hxxps://cdn[.]discordapp[.]com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0[.]9[.]9[.]1[.]jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
191s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0.9.9.1.jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&
Sample261020-qyzsvaav4y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{8B475570-897B-456C-977C-80CFECC839C6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5296	powershell.exe
5296	powershell.exe
5296	powershell.exe
5384	msedge.exe
5384	msedge.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3996	7zFM.exe
5056	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeRestorePrivilege	3996	7zFM.exe
Token: 35	3996	7zFM.exe
Token: SeDebugPrivilege	2440	powershell.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
3996	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SetWindowsHookEx 63 IoCs

pid	Process
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4004	368	msedge.exe	84
PID 368 wrote to memory of 2888	368	msedge.exe	86
PID 368 wrote to memory of 2052	368	msedge.exe	87
PID 368 wrote to memory of 4460	368	msedge.exe	88
PID 368 wrote to memory of 2052	368	msedge.exe	87
PID 368 wrote to memory of 2052	368	msedge.exe	87
PID 368 wrote to memory of 4460	368	msedge.exe	88
PID 368 wrote to memory of 4420	368	msedge.exe	89
PID 368 wrote to memory of 4420	368	msedge.exe	89
PID 368 wrote to memory of 3924	368	msedge.exe	90
PID 368 wrote to memory of 4420	368	msedge.exe	89
PID 368 wrote to memory of 3924	368	msedge.exe	90
PID 368 wrote to memory of 3924	368	msedge.exe	90
PID 368 wrote to memory of 4836	368	msedge.exe	91
PID 368 wrote to memory of 4836	368	msedge.exe	91
PID 368 wrote to memory of 4836	368	msedge.exe	91
PID 368 wrote to memory of 452	368	msedge.exe	92
PID 368 wrote to memory of 452	368	msedge.exe	92
PID 368 wrote to memory of 452	368	msedge.exe	92
PID 368 wrote to memory of 1640	368	msedge.exe	96
PID 368 wrote to memory of 1640	368	msedge.exe	96
PID 368 wrote to memory of 3996	368	msedge.exe	97
PID 368 wrote to memory of 3996	368	msedge.exe	97
PID 368 wrote to memory of 3352	368	msedge.exe	98
PID 368 wrote to memory of 3352	368	msedge.exe	98
PID 368 wrote to memory of 4184	368	msedge.exe	99
PID 368 wrote to memory of 4184	368	msedge.exe	99
PID 368 wrote to memory of 4184	368	msedge.exe	99
PID 368 wrote to memory of 1824	368	msedge.exe	101
PID 368 wrote to memory of 5112	368	msedge.exe	102
PID 368 wrote to memory of 1704	368	msedge.exe	112
PID 368 wrote to memory of 3852	368	msedge.exe	113
PID 368 wrote to memory of 4040	368	msedge.exe	114
PID 368 wrote to memory of 5888	368	msedge.exe	123
PID 368 wrote to memory of 5888	368	msedge.exe	123
PID 368 wrote to memory of 5384	368	msedge.exe	125
PID 368 wrote to memory of 3224	368	msedge.exe	129
PID 368 wrote to memory of 3224	368	msedge.exe	129
PID 368 wrote to memory of 6100	368	msedge.exe	130
PID 368 wrote to memory of 6100	368	msedge.exe	130
PID 368 wrote to memory of 6128	368	msedge.exe	131
PID 368 wrote to memory of 6128	368	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0.9.9.1.jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffac5bdc188,0x7ffac5bdc194,0x7ffac5bdc1a0
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,10642801371695808903,8209559850524405916,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1737138110429708878,7641323173404800787,262144 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,7413423223937776736,17769520808668045387,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12369236145555109649,10833350419299603754,2097152 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5911410723197980801,13587344356287129470,2097152 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5437003064797168830,9100405735674362313,2097152 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,10280621433511547418,18163745089519810823,2097152 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,3716041754776848022,12203026078904339019,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,13916558258868830625,5827676845626524656,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12026052644777730873,18307228628977573682,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5712,i,8765745715572447061,101656277661848235,2097152 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1054206195641394140,2966525582680561737,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,13204189619923628288,12804800548524625866,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1054206195641394140,2966525582680561737,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,8958878670444998685,10850025931569809004,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,18025232709310824060,14118900586170310562,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,15035048248065683182,17533248022551240524,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,14645700930943819183,11227849191627760155,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,4959558602150667944,2528664583438347022,262144 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,4407726940443862768,9117811232779015282,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,2337295916419964535,15725258825881778315,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,7256775924247315864,13211660010950525599,524288 --field-trial-handle=3016,i,13195043715089412064,5485217645512383603,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723
MD5 06d16fea6ab505097d16fcaa32949d47
SHA1 0c1c719831fa41cd102d0d72d61c0f46ec5b8de8
SHA512 03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a
TLSH
T17961FF313275B1D4C9567F071A2819C053BF8396EA94AF5CB25C621EDD2641BDF122F3
MD5 SHA1 SHA512 TLSH

Submit Download

0a98d9c6-c432-4554-8515-9b5c5c03709f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a98d9c6-c432-4554-8515-9b5c5c03709f.tmp
Size 11KB
SHA256 2f5bdb015e18bbba74356a9976443a58c4db9604c67aae9732d60f75f756bc75
MD5 643b7a4e3b858608848bb3d0a2f2f3ed
SHA1 00ccc357777d118714198ec104aa74c0b9bdfc94
SHA512 5741a343b58644a50961a9072b62643da08f6d36f263c8766fcdf53f67a4ebdfa360a3f6f6ab3e88da417575e7b14847acf8439b369dc6fb60898e130cc2e034
SSDEEP 192:uix0sN9Y9QDZGdnaw1Z8Hphvwt6QmiU1ljMa4BGYX59ezvCnyRWNdeiD8kH1TCrn:P0sN9o4Zgt8J5VMFBGYX5EOFNrDhTIUm
TLSH
T1FE421A35ACB8AC7B0DE3A551B44B36135FA4512BABC92F94D6ED5F1C00DB2DC130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a13a914-8a61-48bb-aaf0-70d33339f101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a13a914-8a61-48bb-aaf0-70d33339f101.tmp
Size 8KB
SHA256 d0e7b6b183f4eca9db9560acf4fa740dff6fddca65f8344e8ee60ea03d84d93e
MD5 fddc3ac82a2f66c61ecda4ca9a3afff8
SHA1 05120faa407902135ff7094cdac94fbc69f2baa9
SHA512 dcd1a22e703ff8cc8c2a37067e154669e002e553309763b58292a82deb334fe3482af4ae7b8f8c349307a50ad838fea85a4c895b7b2bea4401de97b43f3da8bb
SSDEEP 192:eONg6DphjqQmiUyhKA3wGYX59ezvCnyRWNdei2kIITCrq5eU6:eONg61Ui3wGYX5EOFNrvTIU6
TLSH
T171120935A8B8BC7B0DD3A951F48B35035FA4512BEB897F50D6ED2E1C00DF59C130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

387a94b1-4194-43e6-b7fa-f80303230cb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\387a94b1-4194-43e6-b7fa-f80303230cb3.tmp
Size 14KB
SHA256 fb2d1f1b6a042b1ba940b9c46afce51ba98332c3bdb495132f68a585a12c5e50
MD5 d77b82e8eb75b6f5f8bef342d4be7c16
SHA1 14e9f656c763f5705dc9fd926b36384d3b80b5c4
SHA512 76104a05daf3ccd250d8c4dd0d5d8b955e5535c16da2cc3fc626a30c6a139e076da6a9cae98bc30963f342a78876a7c1bf8a3fb11583102a6a8995c5a2369cb3
SSDEEP 384:UiFLlJsNo8TUNTUlIlo4Zgt8J5VMFBGYX5EOFNrN4TIUI:vFPfwgzOuJoXGYuOFcMUI
TLSH
T17562083298A8E87B5DE79A80F94A36139FF44167DA85AF94E3DD5D0C00DB1DC130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53505684-77c9-4889-9c94-d2ea0b141880.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53505684-77c9-4889-9c94-d2ea0b141880.tmp
Size 12KB
SHA256 7e5fa29980810ec44e5f32b02074cb034d63141111e8ae9d2e630e16357e6058
MD5 f3991d542a430d7fb076ed4bd45007f9
SHA1 4b735096989a12993a42838204ef70f8cad31c03
SHA512 e7065567bb343aeb9f9ce0e523bb8b975a198d6fd97192478a4a052c0f209e6b5382227d7d3cf019d1859c110c40e9979b84c77c9f14e1c3a217079f77060b43
SSDEEP 384:olJsN9o4Zgt8J5VMFBGYX5EOFNruhTIUI:4kOuJoXGYuOFkMUI
TLSH
T180421A35A8B8AC7B4CE39550B54B36039FA4512BEBC96F54D6ED5F1C00DB2DC130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54ac64c3-6acf-4770-8361-851a4944d4b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54ac64c3-6acf-4770-8361-851a4944d4b0.tmp
Size 14KB
SHA256 75b4771fe759e2b4b8919d938623db717e06eaa6429a8e94566daf6becfcdb22
MD5 4a1977d1255edd010391f4fdc5a1b6c2
SHA1 0e77b7c4f9b4f178387b8cecd32beba904ac49f4
SHA512 be48066a50c9fa4c9a651ffa91daf0cccfc6c7b59f95f63da8a1f5888d7c4d505ae3dd772a0d537504bac017c2c78912c3b3e2a5f3fb917347ba9d9b03017855
SSDEEP 384:UiFLlJsN98TUNTUlIRo7Zgt8J5VMFBGYX5EOFNrN4TIUI:vFPAwgOOuJoXGYuOFcMUI
TLSH
T1D66209329CA8D87B5DE79A80F98A36039FF44127DA85AF94E3DD5D0C00DB1DC130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f23d23a-730c-483c-b058-b1057440dad8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f23d23a-730c-483c-b058-b1057440dad8.tmp
Size 14KB
SHA256 f5a60cf4266d2202f201054ab01fa735a4a5826cca4945403867033080da2aca
MD5 ce4ba5b2db9ded57b686cc761d22e5eb
SHA1 16e28f86f09ce8741f42e1badbf85c181a6d22e3
SHA512 fd8fc56d9501f6cad951fee410c45f486daddebd6fe96fb5d4f5ecbef313949b7a816f0f926d860e58a781988d5c661582af8c3b26ddf7ee719e5ddebfab3632
SSDEEP 384:UiFLlJsNH8TUNTUlIlo4Zgt8J5VMFBGYX5EOFNr3qTIUI:vFPqwgzOuJoXGYuOFMMUI
TLSH
T1E36209329CA8D87B5DE79A90F94A36039FF44167DA85AF94E3DD5D0C00DB1DC130AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

330b2aae-380b-44b8-aef2-b7709f74f1f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\330b2aae-380b-44b8-aef2-b7709f74f1f2.tmp
Size 9KB
SHA256 e4b1debdb596f5db8f425a7a4f0bb6a6cbef5844c375d33bceac2994c41a3ce6
MD5 e05e1635eb94e6505be813544e3d7820
SHA1 cd8f9d997e21adb16afdab24a2d97d113a6b5763
SHA512 4b143423310dab7794e8da230210a0867e9c669050d96c4676b0f67d1090e41ba41b08d765aeef03a15945da981d861ce6f7c9dc74b42953d704522511c8339f
SSDEEP 192:sxZ5Rvnz/fAs2BIdpJHW6+WNGYgxj09bIgrJ:sxZ5xz/fAs2qJHbG29
TLSH
T15E22B6516E24A57B8CC7D20DBB69BF53E6F9503261D01E58FAFC861C08E6ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

635b0cff-1737-474e-ad79-6b91ef73f0aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\635b0cff-1737-474e-ad79-6b91ef73f0aa.tmp
Size 9KB
SHA256 e803b79c155a01ff5d0f5f70655e94e6f4307a9c8b6635754d5cbfd5907801bd
MD5 baba90f8bad36823fcc19a9859e9be7f
SHA1 45be4a32377b008ebc1b6dc4580870baa469fcb0
SHA512 a5cf9802b16517037283f6ca9fe5be25b6767f78c32b230b5a68bc63c21e163e2206b40cbe04f0a5a978408e7159701324651bfedbc98a7d4c9086aa77fbd9fb
SSDEEP 192:sxZ5Rvnz/fAslBIdpJHW6+WNGYgxj09bIg5IhJ:sxZ5xz/fAslqJHbG2yr
TLSH
T1E122A6516E34A67B8CCBD20DBB59BF53E6F9503261D11E48EAFC861C09E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e351f0a-3c2a-40c0-abf6-737a6c56bd36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e351f0a-3c2a-40c0-abf6-737a6c56bd36.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8ee86274-ee5e-41c8-8569-5cb2a8aad465.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ee86274-ee5e-41c8-8569-5cb2a8aad465.tmp
Size 27KB
SHA256 89b9167c43ebb38ec3948bd2847f7a1e75f51d7157ff3aecb5e726dcbaaf8403
MD5 8820eee0c24f62dec06a55054a982aba
SHA1 3defc23b8ae54877433fba67b11cbf38f303e224
SHA512 69dd7afad36dd71222d5cefa8649d72c15dc10eb811460e9c97f77a72e98e3735f7f2a042cf36c2dc17184b5ba89bbc3c26094f7f98a82bd66a5d67b13a2cfce
SSDEEP 768:4pichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz5roulF:4pichfPWvPZplu1jan+LKgzy+F
TLSH
T161C2EA3B640CCB7E4FC01A5DDD5A6F9B7E9802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954162d8-db93-47c0-b765-8d4d8fe68b0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\954162d8-db93-47c0-b765-8d4d8fe68b0b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 01eaae7ed0e8bccdec239832509a651af1d32e39da6af09d88c55bab7b9860cd
MD5 1a51e073fce841d944befaf1e0cd1184
SHA1 e84bfc38f4a3fdef569d57b042d96a6392785482
SHA512 48829ffbdf1bb3fc8abaab5efc1dd2f5358c1e7f065fc272b59d94db61b7ac5d66736c425e299c8dc9ce0e8d224a7292f8501be2f33d79d71fc5dd32061e270f
TLSH
T19AE026A90AC8D22EE318645B0168EB4C8BB0271E92D66A4E3B12D9C872051C4F6E26D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 179eecddb50ee9f9856368b82fcdf6e2e7162850aee47b54f1227dc5d74efe6c
MD5 b3221db4819b4f9cd5297d124dea9127
SHA1 d5ffe9262899680cf026928c73cebbb1707bef20
SHA512 21fb06420dad4549608d24f6fc65a283c7621edfa649f21910b6efe5d395c58c3421186dd5e57f63ad7ed02aa3af02a5d7e0b93ee328f7dcbbf0706c5250b39c
TLSH
T1C461C6C01EB9F5A9FBF84378C5DA13A738F498B8358B1F52105BC1B9640B72559C032B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3ca5dd4d6785be9e559f0701548225c92b7c2cc9ea266373ef24b41d26c43f7
MD5 d5ad81ba3838755e06adb1205d742a78
SHA1 3711459e428c151a8d6df2f2f712865540d3188f
SHA512 b7560ccf904e9f0598e4885280023bfe7b445364971e4d7e75a99374ef1068ea939584c30ae794ad0ed5bf5100caf9060a9ae53b944464bee5937b5575895356
TLSH
T12561B5C01EBAF5A8FBF84374C5DA136738F498B8358B1F52105BC1B9641B72559C032B
MD5 SHA1 SHA512 TLSH

Submit Download

7e236a22-2e3e-4766-9069-8432014c61ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7e236a22-2e3e-4766-9069-8432014c61ad.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

ad6046e2-26fe-4f81-8b5b-d0fa6415a7c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad6046e2-26fe-4f81-8b5b-d0fa6415a7c5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

db890aae-4df5-4619-96ee-a5a53ab417f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\db890aae-4df5-4619-96ee-a5a53ab417f0.tmp
Size 1KB
SHA256 5d71fdea80dc0a5efc9a3df40eb7ef705b049c781430551c0bd794a29732d256
MD5 154c5f520c8d6656666f8a9d418f0263
SHA1 e15f9acc56ead55487c90dd880e23618377161fa
SHA512 71009576dad29a9b24c9102f03ad069d7f83a668765c86aca01536335227ba74f635eed0226c527f4d0f9f23c156a7e8738cdac972e56739617d26a2c0c7acea
TLSH
T166217BB3C7D5896EC9051AF06B24AE1BCE1D055542283D1A89E8EF6BD7E3076E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

e6811a72-e7e8-442f-9a57-61753d60122f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6811a72-e7e8-442f-9a57-61753d60122f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 13c610a3ba95e9e40372ffd7f70c371814a0259c8f4c69ff14b4eb48a76ba155
MD5 eb82c07645017b8573f262d7109be071
SHA1 3aa99b603fb22518dee04bbb2cc69996e8aeb2b1
SHA512 9823c3bfe11efb33d800f466a25757681a635da4e201fb3fd60545721fd159dac36a1246e1674ed4867fcffd5fd50485734fadb254134ecfee4e083763292629
SSDEEP 48:K0wfWaAqefbWt2ISyfK9O1UfxoPYVGu0yLVUplXD34brOrIS94K9d1P4x9oYePTY:K4HmKg4Gyq8K7qMoAKtGS9
TLSH
T1C391710032BF12113CBE2AC891A4961F465131B23599F96BBFAC56F15E2FE401DFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e298fc0e-8379-44cd-adaa-89e385c7d822.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e298fc0e-8379-44cd-adaa-89e385c7d822.tmp
Size 10KB
SHA256 e846d1ba70e79ed3d4066dbb81e11e4409545ff6c5792dbe72811b107120ef3f
MD5 a6e247ba7b2c7b781f94fe0c28780694
SHA1 6a7fc2ba4eedfcb1b58e30fa7e4c9ce106973644
SHA512 5a3f410a9335870bdd35a098b44e2de66015483c8a655925351a27d77cf97d00ebcfedf25b9f213c13ade084be6593d5027b2508c263d13583b802d626315c4c
SSDEEP 192:sxZ5Rvnz/fAsmBIdpJHW6+WNGYg9Z09bIg5IbJ:sxZ5xz/fAsmqJHbGQyt
TLSH
T11722B7516E34AA7B8CC7E20DBB55BF53E6F9503261D11E48AAFC8A1C05E67DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffe55b52-8c5e-4c49-aa7c-329902671df2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ffe55b52-8c5e-4c49-aa7c-329902671df2.tmp
Size 10KB
SHA256 9ee5ebeffa63fdbad1af67aa37c8c947fc81c49762fce838a2e9f27ad73e8f8f
MD5 7e9eafa361f9d68ab2ca9c90b75ddf54
SHA1 13e290b2d082e5615b773d008a996956e7eab9e8
SHA512 8909bcb7b0f7a6c51208340d5739db3dab6779910a282e3881249e0dcf669c0d3df5339caaebc5f432321f893b61b709c7006313484e20766791f3873091c357
SSDEEP 192:sxZ5Rvnz/fAsmBIdpLHW6+WNGYg820MbIg5IbJ:sxZ5xz/fAsmqLHbGVyt
TLSH
T16E22B7516E34AA7B8CC7E20DBA55BF53E6F9503261D11E48AAFC861C05E6BDE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d7e9a69-7f97-4518-b9a9-732328b6e933.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8d7e9a69-7f97-4518-b9a9-732328b6e933.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2ead66e-028c-4de8-98bb-62c63969466c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c2ead66e-028c-4de8-98bb-62c63969466c.tmp
Size 8KB
SHA256 af600b2bf398894ce2a24e66fc7cdf28b21c608f5e2cb67215c37bf591479adb
MD5 c367eee75c7fd8922f3ed1c953a41b09
SHA1 da77ba328361eb03c8ca9f16d59059bd1d0a3229
SHA512 128a74c44e8264c156849c8224369e759aca91f4f7d8536182a7f948b2e838c0a7eeda4d5078544a66b4a7844aaf3b7a5581da95bb9f7f56f0c6b341564808b6
SSDEEP 192:LJONs6DphmqQmiUyoAq8wGYX59ezvCnyRykk7iYU6:lONs619wRwGYX5EOHrU6
TLSH
T15102E935E8BC7C7B8DE3AE45B58B26135FE8112BAA956F44D6E81E1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0fc06d4-60f3-467b-9588-051eee15441b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0fc06d4-60f3-467b-9588-051eee15441b.tmp
Size 11KB
SHA256 90a87343e2acbd05b6734db0ddacb2f0ac76c0598f46326c2cf009a03c7ef581
MD5 3fd8ccb934bcf09c5813cfdd36f38c9b
SHA1 ba32d2aa2784b112400091ba015d871cd2e79d21
SHA512 18128f7da364794e8b45b25b40a0a95a6b5d361b64424b008490a255060ac2811c1994a680b2e55715e4b4e5297f50845c57ea65546cd4ebac8fcc9040200ca3
SSDEEP 192:uEx0sN9YGQDZGdnaw1Z8Hphvwt6QmiU1ljMa4BGYX59ezvCnyRWNdeiD8kH1TCrp:F0sN9x4Zgt8J5VMFBGYX5EOFNrDhTIU8
TLSH
T11A421935ACB8AC7B1DE39591B44B36135FA4512BABC92F94D6ED1F1C00DB2DC130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42772924-e1e0-4567-93c4-636a003ee863.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42772924-e1e0-4567-93c4-636a003ee863.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a0daac1c3a1a94fc051b48f7a8169012662ca7eac5ca534bb7c84c099cf45fc5
MD5 f83a61c4d62bb4c6a8764a958bdc3d43
SHA1 7d84e56335230780be15ea660fcb92e88f147ecf
SHA512 d2baff79298aef3d05c3fd07b09fd0364db7965c8810d49395edfebcc30b8043405c2e89e48d1738f81638e84a24ed60c753fb058400d5d6a7aafd19ef9a41e9
TLSH
T10141F858A6FA1148B3B3AE1AABF6686E447FBD771F06945D50110D8F0A27B40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 9c3684d1427049acc09b43729fc104a9c23569a554b04d9d96b454f6d295c946
MD5 ae8966832ffff59ef1168c6b5a03b1fb
SHA1 8b4f6c07f13931b5b762ac1dec0283482b2d1067
SHA512 e435ad1cb5ee7bb551f8c134032275131067a68b4b2fc4d1ebbb9f121f225890726c61d12a9d9f1252fe1d7c2b519376e1ea4757719c9cc7d2e0b274750c11a0
SSDEEP 1536:pYnC+jH04tAHk1/rMrxyNhftflJdvYoqV3CNBQkj20lUst+hOOwUp7bNvv+Epa5H:pYnC+jH04tAHk1jMrxyNhftflJdvYoqK
TLSH
T156334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 19b4156a423bcb09d97ae14bfec3ad160f543bcc49b99b1b502a5f6042554211
MD5 ee230495c718d88442eb1eba5f385ec9
SHA1 6afe720e905c402e2c63f6ad61fa5575660a83a8
SHA512 c0a75ec2ea5d6fd8e270c8fd131a6386bf24927c654e5c593fc4b7297ece9abcd903800c90566b08d789b6f366c9e8ac816d228d5b453fe0e2f57c3f6e2861c1
TLSH
T18F61EC17B3C84DD3D98D5735C09C9C2220D292974866BECEAF8F85F0621F1B5BA70164
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u04fqyya.skv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u04fqyya.skv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 105B
SHA256 0be89d9e35c92328aae98827dd0074aa8c73257663d17cb6d4dc28a217967ce4
MD5 cf33f000867e258ee1f17a1f1fdb0dfd
SHA1 be5ff2279546b3c7efb45497b37c262195eae57a
SHA512 ab1ea6c1276dd09cf5909e12c535d9f5a09c8797b5e21ad165679e3d2adb08098e7f28932da2e7750a1b4d61b3f4c206e7047afc39bc93f0a3d54485384a98a2
TLSH
T153B012CF3B74EB6B60BC21E2A42041E8C9C0C58EAE54AA700008F708F4D3427CB8F0A7
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 cffdce8986c9c3c7401cbc5007d4c0316bcbecff944ebaf8e15d4e943f99afd7
MD5 4a3be6878c324aa0227916d238476200
SHA1 12ee1b083a92eaec0f80ef9f3f9221ea6a75b15d
SHA512 c6a4987c2f71afadb6f7e025ee6c2d8eaf5d9612c68ac8d4b7189b91b6cf223e1eff48014821ddb8e3da0158c620415f3d5704199c222b4ea77742f25955999c
SSDEEP 96:oKx8+7CAB6RHFukvM3NHyKkLt9QHsCKkLt9QHsX:oKx8+76dSGt9PGt9P
TLSH
T1E0B1DC4027F64229E5F74F3EACBBA7219A76B804CD035FCF6240A5585D30224E57E72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W54LIQC3NW3MIBE0HZT3.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W54LIQC3NW3MIBE0HZT3.temp
Size 5KB
SHA256 b70d63b31b041ef989a1340f69b0aedb5f513c694939d581cb4ad3b8269246b7
MD5 510d7a635c83626189ad47ac3621ab78
SHA1 47d6808bdf3515d52e957aa011ea15960ae5532a
SHA512 7e02b8a92876124cbbd5f8e190afaf73e70f1267e438cc52f2b8bb4e0cb85c6926e0e7bb98c976d596d0676f7924f18c8480778effac7d575f872dbeebc9cbde
SSDEEP 96:X8wsCAB6RUFukvM3NHy4kLbQHsC4kLbQHsX:X8wM6iwGbFGbP
TLSH
T16DB1FE4027F64229E5F74F3AACBBA3219A76B804CD035BCF6240A15C5D70224E53E72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anubis Beta 0.9.9.1.jar

Path C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar
Size 20.2MB
SHA256 20a03c38a39d013bf5f6836818c0b665478eb3381181fd372cd661c438fd752a
MD5 e8f5e1e4a7b4ee4e99e4518c318dc1fd
SHA1 50548b8dd5e4d9a1a9cb99dda32ccb75a446650c
SHA512 40507864700fa08bee8591e96bf79a0adf1ad67eab78971a9b90116c8c16a46cfcc0446d54caf8ed79de304630dca85148303f966e1f0ca9f029f4d7a532d7ba
SSDEEP 393216:3cwzJYMAOBBwk0hVnjQ9lC4CTYVVnLslT+JjKO8zZrlAIKXHXTZhcC:pzJYMAOJ2Vjal7BBhp8zDATlhN
TLSH
T12D2733027EEDE17ED81B9772C011C1626D3421C85A0BA44FBE79078E4EE4D574B9ABEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anubis Beta 0.9.9.1.jar.crdownload

Path C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar.crdownload
Size 10.8MB
SHA256 68b715e78278b2de8bb5540e3035ae97c32d8499bdecdde01459abb7e91c1987
MD5 6fdc052150c864253f7309d3b696bed8
SHA1 12f5fd5a51b0030d82fa3fcf1bc422d3cf9ef7e0
SHA512 17719ed952fa68a26b111c8231efe790e8f7566e459536b57aa71ea4a3bdb64a6927ab417376c38e745c994c03fd1214e617d2923ad4a6efca1442d64524cb17
SSDEEP 196608:30D7cP7/C4CCeCHAO+H+BwFkj0hpjQuRjMx8INwILPfvUAC4C4DdQYs8Vok7TPTz:3cwzJYMAOBBwk0hVnjQ9lC4CTYVVnz
TLSH
T192B633A1CBD3E598E40E93F346A32B590C4505AD6A4ECE80CD2BA95E77F5F67AC37400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5296-236-0x0000022E28BB0000-0x0000022E28C26000-memory.dmp

Download

memory/5296-339-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-325-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-314-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-297-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-275-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-264-0x0000022E0F5A0000-0x0000022E10061000-memory.dmp

Download

memory/5296-235-0x0000022E28AE0000-0x0000022E28B24000-memory.dmp

Download

memory/5296-234-0x0000022E286F0000-0x0000022E28712000-memory.dmp

Download