hxxps://google[.]com

Resubmissions

16/08/2024, 04:45

240816-fdextszepr8

16/08/2024, 04:39

16/08/2024, 04:32

16/08/2024, 04:30

16/08/2024, 04:27

Analysis

max time kernel
65s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample240816-fdextszepr

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	BootstrapperV1.16.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	BootstrapperV1.10.exe

Executes dropped EXE 2 IoCs

pid	Process
3456	BootstrapperV1.10.exe
5984	BootstrapperV1.16.exe

Loads dropped DLL 11 IoCs

pid	Process
864	MsiExec.exe
864	MsiExec.exe
5928	MsiExec.exe
5928	MsiExec.exe
5928	MsiExec.exe
5928	MsiExec.exe
5928	MsiExec.exe
5616	MsiExec.exe
5616	MsiExec.exe
5616	MsiExec.exe
864	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
117	1276	msiexec.exe
119	1276	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
94	pastebin.com
95	pastebin.com
108	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\source\templates.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\abbrev\abbrev.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\is-windows.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\rebuild.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\update-workspaces.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\is-package-bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\signals.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\set.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-search.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-node-modules.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-root.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\signature.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarn.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\registry.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-explain.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\iterator.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\History.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\custom\zalgo.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-node-directory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\version.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\readdir-scoped.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\src\promisify.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmfund\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-regex\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\trailing-slashes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\key.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\lib\language.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\subclass.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\dist\src\promisify.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\role.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\build\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_writable.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\check-bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-regex\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-completion.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-name\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_readable.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-doctor.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\shim-bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\package.json	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8F16.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C84.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586433.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6926.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6956.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e586437.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI930F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e586433.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI730F.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV1.10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133682571600726099"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2536	msedge.exe
2536	msedge.exe
5060	chrome.exe
5060	chrome.exe
5984	BootstrapperV1.16.exe
5984	BootstrapperV1.16.exe
5984	BootstrapperV1.16.exe
1276	msiexec.exe
1276	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeDebugPrivilege	3456	BootstrapperV1.10.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeShutdownPrivilege	5060	chrome.exe
Token: SeCreatePagefilePrivilege	5060	chrome.exe
Token: SeDebugPrivilege	5984	BootstrapperV1.16.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe
5060	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 636	2536	msedge.exe	86
PID 2536 wrote to memory of 636	2536	msedge.exe	86
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2776	2536	msedge.exe	87
PID 2536 wrote to memory of 2504	2536	msedge.exe	88
PID 2536 wrote to memory of 2504	2536	msedge.exe	88
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89
PID 2536 wrote to memory of 3016	2536	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8841246f8,0x7ff884124708,0x7ff884124718
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87228cc40,0x7ff87228cc4c,0x7ff87228cc58
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1368,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3328,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5124,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5184,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4928,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3460,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3432,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3192,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5488,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5620
- C:\Users\Admin\Downloads\BootstrapperV1.10.exe
  "C:\Users\Admin\Downloads\BootstrapperV1.10.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- - C:\Users\Admin\Downloads\BootstrapperV1.16.exe
    "C:\Users\Admin\Downloads\BootstrapperV1.16.exe" --oldBootstrapper "C:\Users\Admin\Downloads\BootstrapperV1.10.exe" --isUpdate true
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      4⤵
      PID:5776

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1276
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D123173B11F808C32157D99D8AC2B465
  2⤵
  - Loads dropped DLL
  PID:864
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7199BCC10E1A6712555E402B9EA64D99
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BE6992DEE4169B45E2B56C078282BA10 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5616
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5744
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586436.rbs

Path C:\Config.Msi\e586436.rbs
Size 1.0MB
SHA256 c04f02fbdcc0d5cd6c619b08c8b1e688dca0f4e4e6a67d11003d63709e71a3d6
MD5 5c9c1a4765e606ba29b8539446b78135
SHA1 02afa93524695029f584c279a0237548de7161bb
SHA512 9e918a5dafd177efad7b4e61970e49d964c0ab6acc8279953bc2701af6b380b0dbf897a92cd555cb1e63e9b0ae18a7df2da1b73471b7666c25eb67565ac1b7f0
SSDEEP 12288:oiUmwt3jOZy2KsGU6a4Ksat3jOZy2KsGU6a4KsNZ:oiLIzOE2Z34KBzOE2Z34K8
MD5 SHA1 SHA512 SSDEEP

Submit Download

node_etw_provider.man

Path C:\Program Files\nodejs\node_etw_provider.man
Size 10KB
SHA256 1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
MD5 1d51e18a7247f47245b0751f16119498
SHA1 78f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA512 1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
SSDEEP 96:Y55SUaOHITT3yclGnDJopeSd/82w9GbLN7ig2GbLN7+g2YGbLN7CSkThMz2OoQIc:4SjH/895kt+Nm1l4Ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

node_etw_provider.man

Path C:\Program Files\nodejs\node_etw_provider.man
Size 8KB
SHA256 1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
MD5 d3bc164e23e694c644e0b1ce3e3f9910
SHA1 1849f8b1326111b5d4d93febc2bafb3856e601bb
SHA512 91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
SSDEEP 96:pK5X2FE47HI+T3yclGnDJopeSd/82w9WBLHRicmWBLHR+cmEWBLHRCqEThMz2uoy:UGFl/895ELyqrl4Ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
MD5 SHA1 SHA512

Submit Download

license

Path C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
MD5 SHA1 SHA512

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Size 1KB
SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
MD5 d116a360376e31950428ed26eae9ffd4
SHA1 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA512 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Size 802B
SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
MD5 d7c8fab641cd22d2cd30d2999cc77040
SHA1 d293601583b1454ad5415260e4378217d569538e
SHA512 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
MD5 SHA1 SHA512

Submit Download

index.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Size 16KB
SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
MD5 bc0c0eeede037aa152345ab1f9774e92
SHA1 56e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA512 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
SSDEEP 384:PjFrIA8zJ08TEcGpIuqbI0WXsJY+cHK+34x2WkFUasBq7BmDWC:PjFrIKf8JKjV0DJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
MD5 SHA1 SHA512

Submit Download

index.d.ts

Path C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Size 4KB
SHA256 dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
MD5 f0bd53316e08991d94586331f9c11d97
SHA1 f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA512 fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
SSDEEP 96:QY2oMUNvB/PG/SF6KygEEIKEflCN33GBXMnzgdRCXaN:IoMWKnKyg2jS3GxsXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
MD5 SHA1 SHA512

Submit Download

Node.js documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Size 84B
SHA256 b4b0b4057df774b1a33706cc4c57884681197e3edeffd4afdbf37be974f8f828
MD5 0c3d77c634f46e5a1d3398b486342e3a
SHA1 1febe77346a037027ba1fc2fe073c7c93418f0be
SHA512 15613e036214ce79048916b2bba4e9db76c1250d55f6c5a43ca54878aaade6313c5b3a90a37f9a2c7870c25481d512d4de2b6c14906823ec7926274c0e0ff260
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f4ff310cb73eb28d3f834c738ed70a032df6d31cefc5e37adc0897a7f7d923fb
MD5 67771158cbcebaa1d1c161f909200c8b
SHA1 1118fe284bc10f82e3da53cecf253d1f2a03b945
SHA512 0df21e30248877d863e9ff5525161055e131d5483aa334d2180840de6685faa16dcf90e3f65e3e5d2cabb562b4a5331b200e093dfed8cf91315eb72c5ead4adb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b66282c018f32b604080dc67fb464d0e75ca4e2060c8dc3e13c4eb14baf8b42f
MD5 ab1406876021aeb9522d047de9f7561d
SHA1 6ed7c3ca35f5c44452309cf8f875ac31c354f225
SHA512 3239033d36f66c653f4a9d5d84861e804de4f665472954539410f16b25c3dc5fda0b69aef47032090236d4f3e559ad56f6fdc713e5f128b65975e83682efca57
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 a83f8edb1fa8185708ad148e42e7c8a401dd3fdac8b0d6c97a8dda7e50477ffe
MD5 e7fa533c19120ed6fcff379e4da68b82
SHA1 3fb16f7cc0254a772f835f86b3bf92339c012b9f
SHA512 bfcf9f768fb4777687fd5726626bee3fcf7808830f3985d39608b840bb727e98b1c4e899807c3f9d49fa49425db7043e34426d68a75c473484936a14059146ce
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 692B
SHA256 2425eafae06f853178c3bd8a00c3c61103d9dcff8531b66f94808186263fac70
MD5 eb1ccb414362c7d805c51f6658ee607f
SHA1 1333d62716d1aac6e0b423f07ec78c33380bff09
SHA512 5873ac11214a6bd2b2f8e792f3dc333552dda7c015d55f7982c847007467f5e0a4a197301a56f4e7ff102046a3a0c0dc798f6b71b1951e049099be1b38307145
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 61bde616758cf4e2a22c8844436e69a5fcfa88e054c14d78f8cd29f93e8e08c3
MD5 fcb7da84917a7a78671aa57a94b4ff47
SHA1 3b69de2ef48ff3ef284a293fd1a2c765f9756a5b
SHA512 efced08030feab26dee46412963ec463c0ffa50abc6fb9bb70b4e5f7da81146caeaea3fce6c351893c5376c26ce361a08feb87d4e795da28708160e2136aeeb3
SSDEEP 192:BNfZlrjnHQejCHV+FRlz+eTI/Aj36hPo6yIsnVdg4:BNf73mGRBPKj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e15fdb4183cde6f66f8d451ccd692752860936f7c0322244bd6142d01bc3e13f
MD5 cfe58260ffb66ff74065e30935a5a8ee
SHA1 2f7098cdf6d718df87d4c946c982da03901a85b9
SHA512 e1f44c04b9e3944514bf835f2dedc11d9e21022d3896b11971e5b5b32b66493456443a1b18ff71102af267c00649b8ee7fe24d0a3f3724f4d88bed69e621ffa8
SSDEEP 192:INfZlrjnIJe0xCHV+FX1/ekjU+eTI/Aj36hPo6yIsnVdg4:INfMDxmGX1ekjePKj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 480db5d43e314a340961809d7cb39e3585d11519039405f35e67ac4f4e4439c6
MD5 e4d1151380199ca5e99e24ba043907fd
SHA1 d3de558ad5aeec702e487e848a2b07e07a560dac
SHA512 e85d8be3e01d748097c74f3cf6cffc095ccc5b9afae0eeb6b5b662f5e831d8bb81732c8065435c71fcbcb72fefd82eaea04af137ae630f5834116a1a1e234589
SSDEEP 192:INPZlrjneJe0xCHV+FX1/ekj/+eTI/Aj3chPo6yIsnVdg4:INPqDxmGX1ekj3Psj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 42ebab6e1429e7f4a8f7870502b5dd2b54f0d775a339160d166631dced0e3096
MD5 c14ffd2a95a979fb88b4389a065bee0e
SHA1 7c338e85215339c125cf999da41beb35f15c98d4
SHA512 7c26e4c232f3f950bf20387ff6fd7e320a909ce81a103057697507cf08dc4007fedb287de0235b6350360bb21167e52276d6e465fc1dbb3c6dcdeded71921be1
SSDEEP 192:INPZlrjn6Je0xCHV+FX1/ekj/+eTI/Aj3chPo6yIsnVdg4:INP2DxmGX1ekj3Psj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f1d0e2ba95f14d6abef2ff9114e2fdeb5980747b7f3ea2d009c9d12af651d711
MD5 7d5713f940977101328e301fb76f8ae1
SHA1 9621858fafedd1731905b52e37d20955f9af031e
SHA512 c1e528013d9ccdf9a6455c4d83ce68fa42bc1c1600dc88abad6471150e9c23e4defc0aa927e47cfe332a7cd32a6661b15c0720ddf4f8a663902ccf9882971eda
SSDEEP 384:RlvN7pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crURWTTV:RtN7pLhLnyemo1kXqKf/pUZNCgVLH2HF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 578a6a405bc22f0e21f121d7cdf27a451c7c2f677b8ac4f7729a844bc2555733
MD5 e1d278adc63b0974970c6c79496df6c9
SHA1 f77b2a5afdb3244ab6d157b21ae72a69348be6fd
SHA512 4b87fec3709d4566a812d5fce9beb5ab7a7c5e594c902b227d7eeb8daffdd293a4c7340f8f940804a5631856f0a28b8662aeeb65329ec7be4a83a09f9678c054
SSDEEP 6144:iZSqv1Mc9+WFs9zGZnr4ZlTFqgImLhs6CO:0SBWFXB8ZZFqgImLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 97a2f0543f76232c0fbc0e75ed508b39938bd37428a8ce8b83c0b310263f41a2
MD5 f71580e872a5b7201d9ccb4239ce1971
SHA1 9c18633b635ea1ba03c8b6c637ef893ed6620bf6
SHA512 e17943c83e3b9e96d31a748a2881af33004e9a7cb5da178d6119b91680cca6aee383a6fc44a725bcc0820d9e3ba9f15a30e379bacbf129366715c940efc682a2
SSDEEP 6144:vsSqv1Mc9+WFs9zGZnr4ZlTFqgImLhs6CO:ESBWFXB8ZZFqgImLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 14a6c09ae58be988e0d9af101157c93ad947627bcb21fc17ec13a350ef903d17
MD5 5233269eb4f579821e8c0257cfbbf15b
SHA1 bf0924fa18a34e50c47bd22b8ae504ede912ac25
SHA512 969ceaa8c40e42970ab8591164adf9f657b3f83f2de876e8aaad50b6c2788cb8a6547b854bde6d4f78657a0924e681482a7690c528329a413bec7f099d853598
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5200c828bcd9d963f8bd3dbfc36bc34b2e277de8df1d52a9489ccb0ae4536cb6
MD5 a083e698cecf5fbd4b1e9931fd89493f
SHA1 9626f00c5b3154face0ff87416eaaa21f13d2e79
SHA512 e0435bcab3f65863fd17978b0c03e962a7750f41ef93cb6797654d56fbc8724cf1473c4c363b3df4b8184f8921fcd782fdc3d00d5427f1bd41c05d96ed60668d
SSDEEP 96:n6kRoJ1iA04wpvWMoiVmdeHa00URUWQyV+VD7ziEwb:n6kRQMv4GWMXVLRrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 51abecdca78cb4d88733f1812044016dccef9207f6ddb3d62a39784358ec0d03
MD5 da5e197e52c204de2fb40ff656a941cb
SHA1 b9d9eeae569fa79de667812a6c424bf7e49153b9
SHA512 03d52504cf8e5cf1f28921d8f46643e08463443f7f4a3d4252eb00f429422da83160aa58ef53d85c06d7f46bfa1465ca49edb72f02e2dd69eb991ae3c37f32b4
SSDEEP 96:n6kR+J1iY04wpvWMoiVmdeiuj1Yqa0eLRUWQyV+VD7AiEwb:n6kRyM34GWMSujuqVGRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0ad4bd5a0ac98ec3deb3c4de2b92980aa05d1a67353545df82bc4ae234160c85
MD5 66b36067c226fc2b4088f863237bcba1
SHA1 ff8bf700f558153f023efc2f557d0213038f7f3c
SHA512 37f621d50d3950cbf7ba8d0dad96aabd2a2640f20be434e3825fe04c89573b3a5d383126def1588da07a07b2e244f70253d6c5e1c116b5096a577975f58077d5
SSDEEP 192:5oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+Jde2RU89Agjru8z8ZJuwl:l9iIxuERzA83h09RZxY05kgjPz8Gwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

node-v18.16.0-x64.msi

Path C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
Size 30.1MB
SHA256 5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
MD5 0e4e9aa41d24221b29b19ba96c1a64d0
SHA1 231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA512 e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
SSDEEP 786432:+UjLyFcn6UchAFxpT/1DbG5AEjNfJUFZw/xM:+UjLyFnUMAFf1nC7UFZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

BootstrapperV1.10.exe.crdownload

Path C:\Users\Admin\Downloads\BootstrapperV1.10.exe.crdownload
Size 795KB
SHA256 da17868f107954124c0953fd1cb37ac8ed4e78460905e83d6402b966a77ee7dc
MD5 a7f3293b177a63f6c50b5560e729cbff
SHA1 4885073e4881cffc5c5155de720aa65755418fe8
SHA512 70b3431b238457a24e66914d0059e7e8e2dc4f79ac49c9a9c510214b8bc1279af6947288442060ac02c3cf3c863c144ef95219006097d2e59183586f7f701438
SSDEEP 12288:Hs0xF36Z1LyI6QQsJNOoRQ1jt/Nppxu29CHWzO:xxJ6Z1L5J8oRQ1jt/Nppxv9C2
MD5 SHA1 SHA512 SSDEEP

Submit Download

BootstrapperV1.16.exe

Path C:\Users\Admin\Downloads\BootstrapperV1.16.exe
Size 796KB
SHA256 6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178
MD5 76639ab92661f5c384302899934051ab
SHA1 9b33828f8ad3a686ff02b1a4569b8ae38128caed
SHA512 928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee
SSDEEP 12288:THeLH6iTPSE54sgweI9oaQJj3r+piq+77xOZ+eMm:THeLHdTSEeyoaQJj3Spiq+77xd
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI68A8.tmp

Path C:\Windows\Installer\MSI68A8.tmp
Size 122KB
SHA256 e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
MD5 9fe9b0ecaea0324ad99036a91db03ebb
SHA1 144068c64ec06fc08eadfcca0a014a44b95bb908
SHA512 906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
SSDEEP 3072:86Xj92CltLwDRLSZyei6pZ7QjjB31v3vYIFryNWk:86TMCfLcS4P6PQvcWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6956.tmp

Path C:\Windows\Installer\MSI6956.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6DBD.tmp

Path C:\Windows\Installer\MSI6DBD.tmp
Size 297KB
SHA256 b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
MD5 7a86ce1a899262dd3c1df656bff3fb2c
SHA1 33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA512 421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec
SSDEEP 3072:QVXg5hPj4piaA2eO4+ZHLsuR3roR2a2AEgCoP7PpR88GXOWvo2/IAVA2tneof5Qd:7Lj4wbYV3roIrRgCoeXOJAyE/kDYNbp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3456-195-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/3456-196-0x0000000005580000-0x00000000058D4000-memory.dmp

Download

memory/3456-194-0x00000000752B0000-0x0000000075A60000-memory.dmp

Download

memory/3456-193-0x0000000000120000-0x00000000001EE000-memory.dmp

Download

memory/3456-209-0x00000000752B0000-0x0000000075A60000-memory.dmp

Download

memory/3456-192-0x00000000752BE000-0x00000000752BF000-memory.dmp

Download

memory/5984-221-0x0000026B6D4C0000-0x0000026B6D4E2000-memory.dmp

Download

memory/5984-2612-0x0000026B6DD00000-0x0000026B6DD0A000-memory.dmp

Download

memory/5984-2614-0x0000026B6DD30000-0x0000026B6DD42000-memory.dmp

Download

memory/5984-210-0x0000026B6B6C0000-0x0000026B6B78E000-memory.dmp

Download