hxxps://www[.]dropbox[.]com/scl/fi/azkb3s3whn0bn8loqyq1v/javaw[.]exe?rlkey=i1a1dugonfikc71tik32rbubx&st=ubvgw2dq&dl=1

Analysis

user interaction
yes
max time kernel
104s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/azkb3s3whn0bn8loqyq1v/javaw.exe?rlkey=i1a1dugonfikc71tik32rbubx&st=ubvgw2dq&dl=1
Sample260508-vxtyesex9l

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	3712	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
3308	javaw.exe

Loads dropped DLL 4 IoCs

pid	Process
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	discord.com
57	discord.com
58	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\javaw.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4348	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	javaw.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities	reg.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
2788	taskkill.exe
1532	taskkill.exe
2588	taskkill.exe
2984	taskkill.exe
2188	taskkill.exe
4672	taskkill.exe
4356	taskkill.exe
3916	taskkill.exe
4552	taskkill.exe
3956	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227345673658680"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{B0E1D5BC-AA32-40ED-90BF-1E135ACB8472}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\javaw.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe
3308	javaw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	3308	javaw.exe
Token: SeDebugPrivilege	3308	javaw.exe
Token: 33	4788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4788	AUDIODG.EXE
Token: SeDebugPrivilege	3308	javaw.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1824	4560	msedge.exe	80
PID 4560 wrote to memory of 3712	4560	msedge.exe	81
PID 4560 wrote to memory of 2852	4560	msedge.exe	82
PID 4560 wrote to memory of 2852	4560	msedge.exe	82
PID 4560 wrote to memory of 2852	4560	msedge.exe	82
PID 4560 wrote to memory of 2720	4560	msedge.exe	83
PID 4560 wrote to memory of 2720	4560	msedge.exe	83
PID 4560 wrote to memory of 3108	4560	msedge.exe	85
PID 4560 wrote to memory of 4944	4560	msedge.exe	86
PID 4560 wrote to memory of 3108	4560	msedge.exe	85
PID 4560 wrote to memory of 3108	4560	msedge.exe	85
PID 4560 wrote to memory of 4944	4560	msedge.exe	86
PID 4560 wrote to memory of 4944	4560	msedge.exe	86
PID 4560 wrote to memory of 4416	4560	msedge.exe	88
PID 4560 wrote to memory of 2200	4560	msedge.exe	89
PID 4560 wrote to memory of 4416	4560	msedge.exe	88
PID 4560 wrote to memory of 4416	4560	msedge.exe	88
PID 4560 wrote to memory of 588	4560	msedge.exe	90
PID 4560 wrote to memory of 2200	4560	msedge.exe	89
PID 4560 wrote to memory of 2200	4560	msedge.exe	89
PID 4560 wrote to memory of 1796	4560	msedge.exe	91
PID 4560 wrote to memory of 588	4560	msedge.exe	90
PID 4560 wrote to memory of 588	4560	msedge.exe	90
PID 4560 wrote to memory of 1796	4560	msedge.exe	91
PID 4560 wrote to memory of 1796	4560	msedge.exe	91
PID 4560 wrote to memory of 2172	4560	msedge.exe	92
PID 4560 wrote to memory of 2172	4560	msedge.exe	92
PID 4560 wrote to memory of 4344	4560	msedge.exe	93
PID 4560 wrote to memory of 4344	4560	msedge.exe	93
PID 4560 wrote to memory of 4224	4560	msedge.exe	95
PID 4560 wrote to memory of 2596	4560	msedge.exe	96
PID 4560 wrote to memory of 4224	4560	msedge.exe	95
PID 4560 wrote to memory of 2596	4560	msedge.exe	96
PID 4560 wrote to memory of 3644	4560	msedge.exe	97
PID 4560 wrote to memory of 3348	4560	msedge.exe	98
PID 4560 wrote to memory of 3644	4560	msedge.exe	97
PID 4560 wrote to memory of 3348	4560	msedge.exe	98
PID 4560 wrote to memory of 3348	4560	msedge.exe	98
PID 4560 wrote to memory of 4416	4560	msedge.exe	99
PID 4560 wrote to memory of 2476	4560	msedge.exe	101
PID 4560 wrote to memory of 2476	4560	msedge.exe	101
PID 4560 wrote to memory of 1852	4560	msedge.exe	100
PID 4560 wrote to memory of 1852	4560	msedge.exe	100
PID 4560 wrote to memory of 752	4560	msedge.exe	103
PID 4416 wrote to memory of 240	4416	msedge.exe	104
PID 4560 wrote to memory of 2424	4560	msedge.exe	105
PID 4560 wrote to memory of 2424	4560	msedge.exe	105
PID 4560 wrote to memory of 1304	4560	msedge.exe	106
PID 4560 wrote to memory of 1304	4560	msedge.exe	106
PID 4560 wrote to memory of 2976	4560	msedge.exe	107
PID 4560 wrote to memory of 2976	4560	msedge.exe	107
PID 4560 wrote to memory of 3308	4560	msedge.exe	108
PID 4560 wrote to memory of 3308	4560	msedge.exe	109
PID 3308 wrote to memory of 444	3308	javaw.exe	111
PID 444 wrote to memory of 1064	444	cmd.exe	112
PID 3308 wrote to memory of 4632	3308	javaw.exe	113
PID 4632 wrote to memory of 4348	4632	cmd.exe	114
PID 4348 wrote to memory of 2340	4348	powershell.exe	115
PID 2340 wrote to memory of 916	2340	csc.exe	116
PID 3308 wrote to memory of 3468	3308	javaw.exe	117
PID 3468 wrote to memory of 2068	3468	cmd.exe	118
PID 2068 wrote to memory of 5028	2068	net.exe	119
PID 3308 wrote to memory of 4468	3308	javaw.exe	120
PID 3308 wrote to memory of 4444	3308	javaw.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/azkb3s3whn0bn8loqyq1v/javaw.exe?rlkey=i1a1dugonfikc71tik32rbubx&st=ubvgw2dq&dl=1
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbca26c188,0x7ffbca26c194,0x7ffbca26c1a0
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,11909615714856861784,2891155234297279271,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,3405675915863622040,9184979466951488156,262144 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,800811990091581864,5043556027463308208,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:13
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,10930296111871452713,2479224289069643405,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,5283921918973963406,3293877067320853293,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2148,i,6369827551521270753,11674781797113445981,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,11864167893137979938,16107471927680026994,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4200,i,16948615834892842487,7231828374368052792,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,3279080515779909749,5865217804998590627,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,1131273065542767679,3684455877760602940,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,313591122514521683,6153609812356280780,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,8865306665172453639,15166468770255482068,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,3088176134567013423,143267924001303068,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,5653541085776868554,11493423631171723340,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5884,i,6512057228279270007,5631105485145772206,2097152 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,6644700455139715100,8616493375506640117,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,4432939940880745446,5412227058236899704,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11514819313122251012,3210668437818051087,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,8644460739666745283,2496468747774977431,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,8644460739666745283,2496468747774977431,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,14168033696392961007,4736459849690547053,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,5073016949415531951,12820104541838930024,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,3418833897256723262,1274873968691928931,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,17504054638875948145,11360310045370838876,524288 --field-trial-handle=2008,i,10827696919909093442,8685029265278324249,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3308
- C:\Users\Admin\Downloads\javaw.exe
  "C:\Users\Admin\Downloads\javaw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System"
      4⤵
      Checks BIOS information in registry
      Enumerates system info in registry
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\moo2mwak\moo2mwak.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7858.tmp" "c:\Users\Admin\AppData\Local\Temp\moo2mwak\CSC418B2D3EE7D4404A8ED76257B724A55.TMP"
        6⤵
        
        PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:4468
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    PID:4444
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    PID:3960
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
    3⤵
    PID:2536
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera_gx.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    PID:4808
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    PID:3792
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
    3⤵
    PID:2272
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discord.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
    3⤵
    PID:4948
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordcanary.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
    3⤵
    PID:984
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
    3⤵
    PID:1064
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordptb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3872

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf93760be23df6efcc7b7922dbd46e9d9ecbf3f23574bf6162e997620b50105
MD5 4273f0f1dd6cd2d157f4924e31075e6a
SHA1 836b3cb4554ece9c0d2a375652538e19862f4151
SHA512 0af07f79745008199fb2831692c66cb7a04d3bd6bf2fe63b8e7d21c2252e2a48eb9d4601eb19c6a668589729eec56b44298b571e07a0b9b6e54717d22c3be108
TLSH
T1EED0233B7B5F7C13F72D65709123871177665461668B8510F31CC84D58780D727C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acc64b5fafe18b6dd8318d3036a3f5c8aba723aef062fb3fcb70757f1fe28095
MD5 8a1ba1ae8c21c699eac9164e0ecbb96e
SHA1 29d13ff7974005e3007ce0900cd6d6066ba670cc
SHA512 ec43dcd4de57fbb5716711bd972e38e38cd27cd080973b78259deddbb7c20cb9c2fc60d37a1021e4a803282ebe4bb115a53b480bfd6455dbe2102b51d62b4477
TLSH
T144D0228CA38A2C22E2A8BC3000A32F00A2A0E0228308C220A0B3080A2C800832202080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 393d76a3d1e0981fb8c79e8fbf067ec2567826241ea874a8dcc210e4131d3f45
MD5 aca2955089f2aaedea61f37e7b7c4b7b
SHA1 d09472d68a0d08fbbfcba290375a58426cdc27ac
SHA512 bec7ab4da440e792a88378b896eacca057b1cf1a8d1b039dc3a2257366a60622e3054bd196ab57914f22bf004afe41aa515b3eabfc5351f624901ca04cd17734
TLSH
T1DCD0228C238A2C22EAA8BC3000A32F00A2A0E0228308C320A0B3080A2C820832202080
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0db4a586632da2aef1716ade6b81e930e14690c879021318c453e9020d37a935
MD5 a1e75673fba07966cc5b85f1770a2f67
SHA1 91a37a3f08fb0ced70bfea279a2c81d4510182b2
SHA512 4869ecc06ffc160f320017a5c262481aadc22ac4e6dc2165bf13bec171884d329dda4acf08690cef06893893dfc407628f095526ee06b9f25b6bd25ce03b9d89
TLSH
T18561F79551E2BC5BEFE600FA9BEED40C726545683172DE3B16D2A0FD0A1FB41E0876B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587a0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587a0d.TMP
Size 3KB
SHA256 0d09520f91a3b04bed1b4d0d517379628cb4f7040879870bdf40a6bb072ae88e
MD5 53ecaee00dd4bc76da80b313669f7126
SHA1 edeb72f0cb778bdb33b04eaf6d3b813d83dd2ebf
SHA512 c9466a48ff51e3abff55c95d64ca7bbd4f0dfb9e3379dccdfd9ebb487063bff35ee8cb58dc29d2f85d8d7d42468e747be020e0727a8ee00f8b764629c9ac42b7
TLSH
T12761F89551E1BC5BEFE600FA9BEDD40C726445683172DE3B16D290FD0A1FB41E047570
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 c4a86c14c94de3afa1ca6f641f3015ef04df59f2a1f6181d8d021e6d1df56bcc
MD5 52800e22d94a185f4806a5c9d216b107
SHA1 6fcafba2eea956c45045349123b9fed609e40d8e
SHA512 955f178bf40f1f2a9700b6deea58b60f8c31fbdf77236e8a3095e31eb5748f4a3d6dd7e3479f3d3d07c0d55088cef965b84e078d8873ce8fc18d4212143f23e1
SSDEEP 48:TtLopFMatSaw/auUOt8B2oOYK9wSoulCStNFfVElfIH4sLcx2tVfD:9eMatUaAKLalLt6M
TLSH
T1CB92518E0F306165E0E45337999581173EEC312DE31762AEDA1460B38EA269AAD023B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 64bb6fd06ab5ef9df343340af9a54a65f679b4b27e1dd0085ba619c1d610678d
MD5 f18d4bc582fc1b6daae67299ab518c78
SHA1 203d5992b8192c834fc0205556f2dba07e0a646c
SHA512 299fddd39432d723872a5c8062cc7cf325b401081caefcf24c1d69b3d8437f64fa84f1703458e3bfb12526e87d41a82b4d24ac074a56c316d9250c60f4b6f282
SSDEEP 192:sxZIARWyM/jK1Ml8MoEv/fkjsYPY5Dnhg3G1dIdpM/W6+WNGY0GokW+rIg4J:sxZIAsQEv/fkjsYPYlhf1eM/bG5/gc
TLSH
T13E520912AA38A977CCCBD20DF9557F53D6F5553292900E44A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 13062aeb83fdf4756d6f641c2d7f7b90fea22a62bf6cd0e4c1b54390cea1d70d
MD5 8ac8038581a47f3a17504d7cc02fdd4c
SHA1 b01e438bce7962e396fbe2773aa1e2f6292d2605
SHA512 6e74ef67ac1fef0ef2da902ad4f22ba09c423a2ee6fbc7f0337e96730b6f70c404148ac8fccfbae4038d2f275bee5006d9ecfb725f9481c82ac11073d77e5968
SSDEEP 384:sxZIAsREv/fkjsqWvdPYlhf1eM/bG5QKB:swA+Ev/fkdYdQlhdr/bG5Qm
TLSH
T17B620A12AA38697BCCCBD20CFA557F63D7F9153292900E4499FCDA0C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 edddaa4cd7025d1281bfeb18315fee871d503711f2bf4ca582919fc59d86adce
MD5 ecdc0c7da04a1f1d5ed7d55f330681bb
SHA1 dcea90839974e7f9a93767582f573999035f362d
SHA512 0b6e52b18ca506f06508be0d316b498470f21886747d1609353e20e429982b448366cad88c393109b775e6638da25e3c78dbe6656e244a1846dfda35fff5019c
SSDEEP 768:U591L8/j2gD7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gVzJLlt:U591L8/j2g1EnqeWRmqSQBqu1jaKgVz5
TLSH
T1A6032B3B2C4CCB7E4F804E9CEC26BE9A6EE8018B9698C95447EA444C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e0fb6d6ae7163672c0346d02a69bbfb7990abedc75a620afb7f4a4a184240691
MD5 bd9c327b25c56ab6dbd30f6131b57694
SHA1 1b841b9a48cb9c19c64599f61dcfbcf5d1dc3f72
SHA512 178fefa94bca73d233bd89c7b15d9a4d71021b90123748dad4d51e1884cba83e7e67f8319b33919b7015ef9eb84908a5831b423be66fa302561a403046e1e7e3
SSDEEP 192:GotfWWFyG0oUPAziOKNm8Xuuj8GF3et6u8QsH47a2iFm0/G2rUJ:GolKPE
TLSH
T104D15351757702C32DBD2D4A85A0B92B56C130A33108B87B7BFD15628E27E218DFEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 067a90a82ddcbb65494794ccf7d9e11d9b47043381abd8be9a86d15a542e711a
MD5 4806d41f35a3c572d97b6e0c266c5ce1
SHA1 56fd54bd5b2173e641ae16819c2f6c642e727609
SHA512 e550dbe85522457d776c2d4d650ff73d7e3f2c6759a5b24dfebce6c694539c967bf687d3f3a796a37fc01108b2ab576d0cb2c6d7074a607dcab34108132c8697
SSDEEP 192:FvoW3dfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aefQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1C924640A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4fff96b73d106007757bb1a5192f501f71d3f75b83fc8bec0bdae93aef8fc037
MD5 eeac32a425d558965a28809580236f00
SHA1 a598357d9361b42ef8874cfdba6ba08d8ae2a69f
SHA512 de0b8dc5e77d748a717bb3cb75ecd5abdf0fbc92622585866b633b246de48e706a1a6a5a0e255b96a9b5cadab802e2d03d641ec33816486e27c8175990ee84fd
SSDEEP 384:n0CcmyWCa8NrUKA8I7B54LexRj2JX5Q/5+f8IXGFOe4KV8p0NLS:/cpaqATakjQw4LqOI8p0NLS
TLSH
T17E827D32A87D6C779DE7AA05F05722178FB4607B93D05FA5DAEC9F1D008B29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fcbb8d6cfe3d57cd9b672af9e4521825a94237d99b97d62563d908b511489830
MD5 d164b48722d6dadf627aa91bac560e78
SHA1 73dddb0916e7d71d777804ff42084684d82be5ac
SHA512 fdd8f7a2cda03e0b2d270b4c6cca5dea2a4a768e423e092469f89ba085ea6eabe782c5337e6335b620495f2957d90167f8f27640e93de4f57e4c7b721ad9994d
SSDEEP 192:+GNJ6h+QmiUyclKgiYX5Hw/5+XjzorIX+hAqLCqOU6:+GNJ6A5kgiYX5Q/5+f8IXGdOU6
TLSH
T15112E835B968BC679EF2AE45B04732579FE4213BEB955F84DAE80B1C008B65C1349C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1869e56b0f33c43ed5f18e564693a714c67c4335b2d332ded6a82a97b33f07e9
MD5 15d38306f77d3522c402778727a0099d
SHA1 8f9f63c0d7a0225d0296567b4f0221eca88f7ee4
SHA512 832d34020db6a9d02242a759db03b45c08d0d3553853739f25fea48d49e4cd61fb77b11fe03b3dd744837cd1fd63c8205414ce81511eeeb86fef25c73d6a6e8d
SSDEEP 384:neCcmyWCT8NrUKA8I7B54LEJLy2JX5Q/5+f8IXGF4ahNQHx6m45AOe4KV8p0NLS:dcpTqATaeyQw4LqhNmx6m45AOI8p0NLS
TLSH
T1C6B26B3EAC696C7F489E770C604E25278CB4613BD3B88AA9E7DC4B0CC07B558F346925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b5c23fa65a9e544ffc61c80e5f81880e72a68edaad3322a634acaf9d41eeef7
MD5 013b04e370342ba81a894a4edd63755f
SHA1 93910b44dce74a06b0d0bda8747d8a0268bc5d21
SHA512 7976d61e3792b505e6a3a2a8f43b7fd5bc27c7c2f79cd2c441ff15d2b1252d27ab8fd4ea5651bf234db161ad7faf4aca8b3a54b351dfb7dbe58057d5847f9bc4
SSDEEP 192:ZGN66hNQmiUyiGhKgNYX5Hw/5+XjzornWYu/U6:ZGN66R1GIgNYX5Q/5+f8/UU6
TLSH
T19602E979B96CBC779EF3AE49B44622179FE4103BEA955B84DAE80B1C00C765C2346C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ae301c0bc889cdaaf08da3af7e84da176b8841a2b9dcbc7fd981e8fb7547fb48
MD5 6519b5dd48fc4d15b419731bf8bcdfe6
SHA1 d422a59589dd7ff06a23dda7d814a1aabe30448a
SHA512 1071feb93133776111876d04d50e5db6c59c59f745465d2af3aed37255d4955f59d484c2c965b165d179812213e3bf286d7198ddf4399068db366ed126d59ff6
SSDEEP 384:neCcmyWCT8NrUKA8I7B54LEKLy2JX5Q/5+f8IXGF4ahNQHx6m45AOe4KV8p0NLS:dcpTqATaNyQw4LqhNmx6m45AOI8p0NLS
TLSH
T11DB26B3EAC696C7F489E770C604E25278C74613BD3B88AA9E7DC4B0CC07B558F346925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

6f3f7e47-1693-4c0b-b5fe-f39d3d585535.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f3f7e47-1693-4c0b-b5fe-f39d3d585535.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 b07a988f6371a745e8902eabb027907ef58b8e4f90f50ccbbb3b413e20a07100
MD5 20f74edb3210914de8e7de8330aef7a2
SHA1 b2188c8a3a086af06e7c62ba627d2146c15cf1ea
SHA512 4ea6a42c4cda88ba5d87e52462fb8660f6d2ff4afa38fd9e8d89d9ff7a9bd76789d50db0b87fc47118ab77b663be2d11d468dc5e5280ed167aa886896d9c288c
SSDEEP 24:TLr4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwr0KfLe:TI/IHRH34kWqB1kQnjhHmr6ITmU0Le
TLSH
T11423896EDA2CBAA2FEE40B3DD7D1D4127B35AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11614494-9e04-40ca-8540-2c6b76ab14e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\11614494-9e04-40ca-8540-2c6b76ab14e0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

507d86e8-1bbb-4d20-a13c-446284da69fc.tmp

Path C:\Users\Admin\AppData\Local\Temp\507d86e8-1bbb-4d20-a13c-446284da69fc.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES7858.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7858.tmp
Size 1KB
SHA256 425022a2a0a172e1015d57504e60f032cbff9a05a5fcd28179b039756f047f17
MD5 e23c1203f9a7cb6e9d24c7e7c702bef1
SHA1 3c9c902fd8060657d7a49bb05fa5aa701fe59337
SHA512 45a976885f7fc12291c27ec0a6fd0549050d4e8d637b4a013e7402495a51f10ffd9c64728aa07a1d2d393145645404f6816abe827e6e500168f56ac2df2f4d22
TLSH
T13021890557FC470EF0B75B31AAFA176BA278FD51DF61535A858042282C51504EFB1AB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fjxkvwd2.hio.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjxkvwd2.hio.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

moo2mwak.dll

Path C:\Users\Admin\AppData\Local\Temp\moo2mwak\moo2mwak.dll
Size 3KB
SHA256 63869b011419ca9dcde357ad63de387cc63ff4a62cfc5fa146ac5fff0164b70d
MD5 eb27d61b80bc79dc2a5c0f0e08b6be63
SHA1 75885d40988a59c3a02c63f3b72ffe28ca236b13
SHA512 6da115d47c948005cbca13f4658d7f410763e4872cf0e32d363e1c05891ded29e7027a20224d86b5998531c61e1749da6f089da1f38aae84bc56f1e272641b86
TLSH
T12B51EB1667E84A6BE47707346EF3072637B8FC509F73675E08804218AC647545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4560_1437082963\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6b391e3-3475-4baf-8b5d-3f44d67fb59a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4560_1437082963\b6b391e3-3475-4baf-8b5d-3f44d67fb59a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\javaw.exe:Zone.Identifier
Size 271B
SHA256 bdbaee1fdd0b57aab9136e1772d6b67bd32de24240294506491acf0f322f9dec
MD5 ef00ba4f43e334a9ce5e78ee92e63174
SHA1 36233fc67516bb2ae261ac1c0c5f6e2cb2c5c6b9
SHA512 388b1cb7f91e84155898a33ae0eb8822489fb36e743f9472f2a8b869128c1a78298e959814ddab692fa6ee29b727058add102cb8562fd9cce2b66f0c8c6c0919
TLSH
T14ED0EBEBCA20380E0A5072893009C02D912CEC389CB41074DC804368CAE138229F2317
MD5 SHA1 SHA512 TLSH

Submit Download

CSC418B2D3EE7D4404A8ED76257B724A55.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\moo2mwak\CSC418B2D3EE7D4404A8ED76257B724A55.TMP
Size 652B
SHA256 96e3d9080d28006daa5ae8bbaa8f4d3a40c4c8200af0198f8131da92c019a931
MD5 45f4c0c913f3020c6c0f5fec2dba5596
SHA1 6c38c75a8715798b10e982f34f2dfeb7893d2fc4
SHA512 073457471b42ea986770023829d16fbea5793dc23b562816ac349a2924270e4918e5e4aa4a5b7c3a65538259c9a5ffa7a7a91ae8a9529badad951aeff216288a
TLSH
T14FF03A4A73FC020AF0F74B30BAF643A391A8BC64DE7293ED1484031D28649109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

moo2mwak.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\moo2mwak\moo2mwak.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

moo2mwak.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\moo2mwak\moo2mwak.cmdline
Size 369B
SHA256 6573defc9775ac1ed29e2963d05894452edc93434e70c5e7378934b89628e357
MD5 4908d5dd76d72e2e54c53fac66b4b98c
SHA1 1ca69fb252e10dad2683f5b6b25a13b7d7234c56
SHA512 b6e8c7e522087f3d5eede8b4891ff3ff06aa1a272064128e5ae204996e820e476083b47c7645a3b9c286f55886d9e25757f729111012fc4e3b9cab82b7f5d101
TLSH
T1BEE0C03A66C7C27F0BFD500731A9C4ADC772074339403FCC5240440DD1170402BE1749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-164-0x000002C7D8760000-0x000002C7D884A000-memory.dmp

Download

memory/752-480-0x000002118F200000-0x000002118F2EA000-memory.dmp

Download

memory/916-1278-0x0000019F867F0000-0x0000019F867FC000-memory.dmp

Download

memory/2340-1282-0x0000019C46120000-0x0000019C4612C000-memory.dmp

Download

memory/2340-1281-0x0000019C46100000-0x0000019C46108000-memory.dmp

Download

memory/4348-1284-0x0000019FEF720000-0x0000019FEF728000-memory.dmp

Download

memory/4348-1288-0x0000019FEF2C0000-0x0000019FEF2C8000-memory.dmp

Download

memory/4348-1268-0x0000019FF03F0000-0x0000019FF0918000-memory.dmp

Download

memory/4348-1267-0x0000019FEFCF0000-0x0000019FEFEB2000-memory.dmp

Download

memory/4348-1266-0x0000019FEF730000-0x0000019FEF752000-memory.dmp

Download

memory/4348-1287-0x0000019FED740000-0x0000019FED74C000-memory.dmp

Download

memory/4348-1289-0x0000019FEF5A0000-0x0000019FEF68A000-memory.dmp

Download

memory/4348-1290-0x0000019FEF2F0000-0x0000019FEF302000-memory.dmp

Download