discord-quest-completer.exePE analysis report - Suspicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
86.7sto launch
508telemetry events
212observed
74agent notes
Suspicious
61/100
26 points past the suspicious line at 35, 9 short of malicious at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+40
Runtime behavior
- 1 evasion behavior(s)
- Terminated the analysis agent (anti-analysis / defense evasion)
+21
Static analysis
- 1 suspicious signature match(es)
- Anti-debug API name(s) IsDebuggerPresent, OutputDebugString: ONE observation read by two static sources, not two findings - signature Suspicious_Anti_Debug_API matched them in the file and the Anti-debugging capability bucket read the same names from the import table; both charges kept.
- 2 high-risk capability bucket(s): Keylogging / input capture, Anti-debugging
+0
Model review
- findings review (advisory, not scored): suspicious - anti-debug checks, embedded webview profile, credential store paths touched, discord automation tool
Model reading
Measured
SUSPICIOUS61 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Other high-severity findings
- HIGH Keylogging primitive (GetAsyncKeyState)
- HIGH Terminated the analysis agent (anti-analysis / defense evasion)
Analysis layers
Static
ran
moved the score
Dynamic
ran
moved the score
Threat intel
local feeds only
no points
AI
not included
Detection signatures
29 detected · 11 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| HIGH |
Keylogging capability
MITRE T1056.001
|
capability
getasynckeystate
capability: keylogging
capability
getkeyboardstate
capability: keylogging
capability
getkeystate
capability: keylogging
capability
registerrawinputdevices
capability: keylogging
|
static |
| HIGH |
Keylogging primitive (GetAsyncKeyState)
MITRE T1056.001
|
import
user32.dll!GetAsyncKeyState
|
static |
| HIGH |
Terminated the analysis agent (anti-analysis / defense evasion)
MITRE T1562.001
|
runtime
agent terminated
observed in the guest
|
dynamic |
| MED |
Anti-VM / sandbox-detection capability
MITRE T1497
|
capability
getcursorpos
capability: anti_vm
|
static |
| MED |
Anti-debug: checks for a debugger
MITRE T1622
confirmed at runtime, seen in 60% of benign software statically
|
import
kernel32.dll!IsDebuggerPresent
|
static |
| MED |
Anti-debugging capability
MITRE T1622
confirmed at runtime, seen in 65% of benign software statically
|
capability
isdebuggerpresent
capability: anti_debug
capability
outputdebugstringa
capability: anti_debug
|
static |
| MED |
Evasion: agent termination
MITRE T1497
|
runtime
agent termination
evasion signal
|
dynamic |
| MED |
Evasion: anti debug
MITRE T1497
|
runtime
anti debug
evasion signal
|
dynamic |
| MED |
Exception-based anti-debug (SEH/VEH install)
MITRE T1622
|
import
kernel32.dll!AddVectoredExceptionHandler
|
static |
| MED |
Raw socket networking
MITRE T1095
|
import
ws2_32.dll!WSAStartup
|
static |
| MED |
Reads full keyboard state
MITRE T1056.001
|
import
user32.dll!GetKeyboardState
|
static |
| MED |
Screen capture primitive (BitBlt)
MITRE T1113
|
import
gdi32.dll!BitBlt
|
static |
| MED |
TLS callback (pre-main execution)
MITRE T1055
|
pe_header
IMAGE_DIRECTORY_ENTRY_TLS present
callbacks run before the entry point
|
static |
| LOW |
Changes the desktop wallpaper (ransom note)
MITRE T1491
seen in 8% of benign software
|
import
user32.dll!SystemParametersInfoA
|
static |
| LOW |
Cryptographic capability (packing/ransom)
MITRE T1573
seen in 6% of benign software
|
capability
bcryptgenrandom
capability: crypto
|
static |
| LOW |
Driver communication via DeviceIoControl
MITRE T1068
seen in 10% of benign software
|
import
kernel32.dll!DeviceIoControl
|
static |
| LOW |
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
|
import
kernel32.dll!GetTempPathW
requires gettemppath
import
kernel32.dll!CreateProcessW
requires createprocess
|
static |
| LOW |
Duplicates a process handle (handle theft)
MITRE T1134
seen in 10% of benign software
|
import
kernel32.dll!DuplicateHandle
|
static |
| LOW |
Enumerates windows (analysis-tool detection)
MITRE T1010
seen in 7% of benign software
|
import
user32.dll!FindWindowExW
|
static |
| LOW |
Executes via ShellExecute
MITRE T1204
seen in 12% of benign software
|
import
shell32.dll!ShellExecuteExW
|
static |
| LOW |
Hides its window (ShowWindow SW_HIDE pattern)
MITRE T1564.003
seen in 13% of benign software
|
import
user32.dll!ShowWindow
|
static |
| LOW |
Network communication capability
MITRE T1071
seen in 6% of benign software
|
capability
bind
capability: network
capability
connect
capability: network
capability
recv
capability: network
capability
send
capability: network
capability
wsastartup
capability: network
|
static |
| LOW |
Queries system information (host recon)
MITRE T1082
confirmed at runtime, seen in 25% of benign software statically
|
import
kernel32.dll!GetSystemInfo
|
static |
| LOW |
Reads the foreground window (activity monitoring)
MITRE T1113
|
import
user32.dll!GetForegroundWindow
|
static |
| LOW |
Screen-capture capability
MITRE T1113
seen in 8% of benign software
|
capability
bitblt
capability: screen_capture
capability
getdc
capability: screen_capture
|
static |
| LOW |
Sleep-based sandbox evasion
MITRE T1497.003
|
import
kernel32.dll!SleepEx
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
| LOW |
Synthesizes input (automation / evasion)
MITRE T1056
|
import
user32.dll!SendInput
|
static |
| INFO |
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
|
import
kernel32.dll!GetTempPathW
|
static |
Withheld: 11 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Dynamic API resolution (obfuscation)
fires on 65% of benign software
Anti-debug: checks for a debugger
fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Anti-debug via OutputDebugString probe
fires on 41% of benign software
WMI usage (recon / execution)
fires on 40% of benign software
Creates a named mutex (single-instance / infection marker)
fires on 31% of benign software
Executes external code / commands
fires on 30% of benign software
Writes to the registry
fires on 30% of benign software
Persistence-capable APIs present
fires on 29% of benign software
Enumerates files recursively (staging/collection)
fires on 21% of benign software
What the tests returned
8 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Persistence mechanisms | none established at runtime |
| Cross-process injection | none observed |
| Payloads written to disk | none observed |
| Network connections | the capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case |
| Behavioural rule matches (Sigma) | none observed |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
| Capability analysis of the file's code | not checked - the check ran past its time limit and was stopped |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.
Instrument coverage
3 of 4 measuredWhat this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.
| Layer | Ran | What that means |
|---|---|---|
| Runtime anti-analysis watch | measured | Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing. |
| API call sequence | measured | Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else. |
| Explicit module loads | measured | Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts. |
| Network capture | not on this plan | Not included on this scan's plan. |
| Live kernel introspection | not measured | Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop. |
This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
Microsoft Visual C/C++(19.36.35217)[C]
CompilerMicrosoft Visual C/C++(19.36.35217)[C]
LinkerMicrosoft Linker(14.36.35217)
Identity
File
typeexecutable
size16.5 MB
file arch64-bit (x64)
subsystemGUI
entropy6.4049
date2025-10-07 14:04:13 UTC
version25.10.7
descriptionDiscord Quest Completer
productDiscord Quest Completer
languageEN
Antivirus engine
no signature matched signature set 28162 - 3.6M signaturesNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
| Signature set | Value |
|---|---|
| Set version | 28162 |
| Signatures in the set | 3,642,894 |
| Set published | 23 Oct 2026 06:24 +0000 |
| Age when this file was scanned | same day |
A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.
Local ML assessment
20.0 of 100 8 strongest of 2568 featuresA gradient-boosted model running entirely on this host scored this file 20.0 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.
Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.
| Structural feature | What it means | Pushes | Weight |
|---|---|---|---|
| image flag dll | Image flag: a library rather than a program | towards malicious | +1.0503 |
| parser warning: Suspicious flags set for section... | Header defect reported by the parse: Suspicious flags set for section... (0) | towards benign | -0.9306 |
| debug directory size | Size of the debug table (84) | towards benign | -0.5870 |
| section entropy .rsrc | Byte randomness of section .rsrc | towards malicious | +0.5675 |
| basereloc directory size | Size of the basereloc table (64708) | towards benign | -0.4824 |
| optional.sizeof_code | Total size of executable code (11208192) | towards benign | -0.3469 |
| feature column 2478 | When a timestamp authority countersigned the signature | towards malicious | +0.3421 |
| debug directory address | Location of the debug table (14152480) | towards benign | -0.3289 |
A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
16/100
packer confidence
Static analysis reads this file directly
Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 2 signals
- High-entropy resource (possible packed payload)
- TLS callback present
Family configuration search
Not attemptedThe sample is 16.5 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.
| Sample size | 16.5 MB |
|---|---|
| Bound | 16.0 MB |
| Limit reached | Sample size, before any parser was loaded. |
Capabilities
13 behaviour buckets · 4 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Keylogging / input capture Hooks the keyboard or reads input state |
T1056.001 | getasynckeystate, getkeyboardstate, getkeystate, registerrawinputdevices |
| high | Anti-debugging Detects or obstructs a debugger |
T1622 | isdebuggerpresent, outputdebugstringa |
| high | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findnextfilew |
| high | Anti-VM / anti-sandbox Detects a virtual machine or analysis sandbox |
T1497.002 | getcursorpos |
| med | Network / C2 Opens sockets, HTTP or downloads payloads |
T1071, T1095 | bind, connect, recv, send, wsastartup |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress, loadlibrarya, loadlibraryexa, loadlibraryw |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497, T1497.003 | getsystemtimeasfiletime, queryperformancecounter, sleep, sleepex |
| med | Code execution Creates processes / runs commands or shellcode |
T1106, T1203 | createprocessw, createthread, shellexecuteexw |
| med | Screen capture Grabs the screen / clipboard |
T1113 | bitblt, getdc |
| med | Cryptography Uses crypto APIs (often ransomware / packers) |
T1573 | bcryptgenrandom |
| med | Persistence Survives reboot via autostart / services / tasks |
T1547.001 | regsetvalueexw |
| low | Discovery Enumerates the host, users, processes or network |
T1082 | getsysteminfo |
| low | Registry manipulation Reads / writes the registry |
T1112 | regcreatekeyexw |
Security mitigations
partial posture
ON
ASLR (DynamicBase)
ON
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
OFF
Control Flow Guard
OFF
SafeSEH
ON
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Rich header (toolchain)
richhash 52bd524a86f0b8e9| Tool | Build | Uses |
|---|---|---|
| prodid_147 | 30729 | 14 |
| Utc1900 (VS2017) | 35207 | 9 |
| Cvtres 14.10 | 35207 | 13 |
| Export 14.10 | 35207 | 47 |
| Utc1900 (VS2017) | 33140 | 5 |
| Cvtres 14.10 | 35217 | 12 |
| Import (linker) | 0 | 478 |
| Unknown | 0 | 888 |
| Implib | 35217 | 1 |
| AliasObj 14.10 | 35217 | 1 |
Sections
6 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.textEP
Executable code
|
0x1000 |
10.7 MB
|
10.7 MB
|
EXECUTEREAD
|
6.199
|
|
.rdata
Read-only data
|
0xab2000 |
5.1 MB
|
5.1 MB
|
READ
|
6.1399
|
|
.data
Initialised data
|
0xfc9000 |
12.0 KB
|
22.7 KB
|
READWRITE
|
2.3363
|
|
.pdata
Exception unwind data
|
0xfcf000 |
589.0 KB
|
589.0 KB
|
READ
|
6.587
|
|
.rsrc
Resources
|
0x1063000 |
33.0 KB
|
32.5 KB
|
READ
|
7.8527
|
|
.reloc
Base relocations
|
0x106c000 |
63.5 KB
|
63.2 KB
|
READ
|
5.4634
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
360 funcs / 22 DLLs · 17 suspicious▸kernel32.dll115 funcs 10 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| RtlVirtualUnwind | 0x00ab2328 | yes | - |
| DeleteCriticalSection | 0x00ab2330 | - | - |
| InitializeCriticalSectionAndSpinCount | 0x00ab2338 | - | - |
| CreateFileW | 0x00ab2340 | - | - |
| SetNamedPipeHandleState | 0x00ab2348 | - | - |
| lstrlenW | 0x00ab2350 | - | - |
| LoadLibraryA | 0x00ab2358 | - | T1129 |
| HeapAlloc | 0x00ab2360 | - | - |
| IsProcessorFeaturePresent | 0x00ab2368 | - | - |
| GetProcessHeap | 0x00ab2370 | - | - |
| RtlUnwindEx | 0x00ab2378 | yes | - |
| RtlPcToFileHeader | 0x00ab2380 | yes | - |
| RaiseException | 0x00ab2388 | - | - |
| SetUnhandledExceptionFilter | 0x00ab2390 | - | - |
| UnhandledExceptionFilter | 0x00ab2398 | - | - |
| IsDebuggerPresent | 0x00ab23a0 | - | T1622 |
| HeapFree | 0x00ab23a8 | - | - |
| InitializeSListHead | 0x00ab23b0 | - | - |
| GetProcAddress | 0x00ab23b8 | - | T1129 |
| SleepConditionVariableSRW | 0x00ab23c0 | - | - |
| WakeAllConditionVariable | 0x00ab23c8 | - | - |
| CreateMutexA | 0x00ab23d0 | - | T1027 |
| WaitForSingleObjectEx | 0x00ab23d8 | - | - |
| LoadLibraryW | 0x00ab23e0 | - | T1129 |
| AcquireSRWLockExclusive | 0x00ab23e8 | - | - |
| WideCharToMultiByte | 0x00ab23f0 | - | - |
| ReleaseSRWLockExclusive | 0x00ab23f8 | - | - |
| MultiByteToWideChar | 0x00ab2400 | - | - |
| GetConsoleOutputCP | 0x00ab2408 | - | - |
| CreateProcessW | 0x00ab2410 | - | T1106 |
| GetWindowsDirectoryW | 0x00ab2418 | - | - |
| GetSystemDirectoryW | 0x00ab2420 | - | - |
| GetFinalPathNameByHandleW | 0x00ab2428 | - | - |
| DeviceIoControl | 0x00ab2430 | - | - |
| CreateDirectoryW | 0x00ab2438 | - | - |
| GetFileInformationByHandleEx | 0x00ab2440 | - | - |
| FindNextFileW | 0x00ab2448 | - | T1083 |
| SetEnvironmentVariableW | 0x00ab2450 | - | - |
| GetTempPathW | 0x00ab2458 | - | - |
| GetFullPathNameW | 0x00ab2460 | - | - |
| SetWaitableTimer | 0x00ab2468 | - | - |
| CreateWaitableTimerExW | 0x00ab2470 | - | - |
| CreateThread | 0x00ab2478 | - | - |
| WaitForMultipleObjects | 0x00ab2480 | - | - |
| ReadFileEx | 0x00ab2488 | - | - |
| ExitProcess | 0x00ab2490 | - | - |
| CancelIo | 0x00ab2498 | - | - |
| LCIDToLocaleName | 0x00ab24a0 | - | - |
| GetSystemTimeAsFileTime | 0x00ab24a8 | - | - |
| GetCurrentThreadId | 0x00ab24b0 | - | - |
| ReleaseMutex | 0x00ab24b8 | - | - |
| HeapReAlloc | 0x00ab24c0 | - | - |
| CopyFileExW | 0x00ab24c8 | - | - |
| FindClose | 0x00ab24d0 | - | - |
| FindFirstFileExW | 0x00ab24d8 | - | - |
| GetFileAttributesW | 0x00ab24e0 | - | - |
| OutputDebugStringA | 0x00ab24e8 | - | T1622 |
| OutputDebugStringW | 0x00ab24f0 | - | T1622 |
| GetModuleFileNameW | 0x00ab24f8 | - | - |
| GetLastError | 0x00ab2500 | - | - |
| EncodePointer | 0x00ab2508 | - | - |
| TlsAlloc | 0x00ab2510 | - | - |
| TlsGetValue | 0x00ab2518 | - | - |
| TlsSetValue | 0x00ab2520 | - | - |
| LoadLibraryExW | 0x00ab2528 | - | - |
| GetModuleHandleW | 0x00ab2530 | - | - |
| FreeLibrary | 0x00ab2538 | - | - |
| GetEnvironmentVariableW | 0x00ab2540 | - | - |
| GetSystemTimePreciseAsFileTime | 0x00ab2548 | - | - |
| QueryPerformanceFrequency | 0x00ab2550 | - | - |
| TerminateProcess | 0x00ab2558 | - | - |
| GetUserDefaultUILanguage | 0x00ab2560 | - | - |
| WriteConsoleW | 0x00ab2568 | - | - |
| GetExitCodeProcess | 0x00ab2570 | - | - |
| SleepEx | 0x00ab2578 | - | - |
| WriteFileEx | 0x00ab2580 | - | - |
| TlsFree | 0x00ab2588 | - | - |
| GetCurrentProcessId | 0x00ab2590 | - | - |
| GetStdHandle | 0x00ab2598 | - | - |
| SetFilePointerEx | 0x00ab25a0 | - | - |
| DuplicateHandle | 0x00ab25a8 | - | - |
| GetCurrentProcess | 0x00ab25b0 | - | - |
| SetFileInformationByHandle | 0x00ab25b8 | - | - |
| GetCommandLineW | 0x00ab25c0 | - | - |
| GetEnvironmentStringsW | 0x00ab25c8 | - | - |
| GetCurrentDirectoryW | 0x00ab25d0 | - | - |
| SetLastError | 0x00ab25d8 | - | - |
| RtlLookupFunctionEntry | 0x00ab25e0 | yes | - |
| RtlCaptureContext | 0x00ab25e8 | yes | - |
| GetSystemInfo | 0x00ab25f0 | - | - |
| QueryPerformanceCounter | 0x00ab25f8 | - | T1497 |
| SwitchToThread | 0x00ab2600 | - | - |
| SetHandleInformation | 0x00ab2608 | - | - |
| GetCurrentThread | 0x00ab2610 | - | - |
| SetThreadStackGuarantee | 0x00ab2618 | - | - |
| AddVectoredExceptionHandler | 0x00ab2620 | - | - |
| CompareStringOrdinal | 0x00ab2628 | - | - |
| FreeEnvironmentStringsW | 0x00ab2630 | - | - |
| GetModuleHandleA | 0x00ab2638 | - | - |
| Sleep | 0x00ab2640 | - | - |
| GetConsoleMode | 0x00ab2648 | - | - |
| CreateIoCompletionPort | 0x00ab2650 | - | - |
| CancelIoEx | 0x00ab2658 | - | - |
| ReadFile | 0x00ab2660 | - | - |
| GetOverlappedResult | 0x00ab2668 | - | - |
| WriteFile | 0x00ab2670 | - | - |
| PostQueuedCompletionStatus | 0x00ab2678 | - | - |
| GetQueuedCompletionStatusEx | 0x00ab2680 | - | - |
| GetFileInformationByHandle | 0x00ab2688 | - | - |
| CloseHandle | 0x00ab2690 | - | - |
| FormatMessageW | 0x00ab2698 | - | - |
| WaitForSingleObject | 0x00ab26a0 | - | - |
| SetFileCompletionNotificationModes | 0x00ab26a8 | - | - |
| CreateEventW | 0x00ab26b0 | - | - |
| LoadLibraryExA | 0x00ab26b8 | - | - |
▸advapi32.dll11 funcs 1 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| RegCreateKeyExW | 0x00ab2050 | - | - |
| RegSetValueExW | 0x00ab2058 | - | T1112 |
| RegQueryValueExW | 0x00ab2060 | - | - |
| RegOpenKeyExW | 0x00ab2068 | - | - |
| SystemFunction036 | 0x00ab2070 | - | - |
| EventRegister | 0x00ab2078 | - | - |
| EventSetInformation | 0x00ab2080 | - | - |
| EventWriteTransfer | 0x00ab2088 | - | - |
| EventUnregister | 0x00ab2090 | - | - |
| RegGetValueW | 0x00ab2098 | - | - |
| RegCloseKey | 0x00ab20a0 | - | - |
▸api-ms-win-core-synch-l1-2-0.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| WakeByAddressAll | 0x00ab20b0 | - | - |
| WaitOnAddress | 0x00ab20b8 | - | - |
| WakeByAddressSingle | 0x00ab20c0 | - | - |
▸bcryptprimitives.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ProcessPrng | 0x00ab2268 | - | - |
▸SHELL32.dll9 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ordinal_190 | 0x00ab2000 | yes | - |
| ordinal_155 | 0x00ab2008 | yes | - |
| ShellExecuteExW | 0x00ab2010 | - | - |
| SHCreateItemFromParsingName | 0x00ab2018 | - | - |
| SHGetKnownFolderPath | 0x00ab2020 | - | - |
| DragQueryFileW | 0x00ab2028 | - | - |
| DragFinish | 0x00ab2030 | - | - |
| SHOpenFolderAndSelectItems | 0x00ab2038 | - | - |
| SHAppBarMessage | 0x00ab2040 | - | - |
▸ole32.dll9 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CoCreateInstance | 0x00ab2718 | - | - |
| CoTaskMemFree | 0x00ab2720 | - | - |
| CoUninitialize | 0x00ab2728 | - | - |
| CoInitializeEx | 0x00ab2730 | - | - |
| RevokeDragDrop | 0x00ab2738 | - | - |
| RegisterDragDrop | 0x00ab2740 | - | - |
| CoTaskMemAlloc | 0x00ab2748 | - | - |
| CoInitialize | 0x00ab2750 | - | - |
| OleInitialize | 0x00ab2758 | - | - |
▸user32.dll117 funcs 3 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| DestroyAcceleratorTable | 0x00ab27a0 | - | - |
| CreateMenu | 0x00ab27a8 | - | - |
| DestroyMenu | 0x00ab27b0 | - | - |
| RemoveMenu | 0x00ab27b8 | - | - |
| DrawMenuBar | 0x00ab27c0 | - | - |
| SetMenu | 0x00ab27c8 | - | - |
| DrawTextW | 0x00ab27d0 | - | - |
| GetWindowDC | 0x00ab27d8 | - | - |
| OffsetRect | 0x00ab27e0 | - | - |
| GetMenuBarInfo | 0x00ab27e8 | - | - |
| GetMenuItemInfoW | 0x00ab27f0 | - | - |
| TranslateAcceleratorW | 0x00ab27f8 | - | - |
| DestroyWindow | 0x00ab2800 | - | - |
| ToUnicodeEx | 0x00ab2808 | - | - |
| InsertMenuW | 0x00ab2810 | - | - |
| GetKeyState | 0x00ab2818 | - | T1056.001 |
| GetAsyncKeyState | 0x00ab2820 | - | T1056.001 |
| GetKeyboardState | 0x00ab2828 | - | - |
| SendInput | 0x00ab2830 | - | - |
| SetForegroundWindow | 0x00ab2838 | - | - |
| GetWindowTextW | 0x00ab2840 | - | - |
| AppendMenuW | 0x00ab2848 | - | - |
| GetWindowTextLengthW | 0x00ab2850 | - | - |
| SetWindowTextW | 0x00ab2858 | - | - |
| SetMenuItemInfoW | 0x00ab2860 | - | - |
| MonitorFromPoint | 0x00ab2868 | - | - |
| EnumDisplayMonitors | 0x00ab2870 | - | - |
| SystemParametersInfoA | 0x00ab2878 | - | - |
| SetPropW | 0x00ab2880 | - | - |
| IsWindowVisible | 0x00ab2888 | - | - |
| GetMenu | 0x00ab2890 | - | - |
| GetKeyboardLayout | 0x00ab2898 | - | - |
| GetRawInputData | 0x00ab28a0 | - | - |
| CreateIcon | 0x00ab28a8 | - | - |
| SetWindowDisplayAffinity | 0x00ab28b0 | - | - |
| ClipCursor | 0x00ab28b8 | - | - |
| GetClipCursor | 0x00ab28c0 | - | - |
| ShowCursor | 0x00ab28c8 | - | - |
| SetWindowLongW | 0x00ab28d0 | - | - |
| EnableMenuItem | 0x00ab28d8 | - | - |
| GetSystemMenu | 0x00ab28e0 | - | - |
| ScreenToClient | 0x00ab28e8 | - | - |
| GetWindowLongW | 0x00ab28f0 | - | - |
| ClientToScreen | 0x00ab28f8 | - | - |
| DestroyIcon | 0x00ab2900 | - | - |
| SystemParametersInfoW | 0x00ab2908 | - | - |
| ReleaseCapture | 0x00ab2910 | - | - |
| SetCapture | 0x00ab2918 | - | - |
| SetWindowLongPtrW | 0x00ab2920 | - | - |
| MsgWaitForMultipleObjectsEx | 0x00ab2928 | - | - |
| RegisterRawInputDevices | 0x00ab2930 | - | - |
| IsProcessDPIAware | 0x00ab2938 | - | - |
| SetParent | 0x00ab2940 | - | - |
| MapWindowPoints | 0x00ab2948 | - | - |
| MonitorFromRect | 0x00ab2950 | - | - |
| RegisterWindowMessageA | 0x00ab2958 | - | - |
| ShowWindow | 0x00ab2960 | - | - |
| CreateAcceleratorTableW | 0x00ab2968 | - | - |
| TrackMouseEvent | 0x00ab2970 | - | - |
| ReleaseDC | 0x00ab2978 | - | - |
| GetDC | 0x00ab2980 | - | - |
| CheckMenuItem | 0x00ab2988 | - | - |
| DrawIconEx | 0x00ab2990 | - | - |
| TrackPopupMenu | 0x00ab2998 | - | - |
| IsWindowEnabled | 0x00ab29a0 | - | - |
| RedrawWindow | 0x00ab29a8 | - | - |
| PostQuitMessage | 0x00ab29b0 | - | - |
| EnableWindow | 0x00ab29b8 | - | - |
| GetWindowLongPtrW | 0x00ab29c0 | - | - |
| GetParent | 0x00ab29c8 | - | - |
| SetWindowRgn | 0x00ab29d0 | - | - |
| FindWindowExW | 0x00ab29d8 | - | - |
| GetTouchInputInfo | 0x00ab29e0 | - | - |
| AdjustWindowRect | 0x00ab29e8 | - | - |
| MapVirtualKeyExW | 0x00ab29f0 | - | - |
| GetForegroundWindow | 0x00ab29f8 | - | T1010 |
| RegisterTouchWindow | 0x00ab2a00 | - | - |
| IsWindow | 0x00ab2a08 | - | - |
| AdjustWindowRectEx | 0x00ab2a10 | - | - |
| FlashWindowEx | 0x00ab2a18 | - | - |
| GetActiveWindow | 0x00ab2a20 | - | - |
| UpdateWindow | 0x00ab2a28 | - | - |
| InvalidateRect | 0x00ab2a30 | - | - |
| SetCursorPos | 0x00ab2a38 | - | - |
| InvalidateRgn | 0x00ab2a40 | - | - |
| GetWindowPlacement | 0x00ab2a48 | - | - |
| SetWindowPlacement | 0x00ab2a50 | - | - |
| ChangeDisplaySettingsExW | 0x00ab2a58 | - | - |
| DefWindowProcW | 0x00ab2a60 | - | - |
| GetMessageW | 0x00ab2a68 | - | - |
| MapVirtualKeyW | 0x00ab2a70 | - | - |
| IsIconic | 0x00ab2a78 | - | - |
| EnumChildWindows | 0x00ab2a80 | - | - |
| DispatchMessageA | 0x00ab2a88 | - | - |
| GetMessageA | 0x00ab2a90 | - | - |
| CreateWindowExW | 0x00ab2a98 | - | - |
| RegisterClassExW | 0x00ab2aa0 | - | - |
| GetWindowRect | 0x00ab2aa8 | - | - |
| GetClientRect | 0x00ab2ab0 | - | - |
| SetWindowPos | 0x00ab2ab8 | - | - |
| PostMessageW | 0x00ab2ac0 | - | - |
| LoadCursorW | 0x00ab2ac8 | - | - |
| DispatchMessageW | 0x00ab2ad0 | - | - |
| TranslateMessage | 0x00ab2ad8 | - | - |
| SendMessageW | 0x00ab2ae0 | - | - |
| GetUpdateRect | 0x00ab2ae8 | - | - |
| PeekMessageW | 0x00ab2af0 | - | - |
| PostThreadMessageW | 0x00ab2af8 | - | - |
| ValidateRect | 0x00ab2b00 | - | - |
| GetMonitorInfoW | 0x00ab2b08 | - | - |
| MonitorFromWindow | 0x00ab2b10 | - | - |
| GetCursorPos | 0x00ab2b18 | - | - |
| SetCursor | 0x00ab2b20 | - | - |
| FillRect | 0x00ab2b28 | - | - |
| GetSystemMetrics | 0x00ab2b30 | - | - |
| CloseTouchInputHandle | 0x00ab2b38 | - | - |
| CreatePopupMenu | 0x00ab2b40 | - | - |
▸comctl32.dll4 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SetWindowSubclass | 0x00ab2278 | - | - |
| DefSubclassProc | 0x00ab2280 | - | - |
| TaskDialogIndirect | 0x00ab2288 | - | - |
| RemoveWindowSubclass | 0x00ab2290 | - | - |
▸gdi32.dll12 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| DeleteObject | 0x00ab22c0 | - | - |
| CombineRgn | 0x00ab22c8 | - | - |
| SetBkMode | 0x00ab22d0 | - | - |
| GetDeviceCaps | 0x00ab22d8 | - | - |
| SetTextColor | 0x00ab22e0 | - | - |
| CreateRectRgn | 0x00ab22e8 | - | - |
| CreateSolidBrush | 0x00ab22f0 | - | - |
| CreateCompatibleDC | 0x00ab22f8 | - | - |
| DeleteDC | 0x00ab2300 | - | - |
| SelectObject | 0x00ab2308 | - | - |
| CreateDIBSection | 0x00ab2310 | - | - |
| BitBlt | 0x00ab2318 | - | - |
▸dwmapi.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| DwmGetWindowAttribute | 0x00ab22a0 | - | - |
| DwmSetWindowAttribute | 0x00ab22a8 | - | - |
| DwmEnableBlurBehindWindow | 0x00ab22b0 | - | - |
▸shlwapi.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SHCreateMemStream | 0x00ab2790 | - | - |
▸ws2_32.dll19 funcs 3 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| WSACleanup | 0x00ab2b50 | - | - |
| getaddrinfo | 0x00ab2b58 | - | - |
| freeaddrinfo | 0x00ab2b60 | - | - |
| getsockopt | 0x00ab2b68 | - | - |
| WSAStartup | 0x00ab2b70 | - | T1071 |
| getpeername | 0x00ab2b78 | - | - |
| getsockname | 0x00ab2b80 | - | - |
| WSASocketW | 0x00ab2b88 | - | - |
| bind | 0x00ab2b90 | - | - |
| connect | 0x00ab2b98 | - | T1071 |
| ioctlsocket | 0x00ab2ba0 | - | - |
| shutdown | 0x00ab2ba8 | - | - |
| recv | 0x00ab2bb0 | - | - |
| send | 0x00ab2bb8 | - | T1071 |
| WSASend | 0x00ab2bc0 | - | - |
| setsockopt | 0x00ab2bc8 | - | - |
| WSAIoctl | 0x00ab2bd0 | - | - |
| WSAGetLastError | 0x00ab2bd8 | - | - |
| closesocket | 0x00ab2be0 | - | - |
▸bcrypt.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| BCryptGenRandom | 0x00ab2258 | - | - |
▸ntdll.dll9 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| NtWriteFile | 0x00ab26c8 | yes | - |
| NtCreateFile | 0x00ab26d0 | yes | - |
| NtReadFile | 0x00ab26d8 | yes | - |
| RtlGetVersion | 0x00ab26e0 | yes | - |
| NtCreateNamedPipeFile | 0x00ab26e8 | yes | - |
| NtOpenFile | 0x00ab26f0 | yes | - |
| NtCancelIoFileEx | 0x00ab26f8 | yes | - |
| NtDeviceIoControlFile | 0x00ab2700 | yes | - |
| RtlNtStatusToDosError | 0x00ab2708 | yes | - |
▸oleaut32.dll4 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SysFreeString | 0x00ab2768 | - | - |
| SetErrorInfo | 0x00ab2770 | - | - |
| SysStringLen | 0x00ab2778 | - | - |
| GetErrorInfo | 0x00ab2780 | - | - |
▸api-ms-win-crt-math-l1-1-0.dll5 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| trunc | 0x00ab2130 | - | - |
| round | 0x00ab2138 | - | - |
| __setusermatherr | 0x00ab2140 | - | - |
| floor | 0x00ab2148 | - | - |
| pow | 0x00ab2150 | - | - |
▸api-ms-win-crt-string-l1-1-0.dll7 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| strcpy_s | 0x00ab2218 | - | - |
| wcsncmp | 0x00ab2220 | - | - |
| strcmp | 0x00ab2228 | - | - |
| wcslen | 0x00ab2230 | - | - |
| _wcsicmp | 0x00ab2238 | - | - |
| strlen | 0x00ab2240 | - | - |
| wcscmp | 0x00ab2248 | - | - |
▸api-ms-win-crt-convert-l1-1-0.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| wcstol | 0x00ab20d0 | - | - |
| _wtoi | 0x00ab20d8 | - | - |
| _ultow_s | 0x00ab20e0 | - | - |
▸api-ms-win-crt-heap-l1-1-0.dll5 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| free | 0x00ab20f0 | - | - |
| _set_new_mode | 0x00ab20f8 | - | - |
| _callnewh | 0x00ab2100 | - | - |
| malloc | 0x00ab2108 | - | - |
| calloc | 0x00ab2110 | - | - |
▸api-ms-win-crt-runtime-l1-1-0.dll19 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _set_app_type | 0x00ab2160 | - | - |
| _configure_narrow_argv | 0x00ab2168 | - | - |
| _initialize_narrow_environment | 0x00ab2170 | - | - |
| _seh_filter_exe | 0x00ab2178 | - | - |
| _initterm | 0x00ab2180 | - | - |
| _initterm_e | 0x00ab2188 | - | - |
| exit | 0x00ab2190 | - | - |
| _exit | 0x00ab2198 | - | - |
| _get_initial_narrow_environment | 0x00ab21a0 | - | - |
| __p___argc | 0x00ab21a8 | - | - |
| __p___argv | 0x00ab21b0 | - | - |
| _cexit | 0x00ab21b8 | - | - |
| _c_exit | 0x00ab21c0 | - | - |
| _register_thread_local_exe_atexit_callback | 0x00ab21c8 | - | - |
| abort | 0x00ab21d0 | - | - |
| _initialize_onexit_table | 0x00ab21d8 | - | - |
| terminate | 0x00ab21e0 | - | - |
| _register_onexit_function | 0x00ab21e8 | - | - |
| _crt_atexit | 0x00ab21f0 | - | - |
▸api-ms-win-crt-stdio-l1-1-0.dll2 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _set_fmode | 0x00ab2200 | - | - |
| __p__commode | 0x00ab2208 | - | - |
▸api-ms-win-crt-locale-l1-1-0.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _configthreadlocale | 0x00ab2120 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | EN |
|---|---|
| Debug info | yes |
| TLS callbacks | yes |
Code signing
UnsignedThis binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Group Icon1Icon6Manifest1Version Info1
▸Group Icon1
32512EN
▸Icon6
1EN
2EN
3EN
4EN
5EN
6EN
▸Manifest1
1EN
▸Version Info1
1EN
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Group Icon 32512
Download
| Type | Group Icon |
|---|---|
| Name / ID | 32512 |
| Language | EN |
| Size | 90.0 B |
| RVA offset | 0x106b058 |
| Content signature | Icon |
| MD5 | 96661e9afe4cd4ebeb0f9d7fda2c6f6c |
| Entropy | 2.802 |
Icon 1
Download
| Type | Icon |
|---|---|
| Name / ID | 1 |
| Language | EN |
| Size | 2.0 KB |
| RVA offset | 0x1063408 |
| Content signature | PNG |
| MD5 | a830a17a6f40461eaa76a775df6fd4a5 |
| Entropy | 7.824 |
Icon 2
Download
| Type | Icon |
|---|---|
| Name / ID | 2 |
| Language | EN |
| Size | 812.0 B |
| RVA offset | 0x1063bf0 |
| Content signature | PNG |
| MD5 | 68eb77d2159809bd8010042d041a9885 |
| Entropy | 7.544 |
Icon 3
Download
| Type | Icon |
|---|---|
| Name / ID | 3 |
| Language | EN |
| Size | 1.4 KB |
| RVA offset | 0x1063f20 |
| Content signature | PNG |
| MD5 | 0baaf0aad76547bf9a6957ea20aef3c9 |
| Entropy | 7.76 |
Icon 4
Download
| Type | Icon |
|---|---|
| Name / ID | 4 |
| Language | EN |
| Size | 3.2 KB |
| RVA offset | 0x10644a0 |
| Content signature | PNG |
| MD5 | 954897b405d47b188b6a1314955f6bed |
| Entropy | 7.865 |
Icon 5
Download
| Type | Icon |
|---|---|
| Name / ID | 5 |
| Language | EN |
| Size | 4.7 KB |
| RVA offset | 0x10651a0 |
| Content signature | PNG |
| MD5 | fbf55aaf65a49b6f5f1a59b7f4ac1905 |
| Entropy | 7.895 |
Icon 6
Download
| Type | Icon |
|---|---|
| Name / ID | 6 |
| Language | EN |
| Size | 19.0 KB |
| RVA offset | 0x1066450 |
| Content signature | PNG |
| MD5 | 31991e700c04cfb020ec3e6aa37d2b67 |
| Entropy | 7.966 |
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | EN |
| Size | 334.0 B |
| RVA offset | 0x106b0b8 |
| Content signature | XML manifest |
| MD5 | 01e4c8c046a47771f13cd120b53303e7 |
| Entropy | 4.961 |
Application manifest
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <dependency> <dependentAssembly> <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /> </dependentAssembly> </dependency> </assembly>
Version Info 1
Download
| Type | Version Info |
|---|---|
| Name / ID | 1 |
| Language | EN |
| Size | 488.0 B |
| RVA offset | 0x1063220 |
| Content signature | Version Info |
| MD5 | b0dd2fa382e25ab088221456d93b5f05 |
| Entropy | 3.285 |
Parsed version info
| FileVersion | 25.10.7 |
|---|---|
| ProductName | Discord Quest Completer |
| ProductVersion | 25.10.7 |
| FileDescription | Discord Quest Completer |
Capability detection
not completedThe capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.
Signature matches
1 finding · 4 file properties · 1 scored| Rule | What it matched | Corpus | Weight |
|---|---|---|---|
|
Suspicious_Anti_Debug_API
|
Anti-debugging API names referenced
2 of 4 strings matched
$a
IsDebuggerPresent
at 0xfc781a
$d
OutputDebugString
at 0xfc69e4 · 2 hits
|
Built-in
ruleset this platform ships, and the only one the score reads
|
SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
|
File properties - not findings
IsPE64IsWindowsGUIHasDebugDataHasRichSignature
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
Extracted strings
showing 200 of 989- !This program cannot be run in DOS mode.
- &0Rich
- .text
- `.rdata
- @.data
- .pdata
- @.rsrc
- @.reloc
- null
- trueH
- falsH
- p://3P
- https://H9
- HostOnlyH9
- NotPreseH3
- nullH
- VWUSH
- lusH
- uusH9
- L.hH
- O;d.Xq
- T.hO
- D.pH
- 0nullH;^
- 9trueH;^
- 9falsH;^
- u.fff.
- index.htH
- gin:D3C
- gree3
- stop_proH3
- H5cessH
- payl3
- opti3
- ionsD3B
- erro3
- callbackH9
- tofE
- EAHI
- enceH
- type
- n headerH
- index.htH3
- taurH
- asseH
- .ffff.
- thfE
- heig
- widtH
- hand1
- dlerD1
- enab1
- bled1
- areleccaL
- rotareleL
- 9text
- 9item
- .ff.
- AdvancedH9
- ComputerH9
- EveryoneH9
- BluetootH3
- BookmarkH3
- Fold3
- Caut3
- tion3S
- FolderSmH3
- derSmartH3S
- ExitFullH3
- llScreenH3K
- ColorPanH3
- ColumnViH3
- ;Home
- ;Info
- IChatTheH3
- aterH
- EnterFulH3
- llScreenH3S
- Shar3
- :Menu
- :Icon
- Chec3
- PredefinH3
- MenuItemH9
- menuD3J
- :text
- :item
- :iconuf
- enab3
- bledD3B
- chec3
- acceleraH3
- eleratorL3B
- Past3
- FullscreH3
- ;Copy
- ;Undo
- ;Redo
- MinimizeH9
- ServicesH9
- SeparatoH3
- SelectAlH3
- Show3
- CloseWinH3
- seWindowH3S
- :name
- :icon
- commentsH9
- vers3
- sionD3B
- auth3
- horsD3B
- lice3
- enseD3B
- siteD3B
- cred3
- ditsD3B
- copyrighH3
- shortVerH3
- sionI
- :iduL
- hand3
- dlerD3B
- :icontMH
- acceleraL3
- eleratorL3J
- :iduZ
- :textt>H
- File
- Edit
- =metiu3
- 9textu
- EPH9E
- mpt7I
- ;dark
- ;menu
- titlebarH9
- ultraDarH3
- selectioH3
- headerViH3
- ligh3
- over3K
- side3
- ebar3K
- appearanH3
- nceBasedH3K
- fullScreH3
- enUIH
- mediumLiH3
- iumLightH3K
- tabb3
- actiD3
- inactiveL9
- rOfffff.
- ?dark
- transparH3
- nsparentH3O
- revo=revoH
- yalrE1
- =yalrt
- nullfH
- true
- fals
- H9EPt
- H;EXp
- heig1
- widt
- heigE1
- PhysicalH9
- icalD3A
- PhysicalL9
- icalD3I
- localhosH3
- AnyLabelH9
- Wind3
- ewWindowL3J
- labe3
- widt3
- titl3
- focu3
- always-oH3
- s-on-topH3K
- user-ageH3
- min-heigH3
- dragDropH3
- pEnabledH3K
- skip-tasH3
- kbarH
- hidden-tH3
- itleH
- crea3
- cent3
- heig3
- minWidthH9
- minimizaH
- imizableL
- userAgenH3
- min-widtH3
- nsparentH3S
- visi3
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x64 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x140a7d4704883ec28subrsp, 0x28
0x140a7d474e8af040000call0x140a7d928
0x140a7d4794883c428addrsp, 0x28
0x140a7d47de972feffffjmp0x140a7d2f4
0x140a7d482ccint3
0x140a7d483ccint3
0x140a7d484ccint3
0x140a7d485ccint3
0x140a7d486ccint3
0x140a7d487ccint3
0x140a7d488ccint3
0x140a7d489ccint3
0x140a7d48accint3
0x140a7d48bccint3
0x140a7d48cccint3
0x140a7d48dccint3
0x140a7d48eccint3
0x140a7d48fccint3
0x140a7d490ccint3
0x140a7d491ccint3
0x140a7d492ccint3
0x140a7d493ccint3
0x140a7d494ccint3
0x140a7d495ccint3
0x140a7d49666660f1f840000000000nopword ptr [rax + rax]
0x140a7d4a04883ec10subrsp, 0x10
0x140a7d4a44c891424movqword ptr [rsp], r10
0x140a7d4a84c895c2408movqword ptr [rsp + 8], r11
0x140a7d4ad4d33dbxorr11, r11
0x140a7d4b04c8d542418lear10, [rsp + 0x18]
0x140a7d4b54c2bd0subr10, rax
0x140a7d4b84d0f42d3cmovbr10, r11
0x140a7d4bc654c8b1c2510000000movr11, qword ptr gs:[0x10]
0x140a7d4c54d3bd3cmpr10, r11
0x140a7d4c87316jae0x140a7d4e0
0x140a7d4ca664181e200f0andr10w, 0xf000
0x140a7d4d04d8d9b00f0fffflear11, [r11 - 0x1000]
0x140a7d4d741c60300movbyte ptr [r11], 0
0x140a7d4db4d3bd3cmpr10, r11
0x140a7d4de75f0jne0x140a7d4d0
0x140a7d4e04c8b1424movr10, qword ptr [rsp]
0x140a7d4e44c8b5c2408movr11, qword ptr [rsp + 8]
0x140a7d4e94883c410addrsp, 0x10
0x140a7d4edc3ret
0x140a7d4eeccint3
0x140a7d4efccint3
0x140a7d4f04053pushrbx
0x140a7d4f24883ec20subrsp, 0x20
0x140a7d4f6488d058b0b3000learax, [rip + 0x300b8b]
0x140a7d4fd488bd9movrbx, rcx
0x140a7d500488901movqword ptr [rcx], rax
0x140a7d503f6c201testdl, 1
0x140a7d506740aje0x140a7d512
0x140a7d508ba18000000movedx, 0x18
0x140a7d50de8c6010000call0x140a7d6d8
0x140a7d512488bc3movrax, rbx
0x140a7d5154883c420addrsp, 0x20
0x140a7d5195bpoprbx
0x140a7d51ac3ret
0x140a7d51bccint3
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Import fingerprint
no related sample| Fingerprint | 192:GBWPfaHDjW/KrsWvILSGE/meDulhPEI8zn0HIMm7yo:USfaHvJmLNimMKez0oMSH |
|---|---|
| Imports read | 360 functions from 22 libraries (360 distinct) |
| Comparable | yes |
| Compared against | 102 stored samples |
Samples built on the same import table
No stored sample you can see shares this import table.
Sample terminated the analysis agent (anti-analysis)
The in-guest agent was killed during the run - a defense-evasion technique (MITRE T1562.001). User-mode telemetry after that point is incomplete, but the analysis continued via the layers the sample cannot see or kill: the hypervisor-level packet capture and a forced memory dump reconstructed from outside the guest. A watchdog also relaunches the agent when possible.
Screen recording
17 frames · screen recording · 152s1 / 17
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 151s7 process(es) observed
LaunchedC:\Users\user\Desktop\discord-quest-completer.exe
Privilegestandard
agent_terminated
Telemetry sources:
Kernel ETW (0 events)
agent poll: 25Process audit: 7In-process monitor: 101
Kernel-level behavior (agentless VMI)
no anomaliesAll 19 kernel passes answered on this run, and none of them matched an injection, hollowing or hiding technique. An empty result here was measured, not skipped.
Observed from outside the guest at the hypervisor layer, outside the guest - direct syscalls and user-mode unhooking cannot evade it.
Evasion / anti-analysis checks
4 checks
MED
Anti-debug API imports static-api
MITRE T1622 · isdebuggerpresent
MED
YARA: Suspicious_Anti_Debug_API Signature
MITRE T1497
MED
Anti-debug check dynamic
MITRE T1622 · anti_debug
MED
Agent termination dynamic
MITRE T1497 · agent_termination
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
Anti-analysis API trace
4 APIs · 3 processes hookedCalls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.
| API | Signal | Calls | Sleep | Scored |
|---|---|---|---|---|
| GetTickCount | timing | 10 | - | no corroborates, never convicts on its own - ordinary software calls this |
| GetTickCount64 | timing | 10 | - | no corroborates, never convicts on its own - ordinary software calls this |
| IsDebuggerPresent | anti_debug | 10 | - | yes |
| Sleep | sleep | 10 | 4825 ms total · 500 ms max | no under the floor a stall has to cross (30s in total or 10s at once) |
Call order 11 events sampled
SleepGetTickCountSleepGetTickCountIsDebuggerPresentGetTickCount64GetTickCountGetTickCount64IsDebuggerPresentGetTickCount64IsDebuggerPresent
How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.
Module loads
4 notable · 21 from system directoriesModules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.
| Process | Module | Loaded | Why listed |
|---|---|---|---|
| msedgewebview2.exe 3140 | netapi32.dll | no | the load failed |
| msedgewebview2.exe 3140 | C:\Windows\SYSTEM32\SspiCli.dll asked for sspicli.dll | yes | a module whose loader is the question |
| msedgewebview2.exe 3140 | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\… | no | the load failed |
| msedgewebview2.exe 3140 | C:\Windows\SYSTEM32\dbghelp.dll asked for dbghelp.dll | yes | a module whose loader is the question |
What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.
No WMI attributed to the sample. The WMI-Activity trace was running and recorded 774 operations on the machine during the run; none of them came from the sample's process tree.
Command lines, unwrapped
7 read7 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
7processes
163file operations
28registry operations
discord-quest-completer.exe
7 processes
7 processes
Attributed activity
discord-quest-completer.exe
PID 3920
Image
C:\Users\user\Desktop\discord-quest-completer.exe
Command
C:\Users\user\Desktop\discord-quest-completer.exe
Parent
not captured - its parent is outside the sample's tree
Children
1
File operations2
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\.cookies
Registry operations1
create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
msedgewebview2.exe
PID 5344
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=discord-quest-completer.exe --webview-exe-version=25.10.7 --user-data-dir="C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3920.5308.1004960670268108817
Parent
PID 3920 · discord-quest-completer.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
Children
5
File operations151
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Crashpad
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\BrowserMetrics
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\lockfile
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Variations
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\component_crx_cache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ExtensionActivityComp
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Preferences
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Secure Preferences
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\blob_storage\7f4ef910-1d7f-40fa-8021-93d3aec34445
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\blob_storage
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Top Sites
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ExtensionActivityEdge
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\component_crx_cache\metadata.json
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.db
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.journal
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ShaderCache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Last Version
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\README
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Local State
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Web Data
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Cache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Vpn Tokens
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Login Data
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Login Data For Account
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\CURRENT
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\000001.dbtmp
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\MANIFEST-000001
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\LOCK
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\LOG
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\PersistentOriginTrials
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\PersistentOriginTrials\LOG
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Code Cache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\parcel_tracking_db
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\parcel_tracking_db\LOG
Showing the first 40 of 151. The full list is on the File & registry section.
Registry operations19
createSoftware\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
createSoftware\Microsoft\EdgeWebView
createSoftware\Microsoft\EdgeWebView\StabilityMetrics
createSOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
createSoftware\Microsoft\Edge
createSoftware\Microsoft\Windows\CurrentVersion\Internet Settings
createSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\
createSoftware\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\EdgeWebView\
create\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
createSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}
createSoftware\Microsoft\EdgeWebView\PreferenceMACs\Default
createSoftware\Microsoft\EdgeWebView\BLBeacon
createSoftware\Policies\Microsoft\Windows\DataCollection
createSoftware\Microsoft\Windows\CurrentVersion\Policies\DataCollection
msedgewebview2.exe
PID 3140
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=150.0.7871.115 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=150.0.4078.65 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ffbbb35dcf0,0x7ffbbb35dcfc,0x7ffbbb35dd08
Parent
PID 5344 · msedgewebview2.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
Registry operations8
createSOFTWARE\Microsoft\WindowsSelfHost\FIDs
createSOFTWARE\Microsoft\WindowsSelfHost\FIDs\ByFID
createSOFTWARE\Microsoft\WindowsSelfHost\FIDs\Unknown
createSOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build
setvalueSOFTWARE\Microsoft\WindowsSelfHost\FIDsAllFlights = FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13083122,FX:13143E2F,FX:1318CA30,FX:1318CAEE,FX:1318CAEF,FX:1318CBED,FX:1318CBF1,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470,FX:13499FAF,FX:134B0F33,FX:135DF0BB,FX:137B6811,FX:137B6858,FX:13B72E01,FX:13B89E7A
createSOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
createSYSTEM\ControlSet001\Services\Tcpip\Parameters
createTenantRestrictions\Payload
msedgewebview2.exe
PID 5620
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView" --webview-exe-name=discord-quest-completer.exe --webview-exe-version=25.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=1844,i,8182805761118970746,6257363724411082535,524288 --field-trial-handle=1900,i,3782084145019746335,9990350664429304767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --pseudonymization-salt-handle=1904,i,12010973531783947079,17088415450041924954,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:3
Parent
PID 5344 · msedgewebview2.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
File operations10
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Sdch Dictionaries
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\SCT Auditing Pending Reports
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Shared Dictionary\cache
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Shared Dictionary\db
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Cookies
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Device Bound Sessions
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Trust Tokens
createC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Reporting and NEL
renameC:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Network Persistent State
msedgewebview2.exe
PID 5628
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView" --webview-exe-name=discord-quest-completer.exe --webview-exe-version=25.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --startup-read-main-dll --metrics-shmem-handle=1672,i,12272964071809133798,835248302261506137,262144 --field-trial-handle=1900,i,3782084145019746335,9990350664429304767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --pseudonymization-salt-handle=1904,i,12010973531783947079,17088415450041924954,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
Parent
PID 5344 · msedgewebview2.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedgewebview2.exe
PID 5960
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView" --webview-exe-name=discord-quest-completer.exe --webview-exe-version=25.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2336,i,11535786303462910768,6268412376955742656,524288 --field-trial-handle=1900,i,3782084145019746335,9990350664429304767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --pseudonymization-salt-handle=1904,i,12010973531783947079,17088415450041924954,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2344 /prefetch:8
Parent
PID 5344 · msedgewebview2.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedgewebview2.exe
PID 6088
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView" --webview-exe-name=discord-quest-completer.exe --webview-exe-version=25.10.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --ram-no-pressure-read-main-dll --metrics-shmem-handle=3432,i,12287023621971438610,7759326500540144251,2097152 --field-trial-handle=1900,i,3782084145019746335,9990350664429304767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --pseudonymization-salt-handle=1904,i,12010973531783947079,17088415450041924954,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3396 /prefetch:1
Parent
PID 5344 · msedgewebview2.exe
Chain
discord-quest-completer.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
Not attributed to any process
1 kindThese operations were captured but carry no pid this tree could match, so they are not shown against any node above.
File operations3
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity
Persistence mechanisms
cleanNo persistence established
None of the 90 auto-start methods below were established during this run.
Detection coverage
0 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
17 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
12 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 144
write 0
modify 3
delete 3
rename 16
Dropped payload analysis
none keptThe sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.
File & registry ops
166 file · 28 registry · sample scope
File operation times: 16 timed150 not observed
| Operation | Target | Process | |
|---|---|---|---|
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter
|
discord-quest-completer.exe pid 3920 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\.cookies
|
discord-quest-completer.exe pid 3920 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Crashpad
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\BrowserMetrics
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\lockfile
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Variations
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\component_crx_cache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ExtensionActivityComp
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:22.688 |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Preferences
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:22.607 |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Secure Preferences
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\blob_storage\7f4ef910-1d7f-40fa-8021-93d3aec34445
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:22.031 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\blob_storage
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:21.919 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Top Sites
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:22.031 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ExtensionActivityEdge
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\component_crx_cache\metadata.json
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.journal
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ShaderCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Last Version
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\README
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Local State
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:12.323 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Web Data
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Cache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Vpn Tokens
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Login Data
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Login Data For Account
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Session Storage
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\PersistentOriginTrials
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\PersistentOriginTrials\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Code Cache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\parcel_tracking_db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\parcel_tracking_db\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\parcel_tracking_db\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discounts_db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discounts_db\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discounts_db\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension State
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\PersistentOriginTrials\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\GrShaderCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache\data_3
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache\data_2
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Scripts
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache\data_1
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache\data_0
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Favicons
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache\index
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnGraphiteCache
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache\data_3
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache\data_2
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache\data_1
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache\data_0
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache\index
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\DawnWebGPUCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\History
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\GPUCache
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ServerCertificate
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata\CURRENT
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\NetworkDataMigrated
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Safe Browsing Network\NetworkDataMigrated
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage\leveldb
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Local Storage
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ClientCertificates
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network
|
msedgewebview2.exe pid 5344 | not observed |
| delete |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceData
|
msedgewebview2.exe pid 5344 | not observed |
| delete |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceDataTensors
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceData
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceDataTensors
|
msedgewebview2.exe pid 5344 | not observed |
| delete |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceDataAllowList
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\ProvenanceDataAllowList
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sessions
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\WidevineCdm
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db\metadata
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\shared_proto_db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Speech Recognition
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Subresource Filter\Unindexed Rules
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Subresource Filter
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\CertificateRevocation
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\MEIPreload
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Extension Rules
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Trust Protection Lists
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\TrustTokenKeyCommitments
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Site Characteristics Database
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Safe Browsing Network
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\PKIMetadata
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discount_infos_db\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discount_infos_db\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\discount_infos_db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\commerce_subscription_db\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\commerce_subscription_db\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\commerce_subscription_db
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\OriginTrials
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\AutoLaunchProtocolsComponent
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Shared Dictionary
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\hyphen-data
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ClientCertificates\LOCK
|
msedgewebview2.exe pid 5344 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\ClientCertificates\LOG
|
msedgewebview2.exe pid 5344 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Sdch Dictionaries
|
msedgewebview2.exe pid 5620 | 2026-10-23 17:12:22.691 |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\SCT Auditing Pending Reports
|
msedgewebview2.exe pid 5620 | 2026-10-23 17:12:21.808 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Shared Dictionary\cache
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Shared Dictionary\db
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Cookies
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Device Bound Sessions
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Trust Tokens
|
msedgewebview2.exe pid 5620 | not observed |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Reporting and NEL
|
msedgewebview2.exe pid 5620 | not observed |
| rename |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Network\Network Persistent State
|
msedgewebview2.exe pid 5620 | 2026-10-23 17:12:35.107 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\EdgeSessions
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:41.121 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\EdgeJourneys
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:41.121 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\EdgeJourneys\EdgeJourneys.db
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:41.121 |
| create |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\extensions_crx_cache
|
msedgewebview2.exe pid 5344 | 2026-10-23 17:12:42.748 |
| modify |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\blob_storage
|
- | 2026-10-23 17:12:22.031 |
| modify |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\Top Sites
|
- | 2026-10-23 17:12:22.031 |
| modify |
C:\Users\user\AppData\Local\me.markterence.discordquestcompleter\EBWebView\Default\EdgeJourneys\EdgeJourneys.db
|
- | 2026-10-23 17:12:41.453 |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
|
discord-quest-completer.exe pid 3920 | not timed |
| create |
Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\EdgeWebView
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\EdgeWebView\StabilityMetrics
|
msedgewebview2.exe pid 5344 | not timed |
| create |
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\Edge
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Internet Settings
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\EdgeWebView\
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
|
msedgewebview2.exe pid 5344 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
msedgewebview2.exe pid 5344 | not timed |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\EdgeWebView\PreferenceMACs\Default
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\EdgeWebView\BLBeacon
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Policies\Microsoft\Windows\DataCollection
|
msedgewebview2.exe pid 5344 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection
|
msedgewebview2.exe pid 5344 | not timed |
| create |
SOFTWARE\Microsoft\WindowsSelfHost\FIDs
|
msedgewebview2.exe pid 3140 | not timed |
| create |
SOFTWARE\Microsoft\WindowsSelfHost\FIDs\ByFID
|
msedgewebview2.exe pid 3140 | not timed |
| create |
SOFTWARE\Microsoft\WindowsSelfHost\FIDs\Unknown
|
msedgewebview2.exe pid 3140 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build
|
msedgewebview2.exe pid 3140 | not timed |
| setvalue |
SOFTWARE\Microsoft\WindowsSelfHost\FIDs
AllFlights = FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13083122,FX:13143E2F,FX:1318CA30,FX:1318CAEE,FX:1318CAEF,FX:1318CBED,FX:1318CBF1,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470,FX:13499FAF,FX:134B0F33,FX:135DF0BB,FX:137B6811,FX:137B6858,FX:13B72E01,FX:13B89E7A
|
msedgewebview2.exe pid 3140 | not timed |
| create |
SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
|
msedgewebview2.exe pid 3140 | not timed |
| create |
SYSTEM\ControlSet001\Services\Tcpip\Parameters
|
msedgewebview2.exe pid 3140 | not timed |
| create |
TenantRestrictions\Payload
|
msedgewebview2.exe pid 3140 | not timed |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
1Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 3,003 records 5 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 3 hours ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,153 records 5 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,680 records 5 minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 1 observed indicator, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 1 observed indicator, none listed | 27.6k records 5 minutes ago |
| CINS Army | IP / domain / URL | clean | 1 observed indicator, none listed | 15k records 5 minutes ago |
| Emerging Threats | IP / domain / URL | clean | 1 observed indicator, none listed | 482 records 5 minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 1 observed indicator, none listed | 5 records 5 minutes ago |
| IPsum | IP / domain / URL | clean | 1 observed indicator, none listed | 19.7k records 5 minutes ago |
| Phishing.Database | IP / domain / URL | clean | 1 observed indicator, none listed | 391.5k records 3 hours ago |
| ThreatFox | IP / domain / URL | clean | 1 observed indicator, none listed | 1,153 records 5 minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 9 hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
1 of 2 listed| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Signature rules | Sample content | 1 match | Suspicious_Anti_Debug_API | 110 records 6 minutes ago |
| Sigma rules | Behavior log | clean | - | 2,275 records 5 hours ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 7 process image paths, none masqueraded | 245 records 6 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 5 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 5 minutes ago |
| LOLRMM | Names and domains | clean | 9 name/domain indicators checked, no remote-management tooling | 360 records 5 minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
0 malicious
5 suspicious
0 info
File indicators
3| Severity | Type | Indicator | Description |
|---|---|---|---|
| suspicious | sample_sha256 | 6ec063f19205e61cec74f50596d15aa429ab3b92d3531e83f63984ced64d466a | Submitted sample (SHA256) |
| suspicious | sample_md5 | a3b6f91a30892bbfb90093bda3f64131 | Submitted sample (MD5) |
| suspicious | imphash | 3ebc9072499789c2ad62dc630bf5d20d | Import table hash (imphash) |
Registry indicators
2| Severity | Type | Indicator | Description |
|---|---|---|---|
| suspicious | registry_key | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters | Autostart / persistence key |
| suspicious | registry_key | SYSTEM\ControlSet001\Services\Tcpip\Parameters | Autostart / persistence key |
Sigma detections
0 matches of 2275 rulesThe Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.
Generated rules
Sigma: auto_file_2925_sigma_reg
Auto-generatedtitle: Auto-generated registry behavior rule (sandbox scan 2925)
id: sandbox-auto-2925-reg
status: experimental
description: Auto-generated from sandbox scan 2925
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
- 'Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}'
- 'Software\Microsoft\EdgeWebView'
- 'Software\Microsoft\EdgeWebView\StabilityMetrics'
- 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness'
- 'Software\Microsoft\Edge'
- 'Software\Microsoft\Windows\CurrentVersion\Internet Settings'
- 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
condition: selection
level: mediumExtracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
No extracted files
Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.
Export & download
/s/2925Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
2 runsThis file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.
| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-10-23 17:03 | Windows 10 22H2 | Suspicious | 56/100 |
| 2026-10-23 17:02 Shown below | Windows 10 22H2 | Suspicious | 61/100 |