Overview
overview
10Static
static
1DiscordGen...in.zip
windows11-21h2-x64
1DiscordGen...in.zip
macos-10.15-amd64
1DiscordGen...ICENSE
windows11-21h2-x64
1DiscordGen...ICENSE
macos-10.15-amd64
4DiscordGen...DME.md
windows11-21h2-x64
3DiscordGen...DME.md
macos-10.15-amd64
1DiscordGen...log.md
windows11-21h2-x64
3DiscordGen...log.md
macos-10.15-amd64
1DiscordGen...ing.md
windows11-21h2-x64
3DiscordGen...ing.md
macos-10.15-amd64
10DiscordGen...ain.py
windows11-21h2-x64
10DiscordGen...ain.py
macos-10.15-amd64
4DiscordGen...ord.py
windows11-21h2-x64
3DiscordGen...ord.py
macos-10.15-amd64
4DiscordGen...ail.py
windows11-21h2-x64
3DiscordGen...ail.py
macos-10.15-amd64
1DiscordGen...ts.txt
windows11-21h2-x64
3DiscordGen...ts.txt
macos-10.15-amd64
1Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system - submitted
20/04/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
DiscordGenerator-main.zip
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
DiscordGenerator-main.zip
Resource
macos-20240410-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DiscordGenerator-main/LICENSE
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
DiscordGenerator-main/LICENSE
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
DiscordGenerator-main/README.md
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
DiscordGenerator-main/README.md
Resource
macos-20240410-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
DiscordGenerator-main/changelog.md
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
DiscordGenerator-main/changelog.md
Resource
macos-20240410-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
DiscordGenerator-main/contributing.md
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
DiscordGenerator-main/contributing.md
Resource
macos-20240410-en
macos-10.15-amd64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
DiscordGenerator-main/main.py
Resource
win11-20240412-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
DiscordGenerator-main/main.py
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
DiscordGenerator-main/modules/discord.py
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
DiscordGenerator-main/modules/discord.py
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
DiscordGenerator-main/modules/tempmail.py
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
DiscordGenerator-main/modules/tempmail.py
Resource
macos-20240410-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
DiscordGenerator-main/requirements.txt
Resource
win11-20240412-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
DiscordGenerator-main/requirements.txt
Resource
macos-20240410-en
macos-10.15-amd64
0 signatures
150 seconds
General
- Target DiscordGenerator-main/main.py
- Size 15KB
- Sample240420-wc5d4aed41
- SHA256 29fa18797410f68867ff6a9ded9d1c0f0a47c8c61402af515120f6864a6963e9
- MD5 a494c6689a76fff770a2b4d94bdcce46
- SHA1 624bcb27485e8da97462c68b045c17be6e268b8e
- SHA512 4cb8fe599d0c4c2203aa7b17ce8283b195959cc3c435ca508b3a04791dcf0b02e093cadf9154a2100cabe77a8eefb51f40f9912a6df7f9bd221eb46abd159813
- SSDEEP 192:zKJ//l14uBbgLTZDY/JT/tHABGfcg5Ts7djvrw7AwvsZEKdTbW1ggfgBEresyG4C:uJT4+gLNYx+BrgR+M7KZbOh9resP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detected phishing page
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 wtfismyip.com 25 wtfismyip.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133581089892553887" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2336 chrome.exe 2336 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: 33 4092 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4092 AUDIODG.EXE Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4964 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2020 2336 chrome.exe 86 PID 2336 wrote to memory of 2020 2336 chrome.exe 86 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 3596 2336 chrome.exe 87 PID 2336 wrote to memory of 2352 2336 chrome.exe 88 PID 2336 wrote to memory of 2352 2336 chrome.exe 88 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89 PID 2336 wrote to memory of 948 2336 chrome.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DiscordGenerator-main\main.py1⤵
- Modifies registry class
PID:2940
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9c909ab58,0x7ff9c909ab68,0x7ff9c909ab782⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:22⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:12⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3852 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:12⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4132 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1636 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4472 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4688 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2828
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff69738ae48,0x7ff69738ae58,0x7ff69738ae683⤵PID:2680
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4888 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:12⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4456 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 --field-trial-handle=1860,i,15081500044776905766,11459059458801093939,131072 /prefetch:82⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1440
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\40e184ea-1382-46c2-9fe0-970439002f5a.tmp
- Size 7KB
- SHA256 32edf0dbae6f777c4f59a78790f0a4c468c6c0efaaa0619c8b501193138cf809
- MD5 4bf675eee7763df19dd42ff49d36fa7c
- SHA1 16552f4bf51f0bf302de73de74e65896675a8ca7
- SHA512 7c7b3354a915fff748471d5e710272b77594030a69aa9e340e37586860191dbd9b6af8443486eb29c0693d911cc6e57c5fdf6d0378dbaead93246ccf9317fc6b
- SSDEEP 192:CGXcxhs7WaJSZ8syh+F1G0O8nEP5tjEsXtScR:CGXczKKyqjO8n8tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 c56084eaa6e09e24435a77322b5367fd4b0972c81967b4e5538dfd9864fbae26
- MD5 4d63b4be0b6252a901ac269c29eb4e00
- SHA1 5550ea1369a741a94a44130ef3c479d1491ac6b1
- SHA512 1c0efdde175ca9818b8fac6cd81506516ebf13f4747241df52feb00a99a684616c7ad2c1a8a00299a024ebed75d2266c700d925ef75acb63ae859c60a652673f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 181c76f17c843014dc386ac5c985ce161f3dcce763c5dfdb2db9c52c511c6358
- MD5 a7c7db2fa2f409369be75bb8e2d91b6a
- SHA1 6a5c65fb0cd58f1959556cc37bc181af83cdac6c
- SHA512 56e60a5c3335a3f061e14208d1e4080deb078f71fcedeb09310cb2264d8d65e73d58dfd6f823bfffee75f0ed36e636e77c60d38bde51a76da96d1609a23b40fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 b3cd52767c463af5664f5f9f4065e5fd3ab131d1fb4b5bc2d991761b4b9323be
- MD5 66ecf10c8d150a9aad36667fa0da728e
- SHA1 1482e730cb13eacfda9d0e3e30bbe45c2ecc291b
- SHA512 a9df87bef8cf2f8956f9c96c0188bdd40ac3a674f058ad56c3ef1e54ecb15bb14c4b0d9aefa62eb389837c36eae6edccd76971933be93c8542fdbbd73dcb26ae
- SSDEEP 192:CGXcxhs7WaJSZ8syh+F1Gc48nEP5tjEsXtScR:CGXczKKyqX48n8tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 fd1d5bc43838e1991d6f7aaf72e90bb114512a80b996800e46b8373f539a664d
- MD5 1dc7a1dbe90b222efd712f0758e14026
- SHA1 1bdb7eea78d24a7032cd98d83ebba3dfc1c084d1
- SHA512 15235606e34211272a310f97d24fdf3c438bda6b2924d55d851899edf545b3c7acd7f52979379201b3cb97672fe63f0b94356ecf566347e0a30593e8f0d82f4b
- SSDEEP 192:CGXcxhs7WaJSZ8syh+F10qdnEP5tjEsXtScR:CGXczKKyqbdn8tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 5192055601a1752d2e34325c2195efedd7fbf26cb70bc1b20b5589e24551286e
- MD5 b5e4a2c12615f6d382bbd0e36a5b303c
- SHA1 92c7564f39c20b7a31ea0c3dd81739d63a7732be
- SHA512 f20a5a189943cf72229bb66a94d691f35515a6c265b1de793d3e2271928c969072a837aaa82389f266a3e42b26aa596b49d24e38f00626b57be104ac6d3838e2
- SSDEEP 384:B1N6LPLeEcXo41kXqKf/pUZNCgVLH2Hf9JsrUMvHG/JU7a:Bj6LPL1Oo41kXqKf/pUZNCgVLH2Hfvs+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 fdac1b695b756cee7ae41d3d8810bce65183a70853ec748bb37bed84ec0529e8
- MD5 2fb2ab3bc59044a97cc4cf5a652e84a6
- SHA1 84dfd60a2043aae015cbfc4b5d18b68da1599b1a
- SHA512 c9f41412ecd9ae68d7553817479e75261d7f0026fef6fb1964b46f083f81d3877e754f62325298545aa7fbee94c37cea2892a8edf5c858cd68f6fc5109749ea7
- SSDEEP 3072:w9x3mgzxLR8t35zIV4nZqBixhjVtEWC1Yr3MaK2EWE07mOw:w978RbxBVtEPY4aI1Ow
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 254KB
- SHA256 15bb77c8cda4cdcd41a37df9a288d40c273a1d2a09bd7da700ed6e386b0534fb
- MD5 bd766412f497246be5deb94eb186824a
- SHA1 55003e9bf8ad2ec8561a70d6d85784bd6afb4091
- SHA512 bd48df1cf712b1dafd1bc432030ac3c51b7bc3da4fe0b11ac3bc7f2325a1d1a1c3f4022f1cfcff14956b6f92f787aaa4ecaf08c292518835708b106f6a29b7d6
- SSDEEP 6144:f/TYLW30xFT+LOH5HIkNe+H78RbxBVtEPY4aI1OU:fuW3GRI0NH78fBfpAOU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 87KB
- SHA256 3c3861c8bbe09a39efbb8bfb6ab1a665ae57671fab45f1d459d654126d00a1a6
- MD5 a598404450b2a546f30a27050d5d4948
- SHA1 3f2a37e33d133a087516c5d23bee263cd56e150b
- SHA512 85d41e6e9b06b83f3fa76cb48ad5511e89bc545b86658e6ece3ff310879a8545136372ff252d104345332aa41dfe7d4078833464bcd6f3640be74faadc98d5d6
- SSDEEP 384:EZnwpxEQkd/gOieF3zDgfxHO08J0o6E1o8rgLo04k3/nFxMV1LqeTvLggoCNNdg2:ESiQJpyA3MRZFj+lKWx4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59622b.TMP
- Size 84KB
- SHA256 aa1d8c8d36fc8d7d9f79e9b2478f9b676bad6d0412c87d6a53a8424643592809
- MD5 79a5acf1d2feb6bbbeac0feb8c242d1c
- SHA1 87edc8f93495e46e35e9f77f9a3b622648189bd1
- SHA512 512a37ea988ac750883854f914e03426d37ab2d5b4ea1543bf3fd67df82069a55e30e8f91f994af0dfd5f5315368986f9e2870db20af28655be5c9346e036eee
- SSDEEP 384:2nwpxEQkd/gOieF3zDgfxHO08J0o6E1o87Lo04k3/nFxMV1Lqe5LggoCNNdgzBqa:BiQJpyAUGRZFj+lKWxT
- MD5 SHA1 SHA512 SSDEEP