eternity | hxxps://codeload[.]github[.]com/MyPrincessAkira/Jarvas/zip/refs/heads/main

Analysis

max time kernel
66s
max time network
67s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/03/2025, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://codeload.github.com/MyPrincessAkira/Jarvas/zip/refs/heads/main

Score

10^/10

eternity discovery

Malware Config

Extracted

Family

eternity

Attributes

payload_urls
https://github.com/MyPrincessAkira/Jarvas/raw/main/gorm.exe

https://github.com/MyPrincessAkira/Jarvas/raw/main/Cqqjbi.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	4580	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cqqjbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gorm.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3174447216-2582055397-1659630574-1000\{3F8DDB43-D3A0-4A35-85DF-308E09E60045}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3174447216-2582055397-1659630574-1000\{1250E82C-69F3-4401-A8E8-A5BA12C747FC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	Cqqjbi.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4528	4004	msedge.exe	80
PID 4004 wrote to memory of 4528	4004	msedge.exe	80
PID 4004 wrote to memory of 1580	4004	msedge.exe	81
PID 4004 wrote to memory of 1580	4004	msedge.exe	81
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3092	4004	msedge.exe	82
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83
PID 4004 wrote to memory of 3440	4004	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://codeload.github.com/MyPrincessAkira/Jarvas/zip/refs/heads/main
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7fffc293f208,0x7fffc293f214,0x7fffc293f220
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2264,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4224,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4248,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5296,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5440,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5956,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6224,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6252,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7016,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7044,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7120,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7068,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7076,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6892,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3552,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4416,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4276,i,4233166971966077577,10853330498775070266,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7fffc293f208,0x7fffc293f214,0x7fffc293f220
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3012,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4648,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4624,i,17456395914831936614,787604140042582740,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\163b39f1-1903-496c-b936-ae54debb4bdf_Jarvas-main.zip.bdf\Jarvas-main\Cqqjbi.exe
"C:\Users\Admin\AppData\Local\Temp\163b39f1-1903-496c-b936-ae54debb4bdf_Jarvas-main.zip.bdf\Jarvas-main\Cqqjbi.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1672
  2⤵
  - Program crash
  PID:2944

C:\Users\Admin\AppData\Local\Temp\fe8a5783-bfea-49ba-9751-f9ea288452bd_Jarvas-main.zip.2bd\Jarvas-main\gorm.exe
"C:\Users\Admin\AppData\Local\Temp\fe8a5783-bfea-49ba-9751-f9ea288452bd_Jarvas-main.zip.2bd\Jarvas-main\gorm.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4580 -ip 4580
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a46a324553367dc0b13a007305e4f102

SHA1
005a700ac0bf4429024f9e857e2281f82f370aed

SHA256
a718f2fe90be4422382450b4959840a13d6d18dea09d3da5394624198a126063

SHA512
d3b9fcde15be13451aa441070d9143fc53faa6a2725adea7fb9c340bcb9d7ea183dc1b36c0f8ec21c1748c80bc8fa03a14f198c2fc914c9f8e81702bd8e18399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
29f13140c50c2394177caf96baf3a5c0

SHA1
680e35060382a846752eb208b62de077d31fd1eb

SHA256
f4554eb3e1e133edb5f5f01e19539ffc52adc0b346e19c4742a815e7a92b2dcb

SHA512
d964d066a2913d3b6eb73925160d7e9d79a94ae5c6e3956cd361b54fe53833b311990a91346917bc90b227301d864939f6a5a417ff52ef9fe8e21971b1a661fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8a3935ddabf5b9f99653f79cbe3d09cc

SHA1
a05f64fd4326ef17e1c94a5832e04cd366630692

SHA256
87a010bb256b5f7ad22a397131745c98e96ee6656d2dfa7f0c342a737096e779

SHA512
1465a86ed64c38a14cc31bb8d35e0118106aa2aa895797203aa48d4fb98d21cb575cfd889cbe792cfff0c68f0d009f3bcfb366126b7fa3e7d5b7c3b98a983d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c3cc7d42688000291330bd95d41134c4

SHA1
80e00aa4661159316c190384f1bce5d22d2ad209

SHA256
6e27daec52efb7074764e677ec8bb8a2a2d2b8b3eee9f155b9f89b321009c988

SHA512
71d45d7954120d28dd3cfe2712001bb4196bcff92a5fb10f385a9840085ed0939b8736c3e88304dd3c299c98ac97fbc41958eee70cdbed94b8fbdfbf51984d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
418d850ff7b91e0c3fd0a45144c2f195

SHA1
71c7f6f30037c97552984a9e6186b10bdf5746bd

SHA256
e25688ab21f01f67e4a4c67c8c56665eadee595d5075b80ae99ed953e9659196

SHA512
a6584ffdca5917af6458209b22fa5a03efde8f65eec0989086e48ee32e3321f156249078c5139da733be4391b853c6bb51f0fef2e1d27ef976b6832293fc816d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
b50dff2ec26345ede7e8138eabf45c2c

SHA1
c46a7770451e6a4aa3f9bfa6ac47ca6ea21cf46b

SHA256
b7db05923167ed6de166a64dc5f85a483b82bca10f8703e0578b24759e14f3f4

SHA512
20e2b4090959e003db8ebafe2e7a7cc4088eb93e7871b5dacad3c0834078817eb9f38203bda708da77503c85315ae6e9e7b4844f62a795d959290a0f29f53c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
90e4d494ced628da4e21d0cdae960f92

SHA1
12904d089a7554f5939a15e92a28401d62b4c71d

SHA256
8272eca418bfbf9858ff878698a907357116f03e98314106d3413dd36bca56e6

SHA512
8673916863b21baf382b64ea2ceebab9d8aa05c8abc64d9f1e39b71b68d1d89aeb5133a3450b4f9fed33734771b771cdf567ecbd6ba55fc3ae5b387833ca89a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
b7e53250b7058c8bd2beb2b759674a74

SHA1
37922220e3bb6b799ae8bed0262b2927e0465ec7

SHA256
5800aba16f03836e934642cb526348a3caf4f5895b9566d943785c3a412e60b6

SHA512
c291ad595dc4a094af8fb5106c117e771f63c2918f7d96d9a10e821df300ef59acadfa61403c4767ead801047ce2bc75cfc43e0209e7f466184a31a4f032716f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
350d8bcaffca0c0f5ab8a100f0b6323f

SHA1
3a7fdfcd13a2befc83741c087d044729669c8551

SHA256
b32da193fcbc3fad1072a4dddf113cdba9a803b303a42797ddd71d4562a27ecc

SHA512
9ad6d301b0dffcc7d4c9630638f3482a69f8bc2056c1ebf0aac36a0fb51db3e8af8207ed362c69de958de7b662bed52d71a07fbafb90f414eeb83da355dc1db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580c30.TMP

Filesize
3KB

MD5
d9b730660d788b5086f9926890027744

SHA1
85d847a02dcc12bd6e5efbe524e04bec22ad8df6

SHA256
178a74cc7723fef3a10cb1cd2986d809018c6b78bdb188ccb996c0d7ed599187

SHA512
c889639fcb88f7761f5964b01db627ca488f9d96b0e11bceb20f6cd6f047278128126b9f207fb6b71c8c301ade2e2ff4f7cf30d963ea5d835f79ab23776a0170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
04683257d50bcc95e407976cd191efc8

SHA1
ff765a9c44162b0f278fe1f1abad02863087d330

SHA256
c63c7ce42f912db6f6d6283b0050e0fdca930a7b10e34d27d9ccbb5f0c467f4a

SHA512
77f0ce692d0d4265c457e5440445bafd713d62618969dc5ed49f55b546609c31d2cac96aa986cfc3e1bb67b3994c691e69d364e6be27217dfb689fb9c74056f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0b1f5b80-a612-4c5c-9f72-224eb3de78d6.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
456B

MD5
f23d2df21a39aa8d814cade6c37856c8

SHA1
233e65707015a53f83a0d53db03a4af8fab21ea6

SHA256
c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31

SHA512
a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
81d453a8711c0a0864a89a23510d400a

SHA1
354685432f3f0c5d4bbf1656eaae83f3027be1dc

SHA256
aefffcaf18a05b37949b007f2ec1712d8f612beb354bd6ae0b83bb15b609cf45

SHA512
e8cb3ed7745bacb312b06c1a819971ca14eed69cab6f9a34f9f4065f468f087ea9134c9dd64c7d9bc2719b627626259e39ff34731278ca1b7a01a3f9aea76b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Filesize
429B

MD5
5d1d9020ccefd76ca661902e0c229087

SHA1
dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6

SHA256
b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9

SHA512
5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js

Filesize
10KB

MD5
3de1e7d989c232fc1b58f4e32de15d64

SHA1
42b152ea7e7f31a964914f344543b8bf14b5f558

SHA256
d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a

SHA512
177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
30e17fe1f4e3c65d614321944cf41ae3

SHA1
d27f378ea2d0be00068a0fd8ad0e03cd1ab49eea

SHA256
f4a2663c34e545b59d1a871ab8fa3275352e87705272df826b726dd1ca046c29

SHA512
4fc598209dfff532ae0a7c181a76f79f2ab366835d8d39dceffb31aeb85c3b7f88e6168807b26f072570e118b342c23701d2423752b983b60a96d1187b1506bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b84e37728bf38e5cba55a14bfe868b84

SHA1
fad03a22f63b1d9c03dcc833fa91f9bd8394c0c9

SHA256
e54f54c2d292844a429bab2471485699998baaf785fcb558047db5ec097db4a3

SHA512
12f79a0b962a0989b3f22047f712c244548feca4a8e4d0afef33fb3e896860558498cc07bf09f5225f7bd5e168ddb784a480f3c4aa7859a3f296230dbd67dbad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
189B

MD5
121bc0d455c55d9bf985afa2d6e39c46

SHA1
8770cca5bae83d102f25e7f5657f0be425eb5ea7

SHA256
81bbdb0f213839f447c5168955574312955ff63df491624cd8147aff3910b64d

SHA512
fbf5f5e4672466d60c6dbd7f015aa0db68321419502434fc1b2477cf3da9faccf667cf557f6903172f2f3f943613e906e59b5369b2f3d91c6a9acb12c369d536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
00c97aa91be09374cfb32f67c300f03a

SHA1
e6bcd7f0839cd60132d9e4a282e4854b1fd524cb

SHA256
f70a0130d3d56567ad3853958a8fb544077b41a6c0406c4f89b6ea8763d28c2b

SHA512
330f69add6f437af0600421783a8c17a7e29d7cf0cc9a36614f288d187fe5b4da122e787529770acaa4ac250d72e87fab00a0a890be97a2fa068f11a441bb879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
6cd8768dfa525115dd5c41cbadb648a0

SHA1
4336c9bffccb499d38c3434940596c331acb4d0f

SHA256
8cc1d5d51648346f12f821347dcfbd7c450bac8985d2bb583f6accbb1d60b4d9

SHA512
1ce98e3a69fb41935f9c14a0a72c188a1ecce05267258f2832096f99d394f64e74ba6cb829c560e3426198e8e010484af887b75e2383779ab63a4fd2cc0df730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
290585f55b233e31d121cfaa8547fb85

SHA1
9116269fad27d09f0d965c5943ddc718fb0c27d9

SHA256
245f0d30e7935c2ad86bab064c4ad5b8de2e99f6a0bb266b00e93722d58478ae

SHA512
d943ecd53129ba49e415152550e87d8aa13fadea57e8b260360d27ff4582adf5f7219344af9910966f2df33d3624d8b35cf1c008242dde76d914422ebd93f534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
74a1085198014dd0915c516ce574bda0

SHA1
6080c6a0b73e1de695f6c683d87d37024bab021e

SHA256
ab3bbb9384e39c25a61d9c457bd2724355df52d7a485b389e1e8b35f493a64b5

SHA512
0f9c03471a85bdcc472c55d54904f91df1519ef7f575a237394edebb7419b4693f7bce277230c2e9bf741e9322d7444726b948f4fa2ba7954f41f591b3e32553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
8dfc9ee0c641765b568b6615d6719eaf

SHA1
a95e0123f1f05f82812f36d4218796fad37d18e7

SHA256
b247a01862aa62bf8553a0b3fbe25454c7f69a58c9df6da9a5f9119c7b01fb55

SHA512
87c7f3d2bc10bfc94acd7c736909f918ec287ac61db0fa7187e1cb843dfd4221bef535b3db537ea7b043bb88cc539c03920b42079c674e38f201be97fbc6da5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
c892c62fc0078762415b7769de313d99

SHA1
4126acff35b9343ab37cd52e1ad4769a7bbe13fc

SHA256
840eafcd4ea1bd468b40950155cbc81ef1e7b4a02cb9f68a07b8cb360b108795

SHA512
881608aaff015a610befcd6e9208f24f1c1a53d8e6d82cb929a0fbcb4f11c3b3e0396f6d55d70f0081167f3846521ea6a6ba653e4d2c1b7f781e3c46601e3661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
7299a58d7d6dfac7bff3a5862a2f7d23

SHA1
1cae655ee878fc38cf02322b710ad27655f84c05

SHA256
2a6460d54d74c4aa2bf8e6cc858e0da1bb94a1900dfe1faad649305ee729a66a

SHA512
956dcb28b63cd1a6dea5e7c5b783f58657c3f123722004b7d7e04444815ffa50786b63f6b285ab3110bc7828aac76a9a0a3d4d14161a5cc9a9070e4985f785b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
11KB

MD5
3401d943dbabc2447eef8cd9ac1cfd3f

SHA1
bf0e7e482c7a87345819c6214d22f3c86d640b40

SHA256
bafb9b085b5657a615a325077c51f02208d160614d4e856c8bbb8cec487726a5

SHA512
ccc85321aed02c7df2837660c78d2102257e0047b9f8939cd865679fa2675d5c9e2a54f99648e5f474811179fa29c68e6c6940c916591de8216760d18c32d8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
cdb2f3983371150f36feff5d282392d7

SHA1
0961d6c8ed9b714a34eeb330c6896601b63fe554

SHA256
595427b941d8432bb5194b6cc83f440e2f877ac1052ffc9aab44c523a0549ad2

SHA512
7cdd6b70b2333c0794b92b2de270fc5d7f778f7cb0e02c45c36a5decca8db799e97dd809079cad82ae50aefb35d246d18130b140294d7d0307f30bf3c7f03c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
44ccfcf7746bbed3964e18a0c4eb9721

SHA1
8e8049ea71873d0020ea2bcd98624b92021268e3

SHA256
db5d30a450c84435cd1cd4a69a9a58c18c81314639627fe61f48092895266f14

SHA512
7a19a33edfe2c3dce2fa4a243af1efeeb2cf02b46393487ec8ea203d318a202455cb3f98e355d4a39b98f931c0c10c261b9e116f1cbfc0808743e96860e89dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
5f8523ff4afb05dacdd4b45c4abc745a

SHA1
e78aa06ee6649d4ac30504cfd3c572ae71d14e00

SHA256
b009e827d89e73c874e118c32967050cf5820130b81abb0958270cc1e83bda07

SHA512
66ce7a0930b0abb3a8ee8fb2226bfdc81d42c2c187e13305917b354d8aad5feef415d00318b72121210daace6ddbc5dcf4416e1692a27586ea285271bd2b92c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
1726705b7b00ad62f2538fdb68314bcb

SHA1
2d487633c6aa06769f2447f263fbe9fac1184c96

SHA256
465aa5aea9aad44222ebc392241264d03f2072d0206ceacb7002f29d865fcf40

SHA512
b9b57e4e2221fe012e7e29b53ae0042371a5b7e8370be1c0744aef43e59713a374106e02807f60b305967621007d528a5fc8a87f451aec090f20e2952b79757c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
8afc9bd42d5525232602cb97f66e591d

SHA1
7305257b178d69d2067a5b80cffb519988454e28

SHA256
ea4ec6a3073dc535dd773840242cb8fcc2dfb2cbc9fec09c3f3533be8134cf7a

SHA512
35a22866058ac1e391d5ce155ae9392e2d6cdd4cb05a2874a7001501ec0f6b6d5796ce3c0f5a99e038e28051d4fe1a69f5352125ae837f6040e9d202743e5d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
484472f6d734c8de329d68a4205beb1d

SHA1
df526bacb72268395ba992011d1b3f0ac60494e3

SHA256
022ca89b4c564f72b5ff62d1f833841b47fbe1bee616cc138e4f63ae1a87283a

SHA512
d93674bf69f7e20ea30e5bd0967305dbef8e25ac503ede59922f33e0cf102621015f0a24574b70418490caa4770d55b5c0cf822b41f0fc8848f45b36905a3513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
edd10bdc12c60cc6c1ba23239f4bf6ee

SHA1
9e94abe83ac1970f10776aa07a9d33ce220e7551

SHA256
d4ba78f1af57e0717e2a29d5ea02310237f787a964990bbb75935f76123aa07f

SHA512
ff9ca9a5bf00190dc53af9c0e2d6041a16c0d212367b42d9b899ddae63f6ab23545dc1060bcf46ce9eca2d7c02738e9664caf315b770711768f2bea1bbebc6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
9729ddb3ce62147d7b6dba8f0a4543b6

SHA1
02697f6398028522f5430aa0dc22ada2fe28ac48

SHA256
0f4f981a7867f2aa83eddf600de3f8e685902f2f89283a1bb8f443766dfebac6

SHA512
5bd55301b7555e71b2e61d39701e4399698e6196dcab0e0cf1cc2f126c033547bbbcc2a480873f856290492102916d606c15536f4353b6a42b279534fcb8e243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
0faf999acda0e2652f69c84d12de9475

SHA1
b88387f133022d331c88c895c54998ac5cbb562c

SHA256
42070c6e751975b2475067ef4187bd43980a4ba9633617bfb02808e7ca9ebad9

SHA512
5002d3c1c3fd835f530bdeae23f29373f1ee7d9c58da408498248208b65aac3d82a7b90f92467d2f33bf99461ec0b2381be40ccc57d3cacb4d6ca23d6d4a5626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
e64c2b3d084cc42f63b97105c7cc6a6b

SHA1
00d37751ef6efa043be08c742e99465738bbc95e

SHA256
fc355e5ad28923937b2835f636bb8e30fa2b110ece86922007024979fe62a5fc

SHA512
2eb7592b8f5b32bb12abf2f1c8468ea340e95fbd57a23f230995b7d01eff07315157c0ffe199b2a86815db367c7e1de829dafee222e287ccd366eaf7c89c18ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
3745bdddfb0c78922580a5108ff1d539

SHA1
74625b3b292c990c26efd85d514a7844a8b6820e

SHA256
5a3647228354189d9b23c7643c7f2700f677d60c5048de669ba16254c6b20007

SHA512
401fc0ec0537aea0774cd3f239704b794460c81c2a30689d6c16d705217f3b0765f39404e1a79735607b796becce0b61cd10df21ad3695ad79758a1068f0d7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
6bd68fb8bc794bdc761203ee1db9454e

SHA1
b4ca1d1307e4fa26fa19deb26ca48c97dced3ed2

SHA256
82e1859113aadab43354369c9886247d352a3b4e377eac2f07ecd0558154fa54

SHA512
a319cbc95f139225b0b994ba11e099707915ca3ee3a95080879777ac8bc50368be63c8be2d89b696e661e2ee295e2e225f1623af1abd7eb1c3cee788cb30e681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
6a095e411d0b2ec25d95ec185261a37d

SHA1
f03d8976863d15a6595aab7a66e2bcb7ec812b48

SHA256
0508bb6abadb2d82a8161e787220776af84f544325f55690c0a1e24ab50010e1

SHA512
6950eea265378d82f9d9724e37357044fe1c7649799f37a0b1e95d6c5419cc5a82b366963088770e4f5ad6a114c86d0c91cea9b6d3f9994f6cd8c57b87d4e206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
c4aed04b101b94755a44f5d42c040501

SHA1
0e34f90df4a40d56c5f3f5fb6321eb70d9c945e1

SHA256
234d3ea8c900c2531382b4ac5eb76a1842009c7ea5730a49a78d8a96d0e77a43

SHA512
3fbb7766874a24ced49ad15538fde4d916d1830cf9733ce797ea5c6721448b3663b61049e14e8c191620e541fbd902f9db919ced1b90e0dad5bc84fcfa310a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
9c67e7be9a73d0f7b5ee39ab2672b871

SHA1
09fac6eb6c87e002c20573662b4ab21b95f54e3e

SHA256
c6c07de8c4cf2d50d6952f118c32d0faef8a6101b27f9ff598c75ceca16616a0

SHA512
57aed1a486736e073b1c161c4c802521504343b6a5ecc38867f6ed448447a74bcdd99f4cfd1e4b1934b44d58fe4dbe67394f6253db5391f8578292b02fa725f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fb47048-da25-447d-b956-f04ac0576de5.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\Downloads\Jarvas-main.zip.crdownload

Filesize
1.4MB

MD5
18aed24496c772c713d14a1e9bcddc97

SHA1
a5332cd58247c00307170f60079f4a51394751f0

SHA256
8d54a029d39b25fbf88fc27e1a7e0d04b2d4e3fe90e8a445b3ce5b4093f14b28

SHA512
1bbc75a9472b022dc24e52a20734c9e4d7e4b62f7b5e00636c47562633168c7d5015d0db6cfbd367e3542fd6a66bc85183ef8b9a90a840fc636e42a695bd2eb1

Download Submit
memory/3400-559-0x00000000004B0000-0x0000000000600000-memory.dmp

Filesize
1.3MB

Download
memory/3400-560-0x0000000005540000-0x0000000005AE6000-memory.dmp

Filesize
5.6MB

Download
memory/3400-561-0x0000000004F90000-0x000000000500A000-memory.dmp

Filesize
488KB

Download
memory/4580-558-0x0000000000800000-0x000000000086E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads