457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571

Resubmissions

02-02-2025 16:44

250202-t8tlcsslfm 8

02-02-2025 08:43

01-02-2025 19:11

01-02-2025 19:11

01-02-2025 19:09

01-02-2025 19:02

01-02-2025 18:52

01-02-2025 18:49

Analysis

max time kernel
88s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2025 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

the_watching_nightmare_updated-Reborn-1.19.4 edition.jar
Size

12.7MB
MD5

a718c31344afb79ab44968939d06e8b7
SHA1

dc7ea8bc0398e224c8a7cc13989289071483ab10
SHA256

457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571
SHA512

91e794b814f496ec3b27e30ab38ae2517f024548bc554e3ba607489cefc0823e30fa9ccde0f180dd772668117737fa5a957a0b0503d04edf8c76755a8e7c29ae
SSDEEP

196608:UCpW79MRAwoS6RnRbyMHLXlz6pJ21/bM51ux44+J9ZJi44+pVtSxjXaOzP2O:dpWZMmr2T21DM5184zRJdAxjaA2O

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3232	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
396	msedge.exe
396	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	NotAVirus.exe
Token: 33	4732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4732	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3256	396	msedge.exe	90
PID 396 wrote to memory of 3256	396	msedge.exe	90
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 2308	396	msedge.exe	91
PID 396 wrote to memory of 380	396	msedge.exe	92
PID 396 wrote to memory of 380	396	msedge.exe	92
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93
PID 396 wrote to memory of 556	396	msedge.exe	93

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\the_watching_nightmare_updated-Reborn-1.19.4 edition.jar"
1⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd8b2b46f8,0x7ffd8b2b4708,0x7ffd8b2b4718
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,9706542271978278405,2639491993262567850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5036

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NotAVirus_v1600\ReadME.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3232

C:\Users\Admin\Downloads\NotAVirus_v1600\ItsASimpleQuestion.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\ItsASimpleQuestion.exe"
1⤵
PID:1796

C:\Users\Admin\Downloads\NotAVirus_v1600\ItsASimpleQuestion.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\ItsASimpleQuestion.exe"
1⤵
PID:3104

C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
"C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe"
1⤵
PID:4124
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PlaySongs
  2⤵
  PID:1564
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /SerMolesto
  2⤵
  PID:2600
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /KeyCaps
  2⤵
  PID:2408
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /PocasCarpetas
  2⤵
  PID:2452
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /Hablar
  2⤵
  PID:2200
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /AnimeGirlWantsCreditCarInfo
  2⤵
  PID:700
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /AnimeSomeoneWantToKnowWhereYouLive
  2⤵
  PID:2740
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /ItsASimpleQuestion
  2⤵
  PID:4128
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /IsJustCAPTCHA
  2⤵
  PID:1256
- C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe
  "C:\Users\Admin\Downloads\NotAVirus_v1600\NotAVirus.exe" /IsJustBSOD
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x310
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ItsASimpleQuestion.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a451e41e51facc395053e7b74c3490d0

SHA1
c866ac24af529f0265e99bd88529da46c9ff6dcc

SHA256
cc33bfdf9c856a2e9e9aa8eeddf9723a0396fad82b0dcae7a408bb4c84fdb584

SHA512
553489450d55d7adb9c859e521d0e46961490e54c533c826adc8c546ca0b51ecda82c159801bd060a291e724355c6d4fd2ee603ff65d4a15603f34f1472664fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6a53cceb7a396402c1eccd08dbe38a73

SHA1
96e06029b79791df1b1a0a7cef7508a5c44d13c4

SHA256
31c8ba2ce8a088515e4feff78968e8916c759331b7428421a990cc349a208b51

SHA512
bda381d092d0272a19350a66533ec0fac2efccfd26fc87695a8270eb3d4abec01483b31dfae75ba3f128623454d471c9e948c44df478edbdb6b5a15377637036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f4d5e52-2831-45f0-ae52-809e56285e18.tmp

Filesize
7KB

MD5
cf312ff2b0cf1a625d6e86f4ccc28adb

SHA1
d796bec0114ba868d70beba7b6f93ddc219f3e9b

SHA256
8d81f72af68c8b1267d61c207532c1b4fe272f2619b124742b2ef767652728ee

SHA512
713cead2ad2f8f93bd59c2a70d20c940d86e9a91b2c8a2973e3d9df2e70e47b86573cefc0574026d9ff8ee57b7c16547e1cf3f5072408de0be82aedaf460908d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0f395b063d10ae5a61bd0d9be528a430

SHA1
dd6ae90438de66866f0122122062eee76812836e

SHA256
9019a708df5c293d9bc2fcb82af5473752cc2932a0f04090c82e130ba996fa4f

SHA512
fa477b3c7a4f423b7c647007d5e6b99f2ce215175c8c4cc7bf55e09e474c628a519a5d446b589541ea9c25f53502ff54aa9430217f6471a4417afbf958ab192d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
c6bd6e67d3f8c02e2a80135931c1b53d

SHA1
9396b8ce09c42da7e4fa897295a184cd40e3f603

SHA256
580a17c370c97bbf0ed1f2edf1dcf20b4d0a21164dfc1c00fb0836315f5fb960

SHA512
7f0b0bb6de22560108cd325eab36f67cf3bda79aa85628b4d501de0bbbbfac4793b6fe57ef8ed1ba04f8e7dba61a08fa524311a5e0a81cfdee40b014487798d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f66c35906e756e694dd46a1738b7f5e

SHA1
ab9ded81cde4eae2f8bfe3df1684135823384b2b

SHA256
d0ad56f40f4bae7ea7e79fb75020a760099f0a377ef79db64f453e68722f276d

SHA512
8597ed840ba1b70f47fc5cd9a279694c3812c1e4d0bf2093c156a5018726fb58af51cde46d0155fb4e1f62d331957dfe21b28c1ab7d32fcd470d9032a702ae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52b6a4c48c764dfd768c262d8ac600e1

SHA1
cb8b791c6484b54fcfa045252001c5c78298438b

SHA256
7fe09732b47b2fd0bf493c5e8b6d8fcddca1e82a4834657b9fec72106ca0e753

SHA512
6158368e79384fc80a85b3316796c7cf57efba1b522946c3ef3169837b9262aa3c8f9f5b600442ee9c7dde5f51eb1800946b0d8eb98d57aacda0e53748810c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90a3a7e872612d085b2b53dac9144cdd

SHA1
e7c8c3a93f60b090c16d610b2323af06d71010da

SHA256
868e00b9693919d4eb9753cbd46a2fa7773e141c523e6ac4cc7a6a86bd404d3c

SHA512
53271b770b6998c6cb2bc0391a0e075b7a24f996c290250fc3d7f6278c92cc62b71228a01a71d739c8cf81108fcdc2093645aae7d185bc5564637a1c4e40efaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eda3a12068063ebf13f07b179dcdd160

SHA1
6a942db1d24c8ef0c538f7eac03fdd9cb0d489b6

SHA256
ac21bcafab9f01070537439e3fa5cee7907aa2a500ece67092252933e9db5868

SHA512
b318b4bdf51c35c03d1a090c88772b6720c2e850372c53feaad3f0d9a1d088e8b6a06be3f96772550aac19bdea87370dec336416ceacc913d0f44d4c593f203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585937.TMP

Filesize
1KB

MD5
6d594efefbad92f83fbfce79fb25dc9d

SHA1
279b0fce4ad5f4e46baedd310845f8932e9ad82a

SHA256
d638eead988cdc087c54b60fabb1b330582d089c037d215f6ef7ca426dcb2e84

SHA512
7017adbf3e9d73f2194bef1ac719228770d010250db49fdb295adbfb82ed4efd65f8ee5d94321917c3039d7ba32949e7acaf67c3ebce88e2c7030697cd2435df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a48dcb1d7a4971a0ec6c4b8511e15e2

SHA1
082899b989d96df456029dd626bc474a79e5410d

SHA256
4a1d2e27042ffdecc2f729d5b9e0d6480b90f6e282e54234fcab8a5c90561c28

SHA512
ff6b8010613ce58235d954c453eceb3e9074f037e4a1908ae2f89b4732d5aaa3fe4a4bdf2549de64d7fc8957b950d5b1937431d87dc42e4af659f0d138642c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f58df4abc4f337db1a65c724b84b171

SHA1
34aacf6861856cbd10a602f0ff577d3fdf60b585

SHA256
e89bd19577dd3a5070e61c4ee8c03ee9672e6e5e51752f72084d3c2c139a090b

SHA512
3a92496bcd147ad2671735d12b371aafa86d2bfa9a46eb698875ad5b4c37d120b645b43335f26bb7136736d0f0062fc972c047cb9c71b12d3f1be8c9c1d4fe66

Download Submit
C:\Users\Admin\Downloads\NotAVirus_v1600.zip

Filesize
209KB

MD5
3d217eb384a6a77373654da57884d019

SHA1
923e8fc1a80b33709466e9cb9334bff4dc9d90c2

SHA256
456ab7bac5d5d632925a18e247ea50e4f668577fc4ea4d1f28d52e57b355efc1

SHA512
7f93dc1ffe1ba0182514ad2137a74f4f2932a517c1e36dc0317466974b3779aa34f09fa8d1c73fd88c2ec9d08e8d382d8a9fd1aece01bf0d1c2e296c65ddd11a

Download Submit
memory/1796-350-0x0000000000F40000-0x0000000000F5E000-memory.dmp

Filesize
120KB

Download
memory/3952-12-0x00000162366D0000-0x0000016236940000-memory.dmp

Filesize
2.4MB

Download
memory/3952-11-0x00000162366B0000-0x00000162366B1000-memory.dmp

Filesize
4KB

Download
memory/3952-2-0x00000162366D0000-0x0000016236940000-memory.dmp

Filesize
2.4MB

Download
memory/4124-372-0x0000000000A30000-0x0000000000A4E000-memory.dmp

Filesize
120KB

Download