Overview
overview
10Static
static
10DiscordBot...64.exe
windows7-x64
9DiscordBot...64.exe
windows10-2004-x64
9$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3DiscordBotClient.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...ags.js
windows7-x64
3resources/...ags.js
windows10-2004-x64
3resources/...eld.js
windows7-x64
3resources/...eld.js
windows10-2004-x64
3resources/...nts.js
windows7-x64
3resources/...nts.js
windows10-2004-x64
3resources/...hop.js
windows7-x64
3resources/...hop.js
windows10-2004-x64
3resources/...lds.js
windows7-x64
3resources/...lds.js
windows10-2004-x64
3resources/...nts.js
windows7-x64
3resources/...nts.js
windows10-2004-x64
3resources/...ata.js
windows7-x64
3resources/...ata.js
windows10-2004-x64
3resources/...oto.js
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 23:51
Behavioral task
behavioral1
Sample
DiscordBotClient-win-x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
DiscordBotClient-win-x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
DiscordBotClient.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app/AppAssets/ApplicationFlags.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app/AppAssets/ApplicationFlags.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app/AppAssets/Bitfield.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app/AppAssets/Bitfield.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app/AppAssets/Constants.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app/AppAssets/Constants.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app/AppAssets/DiscordShop.js
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app/AppAssets/DiscordShop.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/app/AppAssets/DiscoveryGuilds.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/app/AppAssets/DiscoveryGuilds.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
resources/app/AppAssets/Experiments.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
resources/app/AppAssets/Experiments.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/app/AppAssets/NitroData.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/app/AppAssets/NitroData.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
resources/app/AppAssets/SettingProto.js
Resource
win7-20241010-en
windows7-x64
General
-
Target
DiscordBotClient.exe
-
Size
177.7MB
-
MD5
de672272ecc20a5297d211f610bf89e9
-
SHA1
fd3ca25eb4703a3ccd48f7fa7dd6bbb3cd8863f5
-
SHA256
bdd2814e70c075ce41661cc6728bec2555fb2291269d32d5973e932231d25f17
-
SHA512
35e3c0dfa9351943574ca4d1177fd5f4f00f7aba79e9826191a072e8e65d55a16b06e2684e11a58e92c244ec0833c8e833eb832d2987bd10dc44760c4a51f1b4
-
SSDEEP
1572864:6exUbXH3qGPA3X2n04n0PgcCu5P3ds7Ical6BEu4ORlKIpDUs0u2hWozR9HLBwNf:ApjRCMx9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DiscordBotClient.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DiscordBotClient.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
flow ioc 19 raw.githubusercontent.com 23 discord.com 28 discord.com 29 discord.com 18 raw.githubusercontent.com 21 discord.com 22 discord.com 24 discord.com 27 discord.com 30 discord.com -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3756129449-3121373848-4276368241-1000\{FF04CA7E-5CBC-471B-B5EF-86D084F15EC0} DiscordBotClient.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3564 DiscordBotClient.exe 3564 DiscordBotClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe Token: SeShutdownPrivilege 3060 DiscordBotClient.exe Token: SeCreatePagefilePrivilege 3060 DiscordBotClient.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe 3060 DiscordBotClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 224 3060 DiscordBotClient.exe 83 PID 3060 wrote to memory of 2460 3060 DiscordBotClient.exe 84 PID 3060 wrote to memory of 2460 3060 DiscordBotClient.exe 84 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85 PID 3060 wrote to memory of 5012 3060 DiscordBotClient.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:22⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --field-trial-handle=2296,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:32⤵PID:2460
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --app-user-model-id=DiscordBotClient --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3248,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:12⤵
- Checks computer location settings
PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --ignore-certificate-errors --ignore-certificate-errors --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --field-trial-handle=2948,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:82⤵PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --field-trial-handle=4156,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:82⤵
- Modifies registry class
PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe"C:\Users\Admin\AppData\Local\Temp\DiscordBotClient.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Discord Bot Client" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3896,i,15703847703466629801,7345898183746154756,262144 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e8 0x3e01⤵PID:3552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432B
MD51c394fe7749054b82cfc091531133b57
SHA126975eeeb6c14dcc4c1a80fb5956e9fe60913ef3
SHA256ce4cab6e5018cb42ee8feb5cf64df518b16150b376e27916acd82a35beb76624
SHA5125cc175a933872733400716df4d63b004e774c51a53301da115872553999c9dd26ad61672ce29d7f0f6d4c30f4295470995e6e673177da62621041b352e59e57a
-
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\js\index-dir\the-real-index~RFe57fed2.TMP
Filesize48B
MD5a38ee8b6e1fe186d764870d18ee4edce
SHA1c9cc782a3303507adb4a28d7ef6ee80bcd83a9a4
SHA256b0a29a1ef93595a4cc74b475cf78aaf124298af3c44b6d89119ad3929d1d718f
SHA512fa3d53e2631371c9d413c44e5929e4e4bf41f106b05008ab151328d0e0b7ab22efb63e2df6c95895598f4a09c324ac3950db8aa364fae8b7b243d2d933ad290e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
33B
MD57f4b6cba2c41723f372e8c3e0482b1dc
SHA10ce18f6449e770ffd4312de4e6e0b104676596bf
SHA256fc5ef82cc4b82501f0ed62204612860597aa91f3d79cc06e28349267a67760d8
SHA51258c911b737c23e35d54f78bb23218473e1d70191d3e22fda2def15088e92dbdf59d5e32311eab8007d65ce7c7f511a845044dc215dd804767e5d32f8880a333e
-
Filesize
49B
MD55ec339f9aeb94f39a0411f49e321ec0f
SHA133f083b189782c901029ab4639235a437a1fde1c
SHA25659afe04fd727b9db365d3ce837486c4adb89bb15819e31f5b758d154ccd0b064
SHA51220ff2dc9f30dee81aa0ab8177ee461746eb109e9d4eb42b6278c6e06153ec94825e6f12b7e0cb614fbfc20519d77583014d08793e0555373da3aa9cef0b34703
-
Filesize
81B
MD5386a53b119c42527aef2e3b29ed062a8
SHA1438bfc840d8f613ae6eecd5c1cbf2b57eeb19e15
SHA2562eceb99a44ad80e56fb3b738e9ffa768449bc60803bb190053f1545c0f3f39ed
SHA512fbb5ff29a73854a4d5c623785bd3590e30edf93f661ee37332b7aba566e6c43215af45efe4de1bfb9c75df8a0a028e131b0545badd83a87f83ddfc976751f1b6
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84