darkcomet | hxxps://dosya[.]co/1el0yunvgzhb/discord_token_chechker[.]exe[.]html

Analysis

user interaction
yes
max time kernel
47s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/1el0yunvgzhb/discord_token_chechker.exe.html
Sample260718-d6mr2ae13p

Score

10^/10

sazan defense_evasion discovery execution darkcomet rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

onpk7ihvz8.localto.net:6055

Mutex

DC_MUTEX-XY00E3Y

Attributes

gencode
pCoFhfVKdbbe
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
182	4092	msedge.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4100	attrib.exe
2708	attrib.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001e4e9-290.dat	upx
behavioral1/memory/4568-305-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/4568-316-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/4568-352-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3284	cmd.exe
1056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	discord token chechker.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288194543215630"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3613F3E3-22CC-4294-A0C9-2921420515F8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4568	discord token chechker.exe
Token: SeSecurityPrivilege	4568	discord token chechker.exe
Token: SeTakeOwnershipPrivilege	4568	discord token chechker.exe
Token: SeLoadDriverPrivilege	4568	discord token chechker.exe
Token: SeSystemProfilePrivilege	4568	discord token chechker.exe
Token: SeSystemtimePrivilege	4568	discord token chechker.exe
Token: SeProfSingleProcessPrivilege	4568	discord token chechker.exe
Token: SeIncBasePriorityPrivilege	4568	discord token chechker.exe
Token: SeCreatePagefilePrivilege	4568	discord token chechker.exe
Token: SeBackupPrivilege	4568	discord token chechker.exe
Token: SeRestorePrivilege	4568	discord token chechker.exe
Token: SeShutdownPrivilege	4568	discord token chechker.exe
Token: SeDebugPrivilege	4568	discord token chechker.exe
Token: SeSystemEnvironmentPrivilege	4568	discord token chechker.exe
Token: SeChangeNotifyPrivilege	4568	discord token chechker.exe
Token: SeRemoteShutdownPrivilege	4568	discord token chechker.exe
Token: SeUndockPrivilege	4568	discord token chechker.exe
Token: SeManageVolumePrivilege	4568	discord token chechker.exe
Token: SeImpersonatePrivilege	4568	discord token chechker.exe
Token: SeCreateGlobalPrivilege	4568	discord token chechker.exe
Token: 33	4568	discord token chechker.exe
Token: 34	4568	discord token chechker.exe
Token: 35	4568	discord token chechker.exe
Token: 36	4568	discord token chechker.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4568	discord token chechker.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4112	1876	msedge.exe	85
PID 1876 wrote to memory of 4092	1876	msedge.exe	86
PID 1876 wrote to memory of 1248	1876	msedge.exe	87
PID 1876 wrote to memory of 1248	1876	msedge.exe	87
PID 1876 wrote to memory of 1248	1876	msedge.exe	87
PID 1876 wrote to memory of 1472	1876	msedge.exe	88
PID 1876 wrote to memory of 1472	1876	msedge.exe	88
PID 1876 wrote to memory of 2228	1876	msedge.exe	89
PID 1876 wrote to memory of 2228	1876	msedge.exe	89
PID 1876 wrote to memory of 1172	1876	msedge.exe	90
PID 1876 wrote to memory of 2228	1876	msedge.exe	89
PID 1876 wrote to memory of 1172	1876	msedge.exe	90
PID 1876 wrote to memory of 1172	1876	msedge.exe	90
PID 1876 wrote to memory of 4940	1876	msedge.exe	91
PID 1876 wrote to memory of 3884	1876	msedge.exe	92
PID 1876 wrote to memory of 4940	1876	msedge.exe	91
PID 1876 wrote to memory of 4940	1876	msedge.exe	91
PID 1876 wrote to memory of 3884	1876	msedge.exe	92
PID 1876 wrote to memory of 3884	1876	msedge.exe	92
PID 1876 wrote to memory of 516	1876	msedge.exe	97
PID 1876 wrote to memory of 3792	1876	msedge.exe	98
PID 1876 wrote to memory of 516	1876	msedge.exe	97
PID 1876 wrote to memory of 3792	1876	msedge.exe	98
PID 1876 wrote to memory of 2168	1876	msedge.exe	100
PID 1876 wrote to memory of 1656	1876	msedge.exe	101
PID 1876 wrote to memory of 1656	1876	msedge.exe	101
PID 1876 wrote to memory of 1656	1876	msedge.exe	101
PID 1876 wrote to memory of 2064	1876	msedge.exe	103
PID 1876 wrote to memory of 2064	1876	msedge.exe	103
PID 1876 wrote to memory of 2064	1876	msedge.exe	103
PID 1876 wrote to memory of 1008	1876	msedge.exe	104
PID 1876 wrote to memory of 1008	1876	msedge.exe	104
PID 1876 wrote to memory of 5116	1876	msedge.exe	105
PID 1876 wrote to memory of 5116	1876	msedge.exe	105
PID 1876 wrote to memory of 5116	1876	msedge.exe	105
PID 1876 wrote to memory of 1676	1876	msedge.exe	106
PID 1876 wrote to memory of 552	1876	msedge.exe	107
PID 1876 wrote to memory of 552	1876	msedge.exe	107
PID 1876 wrote to memory of 552	1876	msedge.exe	107
PID 4568 wrote to memory of 3284	4568	discord token chechker.exe	111
PID 4568 wrote to memory of 1056	4568	discord token chechker.exe	113
PID 4568 wrote to memory of 4260	4568	discord token chechker.exe	114
PID 4568 wrote to memory of 4260	4568	discord token chechker.exe	114
PID 3284 wrote to memory of 4100	3284	cmd.exe	116
PID 1056 wrote to memory of 2708	1056	cmd.exe	117
PID 1876 wrote to memory of 1632	1876	msedge.exe	120
PID 1876 wrote to memory of 1424	1876	msedge.exe	121
PID 1876 wrote to memory of 836	1876	msedge.exe	122

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4100	attrib.exe
2708	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/1el0yunvgzhb/discord_token_chechker.exe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x260,0x7fff0ed9c188,0x7fff0ed9c194,0x7fff0ed9c1a0
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5929542102216385974,15892995866180522453,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13823580963964228062,3536679123873565258,262144 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10903892574658188603,11227795348738410244,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,10408977307450706987,17048582455810274805,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3179303620611335412,5391377204305157334,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2892487316807810692,6608312867864892192,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17241605128411478578,282302273004497123,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4515598982803082722,9942871955835502257,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13317726636506785660,7078186838080287148,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13475814457070138662,6001740250048540181,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13475814457070138662,6001740250048540181,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,3756972492830605101,2129756275176814080,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3612,i,15968559399590880484,16239088044484969717,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,11278638222199196111,1331753784763011408,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5040,i,12781150111510510437,8122446446549725061,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,4839267310701607508,14716228086941235343,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3560,i,9232369432722976950,4777293620500826714,2097152 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,8772850220707169978,6530248023522739707,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,948870209085271528,7458256233803886919,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2625967047815403164,8311243658988983275,524288 --field-trial-handle=2220,i,2287702693603938980,2642067053979118917,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
  2⤵
  PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

C:\Users\Admin\Desktop\discord token chechker.exe
"C:\Users\Admin\Desktop\discord token chechker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop\discord token chechker.exe" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop\discord token chechker.exe" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Desktop" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2708
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffb80f924756ff258f2e863140212ddfb070eb327439f28cfdfae44913a8719f
MD5 78ce4f12c1099305d14136a7f32948df
SHA1 3203c0a58db07e59566580f6b9f710239dd9ef5b
SHA512 14f862f33d11a22c07c468a0e13b003f57ce826990b3ee51b5967c296ebbf06c4fc7382fbb02a8dfa5b0ffdc2396140ef737ea8c5b894e02cdad08da9298c114
TLSH
T1818171F446A314C5FB210239B3F2364031B145A608DFEE2A784B7FF869C27EA6151A5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589788.TMP
Size 3KB
SHA256 04bcdcfa6024bae9bd74a9259555ee3efa7bb1c32f5408bb70288e679d7e4a0f
MD5 8a33b103a13afdf957acffd56def820e
SHA1 0821d3facc18e4185092746a625972cc035ca7ff
SHA512 22bdb1f4cc2a50e456ea30bd43c9d2e050c36ddc21917d54813dde6436dc860cb78ab652717a715e1da13a1f6bb444a0edd09d23fa12accc153e3e42d8c45f99
TLSH
T11F614DB90A6315C4F3210638F3F1721475B14598099FEE1A38177FF465C1BBE6115A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6cd825e716c5f0a47fb19bacb52c08b4a905cd483698adb62f69ae34983e8ef3
MD5 4f75ad02173cb7f806b9757377d5c27b
SHA1 2a6185f5e7981b81333624246b9c4ab79eccb89a
SHA512 0364d4659d7520cc2646c557c7c5212b42b99ce58f7ac2c4bbaab0a96bc7c56eb90a0fab07620c3629072fcbf2a8bdc2f6463d77fb423b3df55f84e5c3d09296
SSDEEP 192:sxZ/RiyM/jK1Ml8M9BJ/fusILzAHIdpRlpHW6+WNIUGI/YHZcu+IgU7J:sxZ/E1BJ/fusILzAIlHbWI/7UN
TLSH
T13752F9166A349977CCCBD209F9857F93D6F54473A3940E44AAFCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e0da693233327dd4dbab3516b64806982817dfd8472cc03ef3275c2964759ab2
MD5 e655a47ca91b4d5e3ebd27224988e568
SHA1 2b213cc0a7ec71fdf4f1b0ec9a51c61d965acd16
SHA512 f1228c20a22ca9bded7b721731d8d5b70e32e80689a8093a8336864b89d7e47ee540bb96c0bb561afec37d4a940a82c4590e94e37d7bed342462fc4780a4074b
SSDEEP 192:sxZ/RiyM/jK1Ml8MTBJ/fusJLzAHIdpRlpHW6+WNIu9XYH3cu+Ig507J:sxZ/EbBJ/fusJLzAIlHbjXpCN
TLSH
T1A452D816AA345977CCCBD209F9857F53D6F54472A3940E44AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4a587b00f5d7f91a585c12852be4c274d866ce92b0696cf278616d9ea172d77c
MD5 c4d16af84213c420344e89e689573745
SHA1 6bd55488a75e36b652f6c9074e09eb3c478aa437
SHA512 e95f4c7410bd7cf6e0ea8809b705867dd531c86820920c54f2e2fd252be07989cd3d72507ee81a987e55751b12011ad6bbf89eeef2c66d2397e12f901b82ab08
SSDEEP 96:KA1eK2AEsIKZSi6cgKNiOvaKAsWje9+cK/qQ:E2PncJjeyz
TLSH
T109D10A4670FA16023C3D2A0883649757CE92F1A3301CE96B7BAC55B14E66E249DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec6f8b93-c3ad-4380-bd48-f415085b3635.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec6f8b93-c3ad-4380-bd48-f415085b3635.tmp
Size 30KB
SHA256 a761e184acb48631d76d64d3883da460057737fd1feda02bed3ba18d3d1bd80b
MD5 c6bba29ab9fe40557681567729f4305f
SHA1 f4a92cd513309deced93d72caf807d58c9ce7501
SHA512 dfad1f19c36194726a65651566e70198e7ce25949458abecb235301fc678f9936d590c13a818bb2355ddd4a9f2f92447ff03c09abf78bd2aef0b7a083172aa0e
SSDEEP 768:PuUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RkroV10n:PuUZYTMWvg09ou1ja7eLZmRv4n
TLSH
T1D1E20A2F280CCB7E4F844E9DEC2A6F963ED801CB5A584D544BEA894C03CB7EB511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 550690f3228298851882816588c32a60137caf7413f173686cc5a9a5c9d7d867
MD5 2cfa7fb14b872625561cadf6be17af14
SHA1 8423d80b9acb648fc195eac3976052e55f708746
SHA512 11e2a39022fa4bb24270345ed826ef77f68ec95cb3917f9d274be709c1135fa69edb479a9f6f63cc19d3cf3ed9e138a2101a741e7987ddbab955af372defa58d
SSDEEP 192:yONJ61VWQmiUyqbgGX5Obd+jIjzorynm2k/aR3oDLU6:yONJ6WXgGX5od+08y9zWDLU6
TLSH
T17602E83568687CBB9EE2BE49B48737135FE42167EA552F84D6E81B1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 448d16927678523b1254f882ee64594cb174cb626af7e0ca588802beb43709fb
MD5 8f93f62d096d8997625ad6b1a7392cf2
SHA1 582842717f3b4793864aaba6e280b965b2063a87
SHA512 1416bdbe401d9c9e7a9a5ef79186775e575c59c3a54a22103e7ecfe57b78ee22ca0dacc25f2048a2ee64425fdd6f020969e94ebf658357041ed50e2762ee4d56
SSDEEP 384:PtNn/s3n9SMsNomc/VEKzZrJWzX5od+08y91XcNsCIOObjI9G6w7Z:Pj+9DFKOrdCI29MZ
TLSH
T18B928E32A8286D675DE39195F44B36179FF451ABD7842FC4C2ECAF1C01DF6AC0316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4aded9c46fcbba43ba3d32b76e52a8cadd3bc88a8b08735a2573e0a75fcae818
MD5 7411a694ac571976d0348929fbf17766
SHA1 7334f021ea770b071a09df6001d7779f37298e04
SHA512 dcd2c9894e52617ead41cce51fbf4302103324bb444eaa377e94281085144354a3abc90a7ff1fe98c8208e7ead4861c8c63ead3eafc25b0480d8ce3ab70b896b
SSDEEP 192:eONJ613WQmiUyZUbCGX5Obd+jIjzorynm21XaDffjJPqpVU6:eONJ6MYoCGX5od+08y91Xc9IU6
TLSH
T160120A36A468BC675DE2B585B48732136FE55167EB886FC0D2EC2B1C01DF69C131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ccba9add14581ca6df00fc2c9bd7339971ec6c6cb3b751fd2aa570d571873d81
MD5 9d6bd67d363c9b591223a08ba6b13670
SHA1 0bb4d689e76afe6e61b8e4abdaf34c55ca3763a9
SHA512 a9a9f83ea0d4d1125a85f38ea220650996ed84f8cfb9f11fc4fb7ac13d8a4542ff3091099beb98add0436c269c310b479e3c8abfee2ffb8d6d09dd84b4bec7c7
SSDEEP 384:gtNn/s3n9SfsNo6c/VEKzkKrJWzX5od+08y91XcNsCIOObjI9G6w7Z:gj+9UNKOrdCI29MZ
TLSH
T162928D32A8286D675DE3A195F44B36179FF452BBD7842FC482ECAF1C01DF6AC0316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 00bb922a260f357b135bd3eb4eb621ef099ad330094eab2f8ed24436b0a5866a
MD5 68cac49921dc2794943dba067f419863
SHA1 979af794a006f72b39ee32ab734293632e0b63b7
SHA512 5958ec0d2c03e5a26257a4ffb570a2630708b458e82ad6de61a37f64b01f995d2ea8b1814f3266d9e3477bd57d002e7c016ea1ca5723b913b5dc79d4dba13db2
SSDEEP 384:xtNn/s3n9SMsNomc/VEKzZrJWzX5od+08y91XcNsCIOObjI9G6w7Z:xj+9DFKOrdCI29MZ
TLSH
T174928D32A828AD675DE39195F44B3A179FF451ABD7882FC4C2ECAF1C01DF6AC0316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41da010f8be2a997e555016adf80578ab3a6a8f9560a4553fbb78f0f3f04278c
MD5 bf363254ea2e5338eae39241bc261b31
SHA1 b0e206af814c4f4016d33a340bff6d2bc68c443d
SHA512 afbba74f7a63fc15ac5c610c4b85d47e418fadd2180fc64abbe4a0b34bafc9d9fea4293f6c59504362603d5950b20c3d2b8b5834c18d2d4be2c6b92ffeeaf205
TLSH
T114413658B6ED0148B3B76F5AAFF2A86E487B7D372E06D45E00010D4F0666E40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

discord token chechker.exe.crdownload

Path C:\Users\Admin\Downloads\discord token chechker.exe.crdownload
Size 251KB
SHA256 38ad9b4c0e07da39cd5969c14288624fd0e1e4a8ea0388b279e3c4cdbc7e30f7
MD5 ab74a93cebb47b663b0bf7b0bd735142
SHA1 168f3d5b06b5f145c9f08bfd703b1d8373a31d37
SHA512 cb5120f127840efdb7831f708bc5690ac5681842e28abfe882abc4956738324608bcc9d126e2b1b89a53ebf5905b43a7b582e7b0ddf6578b894af5ae950a20b0
SSDEEP 6144:/cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:/cW7KEZlPzCy37
TLSH
T1DA4422A5BFC5AC83EAFDAEFC065D4B04570433EB1AEE83919F21034871A6A56075363D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-306-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/4568-305-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4568-316-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4568-352-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads