Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 22:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ezCLI_5.9.1_x64_en-US.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
ezCLI_5.9.1_x64_en-US.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target ezCLI_5.9.1_x64_en-US.msi
- Size 2.8MB
- Sample261030-2rx68asva1
- SHA256 b46507fafa1ef8da5e2fc642552d46a5426b156c0decfa0ee8c381087316d2f7
- MD5 dd8a79ab5bf0a2241662b004b9185778
- SHA1 5778684937c4aef7a95a2c5c6079302867be6e53
- SHA512 6aa28bf6da87b20d25e6a52a61b2662490c0dc7cf21aeab85c9adf91a3349f679b0260f29e8b20f99cbd1a50936f0d3b8b5358e7d5ec15972cc651e37474b5d5
- SSDEEP 49152:85bZjp9CioK+80/BlfxFMUjBRd2bNCWsj4AGH7HlAEHm7jG6MbfgZkvm:cjp9CXKo5vBjF2bNCcAIlAEG3G6cfgZb
- TLSH T1BFD5231B7F419532C8692DFA047A87A05E3DFC108F706983739A362DDEF12E09B659D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1352 ezcli.exe - Loads dropped DLL 1 IoCs
pid Process 2564 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ezcli.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\ezCLI\ezcli.exe msiexec.exe File created C:\Program Files\ezCLI\Uninstall ezCLI.lnk msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-hy.hyb msedgewebview2.exe File opened for modification C:\Windows\Installer\e59c8f3.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-sv.hyb msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{EF8E1855-6BB6-4190-81BE-E8990D3667B8} msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\~DFD4E6C3CFBB56C137.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-or.hyb msedgewebview2.exe File opened for modification C:\Windows\Installer\MSICCFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EF8E1855-6BB6-4190-81BE-E8990D3667B8}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\manifest.json msedgewebview2.exe File created C:\Windows\Installer\e59c8f5.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\~DFD09DAAE3D376294D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCF51EE446651D284.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e59c8f3.msi msiexec.exe File created C:\Windows\SystemTemp\~DF456125D62FBA7B03.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-as.hyb msedgewebview2.exe File created C:\Windows\Installer\{EF8E1855-6BB6-4190-81BE-E8990D3667B8}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-ta.hyb msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\manifest.fingerprint msedgewebview2.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4492 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\ProductIcon = "C:\\Windows\\Installer\\{EF8E1855-6BB6-4190-81BE-E8990D3667B8}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8A747AD810236EF5387939A9E6C41800\5581E8FE6BB6091418EB8E99D063768B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\PackageName = "ezCLI_5.9.1_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5581E8FE6BB6091418EB8E99D063768B\MainProgram msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8A747AD810236EF5387939A9E6C41800 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5581E8FE6BB6091418EB8E99D063768B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5581E8FE6BB6091418EB8E99D063768B\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5581E8FE6BB6091418EB8E99D063768B\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5581E8FE6BB6091418EB8E99D063768B\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\ProductName = "ezCLI" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\PackageCode = "93FDB123037D1034882A5B87268DED41" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\Version = "84475905" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5581E8FE6BB6091418EB8E99D063768B\SourceList msiexec.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 5016 reg.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3332 msiexec.exe 3332 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1192 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4492 msiexec.exe Token: SeIncreaseQuotaPrivilege 4492 msiexec.exe Token: SeSecurityPrivilege 3332 msiexec.exe Token: SeCreateTokenPrivilege 4492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4492 msiexec.exe Token: SeLockMemoryPrivilege 4492 msiexec.exe Token: SeIncreaseQuotaPrivilege 4492 msiexec.exe Token: SeMachineAccountPrivilege 4492 msiexec.exe Token: SeTcbPrivilege 4492 msiexec.exe Token: SeSecurityPrivilege 4492 msiexec.exe Token: SeTakeOwnershipPrivilege 4492 msiexec.exe Token: SeLoadDriverPrivilege 4492 msiexec.exe Token: SeSystemProfilePrivilege 4492 msiexec.exe Token: SeSystemtimePrivilege 4492 msiexec.exe Token: SeProfSingleProcessPrivilege 4492 msiexec.exe Token: SeIncBasePriorityPrivilege 4492 msiexec.exe Token: SeCreatePagefilePrivilege 4492 msiexec.exe Token: SeCreatePermanentPrivilege 4492 msiexec.exe Token: SeBackupPrivilege 4492 msiexec.exe Token: SeRestorePrivilege 4492 msiexec.exe Token: SeShutdownPrivilege 4492 msiexec.exe Token: SeDebugPrivilege 4492 msiexec.exe Token: SeAuditPrivilege 4492 msiexec.exe Token: SeSystemEnvironmentPrivilege 4492 msiexec.exe Token: SeChangeNotifyPrivilege 4492 msiexec.exe Token: SeRemoteShutdownPrivilege 4492 msiexec.exe Token: SeUndockPrivilege 4492 msiexec.exe Token: SeSyncAgentPrivilege 4492 msiexec.exe Token: SeEnableDelegationPrivilege 4492 msiexec.exe Token: SeManageVolumePrivilege 4492 msiexec.exe Token: SeImpersonatePrivilege 4492 msiexec.exe Token: SeCreateGlobalPrivilege 4492 msiexec.exe Token: SeCreateTokenPrivilege 4492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4492 msiexec.exe Token: SeLockMemoryPrivilege 4492 msiexec.exe Token: SeIncreaseQuotaPrivilege 4492 msiexec.exe Token: SeMachineAccountPrivilege 4492 msiexec.exe Token: SeTcbPrivilege 4492 msiexec.exe Token: SeSecurityPrivilege 4492 msiexec.exe Token: SeTakeOwnershipPrivilege 4492 msiexec.exe Token: SeLoadDriverPrivilege 4492 msiexec.exe Token: SeSystemProfilePrivilege 4492 msiexec.exe Token: SeSystemtimePrivilege 4492 msiexec.exe Token: SeProfSingleProcessPrivilege 4492 msiexec.exe Token: SeIncBasePriorityPrivilege 4492 msiexec.exe Token: SeCreatePagefilePrivilege 4492 msiexec.exe Token: SeCreatePermanentPrivilege 4492 msiexec.exe Token: SeBackupPrivilege 4492 msiexec.exe Token: SeRestorePrivilege 4492 msiexec.exe Token: SeShutdownPrivilege 4492 msiexec.exe Token: SeDebugPrivilege 4492 msiexec.exe Token: SeAuditPrivilege 4492 msiexec.exe Token: SeSystemEnvironmentPrivilege 4492 msiexec.exe Token: SeChangeNotifyPrivilege 4492 msiexec.exe Token: SeRemoteShutdownPrivilege 4492 msiexec.exe Token: SeUndockPrivilege 4492 msiexec.exe Token: SeSyncAgentPrivilege 4492 msiexec.exe Token: SeEnableDelegationPrivilege 4492 msiexec.exe Token: SeManageVolumePrivilege 4492 msiexec.exe Token: SeImpersonatePrivilege 4492 msiexec.exe Token: SeCreateGlobalPrivilege 4492 msiexec.exe Token: SeCreateTokenPrivilege 4492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4492 msiexec.exe Token: SeLockMemoryPrivilege 4492 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4492 msiexec.exe 4492 msiexec.exe 1352 ezcli.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1352 ezcli.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4492 msiexec.exe 3332 msiexec.exe 2564 MsiExec.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2564 3332 msiexec.exe 90 PID 3332 wrote to memory of 4744 3332 msiexec.exe 96 PID 4492 wrote to memory of 1352 4492 msiexec.exe 99 PID 1352 wrote to memory of 1192 1352 ezcli.exe 100 PID 1192 wrote to memory of 3196 1192 msedgewebview2.exe 101 PID 1192 wrote to memory of 3128 1192 msedgewebview2.exe 102 PID 1192 wrote to memory of 3128 1192 msedgewebview2.exe 102 PID 1192 wrote to memory of 3128 1192 msedgewebview2.exe 102 PID 1192 wrote to memory of 3128 1192 msedgewebview2.exe 102 PID 1192 wrote to memory of 2896 1192 msedgewebview2.exe 103 PID 1192 wrote to memory of 4560 1192 msedgewebview2.exe 104 PID 1192 wrote to memory of 4560 1192 msedgewebview2.exe 104 PID 1192 wrote to memory of 4560 1192 msedgewebview2.exe 104 PID 1192 wrote to memory of 4488 1192 msedgewebview2.exe 105 PID 1192 wrote to memory of 4488 1192 msedgewebview2.exe 105 PID 1192 wrote to memory of 4488 1192 msedgewebview2.exe 105 PID 1192 wrote to memory of 4488 1192 msedgewebview2.exe 105 PID 1192 wrote to memory of 4488 1192 msedgewebview2.exe 105 PID 1352 wrote to memory of 5016 1352 ezcli.exe 106 PID 1352 wrote to memory of 5404 1352 ezcli.exe 108 PID 1192 wrote to memory of 2068 1192 msedgewebview2.exe 112 PID 1192 wrote to memory of 2068 1192 msedgewebview2.exe 112 PID 1192 wrote to memory of 2068 1192 msedgewebview2.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ezCLI_5.9.1_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files\ezCLI\ezcli.exe"C:\Program Files\ezCLI\ezcli.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1352.5884.13774604972150839651 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c203⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView /prefetch:4 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c20 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9b2335fd8,0x7ff9b2335fe4,0x7ff9b2335ff04⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,17714786153787695538,14865552615676237300,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c204⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1780,i,17714786153787695538,14865552615676237300,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c204⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1780,i,17714786153787695538,14865552615676237300,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c204⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3352 --field-trial-handle=1780,i,17714786153787695538,14865552615676237300,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c20 /prefetch:14⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView" --webview-exe-name=ezcli.exe --webview-exe-version=5.9.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1780,i,17714786153787695538,14865552615676237300,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:31e9a769f61b6b6750c17b8e15c065254e924c204⤵PID:2068
-
-
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Classes\obsidian3⤵
- Modifies registry key
PID:5016
-
-
C:\Windows\System32\curl.exe"C:\Windows\System32\curl.exe" --disable --fail --silent --show-error --location --max-time 20 -H "Accept: application/vnd.github+json" -H "User-Agent: ezCLI-updater" https://api.github.com/repos/Aryansingh0783/ezCLI/releases/latest3⤵PID:5404
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B49B97159E52ACC17A149E29CADA330A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4744
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c8f4.rbs
- Size 9KB
- SHA256 4da2fd1f54e6367f652c8edde1c1ac7f19e3707e67f241ad1754959caca85ab9
- MD5 9749118a7e8bbdb8dc6d86e891c1f027
- SHA1 8637dc82718b317ee7f25b71bf6c61d8a3b4065a
- SHA512 f71bf96fee3f9c82e06e6cc9704f91d088bcdbd938214002b067e3413586440b2087cb1268f7c154da4e3a9d854eb6a4eb64d1ae14b3b356976d78a3c82c2d77
- SSDEEP 96:ymG4rzKRCsLAuMRCvTEpU37CaCMoCOTlLU37CaCMoCgjWF3uTlJyJ5Mj15a9Q+5N:zZ0CsLiCoiGHMfGiGHMf8wwYoWYilopi
- TLSH T1A3224141720596F2F8522B34CB4313513BF3E7E8A718528B468E99348F567889FA96CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ezCLI\ezcli.exe
- Size 5.4MB
- SHA256 8d6ea47c60c7ab28f78697609c79ff3a7efef3cc9c24c8317947637a32b6b7ec
- MD5 2715f8dda76dd7a30e4a3cb13368ed9b
- SHA1 9380f5c519bbcd9254377e8e342e5a4d5a69f268
- SHA512 a452e84ca49d91a1fe8cfa1b949f749e057ef7c9703338fbc140c80a94ab25ae8c1b67ae1a8ab0d32f4b4f64d512dac65d86388261d01788423166d2c542e166
- SSDEEP 49152:WvOS5/XHlRyLp7yMRsZh/zPRS3mnaEjVD6r4vXiMQ9pCtiu8xfy9y1CtdiSZT70:2R7MpCgjCttfFmOfg3ZN1Aqg
- TLSH T1FF465C07F26291E8C06EC175836BA233E7327889493471EF7BA85B752F66F406B1D718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ezCLI\ezCLI.lnk
- Size 1KB
- SHA256 73b83742bd5a935807e0292202816e25bd70e0cbb822933f3f05c08c06d63f97
- MD5 80c30a5d3ab9ced23beedb33d62c8255
- SHA1 0b8142fccd99e67a97a6d6092115c558b9aa2305
- SHA512 cf24f58703dbc808db1d46bec69219f485fe29a1dcae293cd99e2b0a6b593a4d414a28a0562536e8045148ed999f12b5d215806a59b9c2cc5b0a6f747bb6c250
- TLSH T18241B1007AEA172DE3621276BD668B319F32F805E7614F2F41C54541057214299B9F7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ezCLI\~zCLI.tmp
- Size 1KB
- SHA256 0f64293b3244488f898356fd615bb68f311441ea18d40792e8f83a5612d86d0a
- MD5 092f398b5e73d343798cdb3b12c20b06
- SHA1 62be27b226fe701f834feeab8048be90a3572131
- SHA512 6e8b3eaa7d957dfe903eaade3dde2fcd16ead4cdb62f7a9b3bfca9c01d91b91d8a1ddc06cbdea0fbbb58ad080e0e20c7630fa13a93e3eacb83fc7174a83a5cc2
- TLSH T1C041CD006AEA2729E3621276BE668A328F32FC01E7614F2F41C54581097514299BDF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI5AB9.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\157ed660-e6ea-4dea-85b0-2b3aa74c2ac5.tmp
- Size 3KB
- SHA256 63de6a92d652db3d7245bb241c309486626bec8a5a4393c4e4fdcaffa0f41990
- MD5 794928b1df458c3f18058956c9dc3fdb
- SHA1 5b02c6e71b5a5ac0defb69289d8a82ac6f113e8a
- SHA512 b2b52dfc0a44933b299a89b8d7766b93010f43a17cc8f0c56b774a87fedf78d9aab389a7176fdc989204e2551e6deb7d21b4779a608a4401c5fb14bd8f5d2fbe
- TLSH T15B6161336974AA378EE2CB06798A3B12A7A55027E5913FA4C6DC0F2C01D728C1351C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\3397e67d-88b1-49ee-b766-a67b39902e61.tmp
- Size 15KB
- SHA256 4e775e95ca2752ae8226161911f272339b83ce1d13908936c0a0517db75a9f10
- MD5 b22cdb433819a1bf706fa61334eb1be1
- SHA1 c3fb47d636e75dbb60da92cd1de778131ced1496
- SHA512 6475ebc24d14ea1a330e920fcc908e586baa0a4b9d704e178681b0eb08057048e0bde9f9f5648a22ca610f644fd7a2fa2964615862dbc0a6f73189b7edd3e23a
- SSDEEP 384:s+OBqImmJvGBLx3NaFMJFPNBSYgOK9fODfcatj:NcvGtlNHKJicC
- TLSH T14D72AE3B2D757A232CF7C60BBE8E2747CB69616380917BF5DCDC9F1E526B0841242926
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\5b54acac-c8e2-45f5-bb3d-78dad47ab071.tmp
- Size 2KB
- SHA256 ce13d9a95745b03324ba3f31dd0ae9cc71fb02a43a8613d04a92de272db20bf2
- MD5 2a9cd853d472f6b6576c1ae8bda9478f
- SHA1 381d73b2fc3fccc6aaf8ad9ea2ad1de765d358f5
- SHA512 2cde9bc549dda4082b7d1ee872be249d19eff709a1ea7dd0d09e9c9b1b305c8b60978f4c2b87387de9683b94598157aeeefb68d47f07526099d3313bea505304
- TLSH T1735197337824BB378AF78719798B3B23DF39516699613F2095CD4B2801D615C1705C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 adb0fc26fab02e3b25dbdf3cdb8bf58fe5da291376cceafb76a1ccea14a0e7d9
- MD5 b0b80b88951c3461ca4843f571abc33e
- SHA1 aaa4ad8184cb0530db3a6b49b257393b44ec3eea
- SHA512 85743c42f3cb93c64d4139ab014a0553700abe8f5a9132c3a3b8872eb46e7c342c2d5a92b45282fa92a25eef768797b281249761e14546dcdebde4870e488a19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 ae42ff63a181d76d65acf7fc97c39ecb00e2eca79d7f26545ea867f75fff3f8a
- MD5 37e91c29f9079a906559d87df2090f1e
- SHA1 bb576639a975ac16a404d5c59e318c5563d1f62a
- SHA512 0e6a28270e56b033ac30a04526a10e02f8c36443ce490f1dbbe35850e9360664e0e8d0921b7835eab866ccf4041b6c3eeed364f3f1f69e0fe15b45a8426fe11c
- TLSH T192D0121372110134C05021330542610C1403C20B51054105D4A896AE1A440E41903841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\428a39eb-6585-4713-bdf3-77dca1df486e.tmp
- Size 6KB
- SHA256 13018fddcf344e8d73a98a310bcdc2e6c6500d50f7f1e04233f8140ff1c5ae03
- MD5 f7ceb1fb81867c35af8dd666ff6fbfbf
- SHA1 a827ea17b670e8f17988cf1a00a7e611c67e64af
- SHA512 0b077b768cac7a7500fa803410c56f4afb129b1bc26dcdac8e99d968c4e33469f8a1bf988021a3d2f48a6d0a186935fd013a3ca315144227dfcde35a44feb30f
- SSDEEP 96:sty/d0+BFmWb9TkRo5h16Z0Us7/x+6MhmuecJe71ejefK+gfEf28XM1C7K:stKX2oeonUsV+Fde7QjxGfG6K
- TLSH T1FBD198025F24B97B4CCBE609BA35BB07D2F9507261D52E58E7FD8A2C04DA6CC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 984B
- SHA256 921b2e3fa0668e0fb19ef8086a1a345f3790e416e6c61937423c3c08ce09dfad
- MD5 2bf867b25b5f2914b0d614cb79172e4d
- SHA1 61b25e79bec69c2cb732ec7863b85acea8ef8b3a
- SHA512 bf13573f312badade1c159ccab2ac2bd7f65569272b9ddfb03501927db634222fa581a9b7c6b5e09824fedfcf2f28846667d608c2497c1562d332aa4491a1e5b
- TLSH T1A611200209CA043DC391383490DA410C7330E6266113BD0682C6F8FC3435729F35CD44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 759ae95bb59d52f301175a0843017708a59b26631d801eec1bc69cfa8cac9bea
- MD5 51cdc93c4b81179910df9652d85dd21e
- SHA1 1b4c2e6ec50139e9196cfa5b9cd9c872c7ee16dc
- SHA512 ca16b1a3862c1d2149f7ae31f4d36cf91174c258cf3b9e150ab746c1ca452dd321543c62c5578c3b9ae2266b912f0da71299c3d9511f6b9ed11db34e87a87d7a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Network\2b586f33-b852-4756-9e84-9fb4f759e37a.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.aryansingh.ezcli\EBWebView\Local State
- Size 1KB
- SHA256 4b43981d4239179720be5eff5fe69021e7dd281b98be2c936b453cf54d11d307
- MD5 46d66408e8728b3fe0ebc7f8f3d07664
- SHA1 a1ed94e77cae11c41a3ab3140eca419aa0d3f50d
- SHA512 967150059267d35e04b0937f3a39fc8215b1fb1d4327215b479817b5938197bd076263c30bc1306cdf83be14b4a57a4552168ba1aaaa3092c68bab96bd9f697d
- TLSH T1AB2142B3B4B86B32AD96574B324B3757AE20506B81616E1055CEC72812E204D5A29C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59c8f5.msi
- Size 2.8MB
- SHA256 b46507fafa1ef8da5e2fc642552d46a5426b156c0decfa0ee8c381087316d2f7
- MD5 dd8a79ab5bf0a2241662b004b9185778
- SHA1 5778684937c4aef7a95a2c5c6079302867be6e53
- SHA512 6aa28bf6da87b20d25e6a52a61b2662490c0dc7cf21aeab85c9adf91a3349f679b0260f29e8b20f99cbd1a50936f0d3b8b5358e7d5ec15972cc651e37474b5d5
- SSDEEP 49152:85bZjp9CioK+80/BlfxFMUjBRd2bNCWsj4AGH7HlAEHm7jG6MbfgZkvm:cjp9CXKo5vBjF2bNCcAIlAEG3G6cfgZb
- TLSH T1BFD5231B7F419532C8692DFA047A87A05E3DFC108F706983739A362DDEF12E09B659D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1192_407407343\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 61255792c5a855c06946fc1d90966388b175fc4a277443d1dbf637b03f6c3aa3
- MD5 927d4a6078d2391fbed8681ea1e7f64d
- SHA1 f760ac3d1a222264ffbd2a531731c4866afdb910
- SHA512 9af05343421750f3457bed75425094dca77214e3e59a849c6b7357de38c413d5b92c43ec4f7f833e6bc9fd8fd0c98a6595df2a0f28d1aa0bb7dce913f791c549
- SSDEEP 24576:wFo3DMPzdoO/vvTL/SQPvCFg/L+F07osEiJdNiBH5KBq5YOfc4h2PW1+ruv:2HI
- TLSH T1C657A12436F92200E7B79E3DA8F06A634D3A7D5B9C15DE8D45411B8E0822F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{451c1832-66ce-412e-a685-18c85d2eb68d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6261bb8773456446a23c7d21ae559d8cf71bb598ab2c40085b6b6bd2dc3eaa65
- MD5 2d9ab2ac7ffcf7d800a6bad1efeaab12
- SHA1 82c2fb33fc8b0fcb64652be8e3261b2f8c315696
- SHA512 518a38a86c41abe9cbcad4bda70edb79424a6e69bdd7d7fe07af3a885d8ad20c7a305722dc9800c11ce58378978a6cf163d44de7b4c8767c77e6ad2cb164c67e
- SSDEEP 96:FpQnU1vaqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:4nGb++uVmN
- TLSH T153D187085AF54711E2B3AB7228F18557A877B911EF33CB8E0198238E6631910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH