exe	112
PID 4388 wrote to memory of 3152	4388	Discord.exe	113
PID 2052 wrote to memory of 4828	2052	Update_8678c8.exe	114
PID 3600 wrote to memory of 3928	3600	Updater_8678c8.exe	115
PID 5064 wrote to memory of 3716	5064	OneDriveStandaloneUpdater_8678c8.exe	116
PID 2548 wrote to memory of 1472	2548	SpotifyWebHelper_8678c8.exe	117
PID 3964 wrote to memory of 452	3964	chrome_proxy_8678c8.exe	118
PID 2052 wrote to memory of 4988	2052	Update_8678c8.exe	120
PID 4388 wrote to memory of 3032	4388	Discord.exe	121
PID 3600 wrote to memory of 4140	3600	Updater_8678c8.exe	119
PID 4188 wrote to memory of 5112	4188	MicrosoftEdgeUpdate_8678c8.exe	122
PID 3600 wrote to memory of 1580	3600	Updater_8678c8.exe	123
PID 5064 wrote to memory of 3408	5064	OneDriveStandaloneUpdater_8678c8.exe	124
PID 2548 wrote to memory of 212	2548	SpotifyWebHelper_8678c8.exe	125
PID 4388 wrote to memory of 216	4388	Discord.exe	126
PID 2052 wrote to memory of 368	2052	Update_8678c8.exe	127
PID 3964 wrote to memory of 4372	3964	chrome_proxy_8678c8.exe	128
PID 4604 wrote to memory of 2756	4604	SteamService_8678c8.exe	129
PID 4188 wrote to memory of 808	4188	MicrosoftEdgeUpdate_8678c8.exe	130
PID 4188 wrote to memory of 2652	4188	MicrosoftEdgeUpdate_8678c8.exe	131
PID 4604 wrote to memory of 1320	4604	SteamService_8678c8.exe	132
PID 3964 wrote to memory of 992	3964	chrome_proxy_8678c8.exe	133
PID 2052 wrote to memory of 5000	2052	Update_8678c8.exe	134
PID 4388 wrote to memory of 1748	4388	Discord.exe	135
PID 2548 wrote to memory of 3424	2548	SpotifyWebHelper_8678c8.exe	136
PID 5064 wrote to memory of 3924	5064	OneDriveStandaloneUpdater_8678c8.exe	137
PID 2548 wrote to memory of 2852	2548	SpotifyWebHelper_8678c8.exe	138
PID 4604 wrote to memory of 1928	4604	SteamService_8678c8.exe	139
PID 4188 wrote to memory of 2500	4188	MicrosoftEdgeUpdate_8678c8.exe	140
PID 5064 wrote to memory of 1040	5064	OneDriveStandaloneUpdater_8678c8.exe	141
PID 4140 wrote to memory of 3800	4140	NVIDIA Web Helper_8678c8.exe	142
PID 3928 wrote to memory of 1664	3928	DropboxUpdate_8678c8.exe	143
PID 4140 wrote to memory of 4668	4140	NVIDIA Web Helper_8678c8.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Discord.exe
"C:\Users\Admin\AppData\Local\Temp\Discord.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Discord_8678c8" /tr "'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe'" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1020
- C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe
  "C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe
    "C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:4668
- - C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe
    "C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:4688
- - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:1848
- - C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:856
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
    "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:4828
- - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
    "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:4988
- - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
    "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:368
- - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
    "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:5000
- C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe
  "C:\Users\Admin\AppData\Local\Spotify\SpotifyWebHelper_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe
    "C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:3716
    - - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:3924
    - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe
      "C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
        6⤵
        Executes dropped EXE
        
        PID:5112
      - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
        6⤵
        Executes dropped EXE
        
        PID:808
      - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
        6⤵
        Executes dropped EXE
        
        PID:2652
      - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        6⤵
        Executes dropped EXE
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:2892
    - - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:452
    - - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:4372
    - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:992
  - - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
      "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      PID:692
  - - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
      "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:1320
    - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:1928
  - - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
      "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:1664
  - - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
      "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
        
        "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:3800
    - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
        
        "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
        5⤵
        Executes dropped EXE
        
        PID:4668
  - - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
      "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
      4⤵
      Executes dropped EXE
      PID:1580
- - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:632
- - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
    "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:3920
- - C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
    "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:1472
- - C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
    "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:212
- - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
    "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:3424
- - C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
    "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
    3⤵
    - Executes dropped EXE
    PID:2852
- C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe
  "C:\Users\Admin\AppData\Local\Telegram Desktop\Updater_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\OneDriveStandaloneUpdater_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome_proxy_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe
  "C:\Users\Admin\AppData\Local\Steam\bin\SteamService_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe
  "C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxUpdate_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NvBackend\NVIDIA Web Helper_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:216
- C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe
  "C:\ProgramData\Adobe\ARM\AdobeGCClient\AdobeGCInvoker_8678c8.exe" --smart-watch
  2⤵
  - Executes dropped EXE
  PID:1748

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\du_8678c8aeea08\Discord.exe"
1⤵
- Executes dropped EXE
PID:4604

C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe
"C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe"
1⤵
- Executes dropped EXE
PID:380

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv iXs4J+fndkyB4nK4nT5rGA.0.2
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXB11D.tmp

Path C:\Users\Admin\AppData\Local\Discord\RCXB11D.tmp
Size 5.4MB
SHA256 256628c915d7f7303213b603d55564927b1fcbffb7091b822d3d21815d594b18
MD5 9a51eac0121ce5aabbe900406c3afaad
SHA1 c4730842d9cd2f9742b3f914733879c5e101bac6
SHA512 520db73bc436eaec86bef86b6c022df79e8ace35d4a17f2240437364c1fff5a11429c422bad2601e9bec0e98c2499682cff6c7a2d14c6f43d11af14cc496fff0
SSDEEP 98304:/YnbyxBrt+FXG5rG+tLww1vy+fKv3OYNiUs/auSGQNDhhwl/TYIcKsFKmrqbJ6:An+/rt+FXG4+OwRKOYNiUyauSGQFrwlM
TLSH
T1C046238873DC0A09F1FF9B7868B120948271F993DAA1D75D5DC561ED2A71B80EE21B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update_8678c8.exe.~si

Path C:\Users\Admin\AppData\Local\Discord\Update_8678c8.exe.~si
Size 5.7MB
SHA256 2aa6a3e610004ea1d6124e1a23f64ebba4baeaa26d88508e01c8ddd48de35a0b
MD5 ea7e734e8c5df32c3ba7959ecb794e92
SHA1 c57ea7e007bf39b29b0ee34c8d5c37b8ad2e1c81
SHA512 091450b6210eba7a4caf0e2f5e2b83ef786eca6e0356bacf098027eb07e6821b3d82f966ec8e09cba065b990df04bcb58f5489ae3f602e833765081059bd7e81
SSDEEP 98304:rYnbyxBrt+FXG5rG+tLww1vy+fKv3OYNiUs/auSGQNDhhwl/TYIcKsFKmrqbJ:Mn+/rt+FXG4+OwRKOYNiUyauSGQFrwlL
TLSH
T1125622C833DC3B09E2BEDF7C68B150848E71BD52DA61D74D5A8571D81A72B839A21F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater_8678c8.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Updater_8678c8.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

smart_8678c8aeea08.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\smart_8678c8aeea08.dat
Size 717B
SHA256 fd0d25e28a537dc3f78a35df5bb3f39b57fbdc290ce66c1459149b1424675eb9
MD5 4c22958f976c4e0115a10b232c4becf4
SHA1 1e5363f108be875df38888111ecf7e53de17c089
SHA512 7d1b8bfe2b73b59c96c8e7905d518de0cbac3940c0d8c73fd3444731940c320a73c7b5b0d9b36812d2d921d437e9e0f2d146a011fb9174d2a6d1ec95e7868f32
TLSH
T167014F2090C6CA3E55A570AF16B2F6D8C4B68845AF993B46C3549C0D12CE9CCFACA5CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-343-0x0000025B54E70000-0x0000025B553E0000-memory.dmp

Download

memory/4388-1-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-3-0x000001FAA8040000-0x000001FAA8072000-memory.dmp

Download

memory/4388-475-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-36-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-76-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-255-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-253-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-4-0x000001FAA7EA0000-0x000001FAA7EBA000-memory.dmp

Download

memory/4388-2-0x000001FAA7ED0000-0x000001FAA7F1E000-memory.dmp

Download

memory/4388-0-0x000001FAA5C90000-0x000001FAA6246000-memory.dmp

Download

memory/4388-355-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4388-426-0x000001FAA8070000-0x000001FAA80A4000-memory.dmp

Download

memory/4388-425-0x000001FAA67F0000-0x000001FAA6804000-memory.dmp

Download

memory/4388-424-0x000001FAC1720000-0x000001FAC1796000-memory.dmp

Download

memory/4388-423-0x000001FAC15F0000-0x000001FAC16A2000-memory.dmp

Download

memory/4388-433-0x000001FAA65E0000-0x000001FAA65F0000-memory.dmp

Download

memory/4604-37-0x000001ABDBA70000-0x000001ABDBA80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads