Analysis
- max time kernel
97s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 23:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/NekzofIsBack/TokenDiscordGenerator
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://github.com/NekzofIsBack/TokenDiscordGenerator
Resource
win10v2004-20231215-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target https://github.com/NekzofIsBack/TokenDiscordGenerator
- Sample240205-3lc5jaagc3
Score
10/10
Malware Config
Extracted
Family
-
mercurialgrabber
C2
-
https://discord.com/api/webhooks/896767677144658010/lRZUcnLYRv9m2glfE9ebIeKijtD_3vR810SJne_xG-If7c2TUZQlOv_xUrc9SbTPfazj
Signatures
- Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions gen+checkTokenDiscord.exe - Downloads MZ/PE file
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools gen+checkTokenDiscord.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gen+checkTokenDiscord.exe - Executes dropped EXE 4 IoCs
pid Process 1276 gen+checkTokenDiscord.exe 3536 gen+checkTokenDiscord.exe 4892 gen+checkTokenDiscord.exe 1744 gen+checkTokenDiscord.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 94 discord.com 99 discord.com 101 discord.com 102 discord.com 109 discord.com 79 raw.githubusercontent.com 80 raw.githubusercontent.com 95 discord.com 105 discord.com - Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 107 ip4.seeip.org 89 ip4.seeip.org 90 ip4.seeip.org 91 ip4.seeip.org 92 ip-api.com 103 ip4.seeip.org 106 ip4.seeip.org - Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 gen+checkTokenDiscord.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S gen+checkTokenDiscord.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString gen+checkTokenDiscord.exe - Enumerates system info in registry 2 TTPs 15 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName gen+checkTokenDiscord.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 gen+checkTokenDiscord.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation gen+checkTokenDiscord.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 gen+checkTokenDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 gen+checkTokenDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 gen+checkTokenDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 gen+checkTokenDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 gen+checkTokenDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 gen+checkTokenDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 gen+checkTokenDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 gen+checkTokenDiscord.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 464330.crdownload:SmartScreen msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4680 msedge.exe 4680 msedge.exe 348 msedge.exe 348 msedge.exe 4560 identity_helper.exe 4560 identity_helper.exe 4920 msedge.exe 4920 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3536 gen+checkTokenDiscord.exe Token: SeDebugPrivilege 1276 gen+checkTokenDiscord.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 1332 348 msedge.exe 84 PID 348 wrote to memory of 1332 348 msedge.exe 84 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 468 348 msedge.exe 85 PID 348 wrote to memory of 4680 348 msedge.exe 86 PID 348 wrote to memory of 4680 348 msedge.exe 86 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87 PID 348 wrote to memory of 4332 348 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NekzofIsBack/TokenDiscordGenerator1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc290e46f8,0x7ffc290e4708,0x7ffc290e47182⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:82⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:12⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:12⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4828 /prefetch:82⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4908 /prefetch:82⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,11506845116878795450,17947119352033350558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:4892
-
-
C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"2⤵
- Executes dropped EXE
PID:1744
-
-
C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"C:\Users\Admin\Downloads\gen+checkTokenDiscord.exe"2⤵PID:4128
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
- MD5 efc9c7501d0a6db520763baad1e05ce8
- SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
- SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 131d22fde653bd0b42e14e530250831cf5d86a689bef3779156d99a8e426a5bf
- MD5 1e39212a0c4ff8626496a0dad0eb17a9
- SHA1 9fd1afebf6789fe4380f69ba5cadfd2dcdf6521f
- SHA512 e546af279cc4d7237278117d5fbd301e936a534480ed8c6af341cb7ea055f67898f354c6a7d85543815a08983b322c09accfe03f89ff5b74219ad826610957e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 ebc9340382e63c855c0c44ae98c5cb056a55bc19820d6ae2c8f2cccf1b4498d1
- MD5 81e9897337674a27d1d10ac8e57426ce
- SHA1 5d169843a8314f96f5433d81203a9fd139eb2200
- SHA512 1901fd1f2287e313f96fc403d2bc3ea95e3dc222d1d9368f31b5fd8d5b61254b27ca38f21e0a61aa81370411508bd12e628438668d8ca89f9e5588d699bd840f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 579B
- SHA256 63323b56c49b79c0cc4e1d4860f2121f462a4813f256a028c777604470013209
- MD5 8bbf66ae9ec386af4152e640d99ee79f
- SHA1 6eed11e2861ec6509f508ae7197d0338897fb869
- SHA512 fa2ca0c0a7a8f8d3396001a6e23113ed50d54ae83af55b5b0f4db40fee7d04590eb316f315eadc08677fcb6a731d9b662d1bff18faea70a66f566a1136792ecb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 918839c61c585ac3e2a9cfbfb5b9c8cbf3120d27528db6d9b5c288ee78d70fb8
- MD5 94b0f0154542cc4d6856acb37a1c084f
- SHA1 a0e5085e0d01975c6cfbf6677ffb8e3ad8a2fbbe
- SHA512 0d016c281d0095fcc2d10572822a4c6057e6cd45b254304f3ccb3ef1fe34f248b5a5496b7a62c878424be748890a8c9aed07d0626eb26cbd8f836b8347a1932e
- SSDEEP 96:ngkAI1uKTlwpvWMoiVmdeHc3TUWQyV+VDCzia:ngkhDTlGWMXATrj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 33cc42e1070ef10ae7cc6b5ba2388bd47d4e2d6a8a27efbfac8254466b5f805e
- MD5 852468ee11e5b942402b46d1e360c2d7
- SHA1 8ade5aa92f3a908de5b6c319e47d7ccfa5c6838e
- SHA512 9f93f996abaf0792f9cc287138f204b15846b4c9292449dbbbe79cfed1be7e1bcdeca36d057fc1631b34de5811aa8d22b23c52587c907316da78b99421477597
- SSDEEP 96:nqkrI1uKjlwpvWMoiVmdesud1jcLCTUWQyV+VD7AiEwb:nqkkDjlGWM8udhTTrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ca9790fbec69202ea03cd073133f9f6699061c6b507d8e27eb3b6a2d497d37f3
- MD5 3a14ac14a05c9c5e17eb828172d821c6
- SHA1 928a9108d677d4d176d3f088b6c9d79cd52726b6
- SHA512 665c0396966fd8b3ad3b01caf1b59b1db9353d6053a644e37268bda32fee895f23e759298154cab47dda51844df46271d5b5ad17dc0a85f091fbb0c326b01c69
- SSDEEP 96:nqk8sQNI1uajlwpvWMoiVmdecwsjNcbCTUWQyV+VD7AiEwb:nqkxfjlGWMswspfTrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 24KB
- SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
- MD5 121510c1483c9de9fdb590c20526ec0a
- SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
- SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
- SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 1KB
- SHA256 52c734e6573a77f61d573f41e32f9dd7934cf1014d551569ce6bead20acb8ad9
- MD5 72cbad47842f06e59e3f330430b5ed34
- SHA1 d85d92240f53b70987d235e1e5eb7320a076e3a5
- SHA512 56383341f8fe89acd7edc2e3822b40bb4e926a08ed955233d597564eccda44dd5b9f4ee2e5e366ad6bfa43b9f2e3dc0e1f532281dc92064cd4be98574e7e4a2a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a023.TMP
- Size 707B
- SHA256 950c5b44245162e37ce0a4ca11baa1914d4f30acc39892bfca8c6cf6d82c8b62
- MD5 b1c90d9c8bbf7b8e939102745556980a
- SHA1 e19b43ab5041a2fc8e87f004819f698401f0f68a
- SHA512 ea161185ef4c1a4c802c01744a485c5d62f8a006f41740479e9cf68eec0f467ae146b77285cd796d9f4d40cb7786399db48f65c8600b704c4ff778ec13fa7bc6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 8cb1075817364e3bddfc175cdddb763d2875fa7ce06ded9cf9124b44bac98d6b
- MD5 b2916d409f27e8c363790c3e7fbc6e16
- SHA1 1b2b46f6e1e73253dd130659374c4d3e0d35139a
- SHA512 530a9c08d9667934e424ffe871e81662ed65210e4eed2fe0ed65117012c93d4babb94386920062929efe182aae376c312b792379b58d42ad4915838f63b3c098
- SSDEEP 192:poCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+tzOe2RUX/Q7Vt+HpZbHNI:V9iIxuERzA83h09RZxY+62YkpdQ86W2L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 314e1e9815b1e9ee049d408d42dad96e7024ce9dddb5b55f59468ca161fcaec2
- MD5 4ad90c2c8629a94b2135e0c9d7ad3d19
- SHA1 ea7677bd26e530bb9b04b50255ab406e6277fed4
- SHA512 89286525bec2caca5d2947e8ff45665b94f85646a913f82cae7cecf1311ac4d9969d0a9757e1597b85d4010ca6bf10227fffe51bd26aa618ff86c81efc3d1bcb
- SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjtzhe2RUX/fHAhTw8Aftw2:W9iIxuERzA83h09RZxYjH23D86W2L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 e5e8693e0ee2c10ff005bb7ffe21890ec6fba87c3b2e42bef0fcdb5a832a17f3
- MD5 fc91ad71f395601083576de260939831
- SHA1 356d185e0fae8c147cf7996b0c7311703d216f09
- SHA512 3770b93f645fce8d2122d2383880eb17d9c2d48983294e63051d52ff6ea1ecb9e1aa9c87260073c81cc7b2e47680b67d0dee04ee5f01ca0e3f482755ef725d9f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+tzOe2RUX/6bHOhTw8Aftj:A9iIxuERzA83h09RZxY+62Yh86W2L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 a27a7bd2d9c502d9de5f7a27ee8caa31e238788a7072decb0c67a024b790f90d
- MD5 ddd3b607170842a847b6e80288d4ed1d
- SHA1 617629387bae61abc8c443c913d3c210f71d28c6
- SHA512 809d8c21162d218ed5bac26d3722edee3615b955c8af118358f49081f4d933776a96e56a92e635e1b7b05614442c448b804b6475b1e2266cb3a07779200435c3
- SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+tzhe2RUX/6bH6hTw8Aftj:c9iIxuERzA83h09RZxY+H2Yd86W2L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\Unconfirmed 464330.crdownload
- Size 41KB
- SHA256 bc55c9320951f1db49387b73b81c62463e5b49aab291508aca967a5693ebb2e2
- MD5 dfa64353f3592d09d443d43defcc27ab
- SHA1 e25675f0e5e57b304a6090c36aa6c624c0d9f016
- SHA512 46532f2b3dcf6989748f0e548329d4632009bc770753ed6e048f86c4ee39f9f1ee07cc276d49f7d830566dc27e376a62b6c97cb41ee8e91781c5af89adfb0441
- SSDEEP 768:HscG4A6bYcrSwouZae5WTjMKZKfgm3Ehy0:Mclj6e5WTAF7E00
- MD5 SHA1 SHA512 SSDEEP