72b1e465a8ea4c509e4cd9e6dc11e1bb4d013b625e35363d8ad5f1c9a936e901

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SakoraSetup.exe
Size 114KB
Sample261030-l58bcabs9v
SHA256 72b1e465a8ea4c509e4cd9e6dc11e1bb4d013b625e35363d8ad5f1c9a936e901
MD5 90fef75901f3cf37f21ef9c859294667
SHA1 e9382837e4db99cbb7e22cec4dc49add4f0af6a7
SHA512 1aba8205ccc00eab2391661c45290509bfdead9539e92bcf07de51f4a062fd91d4e91a71b3487b8223ff642568ed1e9b21a837585a92c74ae5199f6b89502ba5
SSDEEP 3072:1rv+LsMjvFsOTb98xQT+5U5qwBpEAjSF9P:9WLsKB0Irzjs
TLSH
T1E4B39E1CBB268CF7D83245309997FAAF4A256D718D6A960FDB111B73DC335A1E60B302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3936	powershell.exe
9	1828	powershell.exe
10	3464	powershell.exe
12	5176	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4824	powershell.exe
5544	powershell.exe
2940	powershell.exe
1828	powershell.exe
5176	powershell.exe
3936	powershell.exe
3464	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Loads dropped DLL 8 IoCs

pid	Process
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe
5068	SakoraSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5180_22247564\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5180_1119916626\_locales\ca\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SakoraSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2136	ipconfig.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\URL Protocol	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora-studio	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora-studio\shell\open\command	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\shell\open\command	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\ = "URL:Sakora Protocol"	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\shell	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\shell\open	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\shell	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\shell\open\command\ = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Sakora\\launcher.vbs\" \"%1\""	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{5A97F9D0-848F-4D78-A445-A3E160FAAF39}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora\DefaultIcon	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Sakora\\Client\\RobloxPlayerBeta.exe,0"	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\shell\open\command	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\ = "URL:Sakora Studio Protocol"	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora-studio\DefaultIcon	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\shell\open	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora	SakoraSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sakora\shell\open\command	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora\shell\open\command\ = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\Sakora\\launcher.vbs\" \"%1\""	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\URL Protocol	SakoraSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sakora-studio\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Sakora\\Studio\\RobloxStudioBeta.exe,0"	SakoraSetup.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3936	powershell.exe
3936	powershell.exe
4824	powershell.exe
4824	powershell.exe
1828	powershell.exe
1828	powershell.exe
3464	powershell.exe
3464	powershell.exe
5544	powershell.exe
5544	powershell.exe
5176	powershell.exe
5176	powershell.exe
2940	powershell.exe
2940	powershell.exe
5540	powershell.exe
5540	powershell.exe
5540	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe
5180	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	5544	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5180	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3936	5068	SakoraSetup.exe	90
PID 5068 wrote to memory of 4824	5068	SakoraSetup.exe	92
PID 5068 wrote to memory of 1828	5068	SakoraSetup.exe	95
PID 5068 wrote to memory of 3464	5068	SakoraSetup.exe	97
PID 5068 wrote to memory of 5544	5068	SakoraSetup.exe	99
PID 5068 wrote to memory of 5176	5068	SakoraSetup.exe	101
PID 5068 wrote to memory of 2940	5068	SakoraSetup.exe	103
PID 2940 wrote to memory of 3440	2940	powershell.exe	105
PID 2940 wrote to memory of 3720	2940	powershell.exe	107
PID 2940 wrote to memory of 2136	2940	powershell.exe	109
PID 5068 wrote to memory of 3372	5068	SakoraSetup.exe	110
PID 5068 wrote to memory of 5180	5068	SakoraSetup.exe	115
PID 5180 wrote to memory of 4260	5180	msedge.exe	116
PID 5180 wrote to memory of 2240	5180	msedge.exe	118
PID 5180 wrote to memory of 2424	5180	msedge.exe	119
PID 5180 wrote to memory of 2424	5180	msedge.exe	119
PID 5180 wrote to memory of 2424	5180	msedge.exe	119
PID 5180 wrote to memory of 4300	5180	msedge.exe	120
PID 5180 wrote to memory of 4300	5180	msedge.exe	120
PID 5180 wrote to memory of 2276	5180	msedge.exe	122
PID 5180 wrote to memory of 4528	5180	msedge.exe	121
PID 5180 wrote to memory of 2276	5180	msedge.exe	122
PID 5180 wrote to memory of 2276	5180	msedge.exe	122
PID 5180 wrote to memory of 4528	5180	msedge.exe	121
PID 5180 wrote to memory of 4528	5180	msedge.exe	121
PID 5180 wrote to memory of 4160	5180	msedge.exe	123
PID 5180 wrote to memory of 4160	5180	msedge.exe	123
PID 5180 wrote to memory of 4160	5180	msedge.exe	123
PID 5180 wrote to memory of 2776	5180	msedge.exe	124
PID 5180 wrote to memory of 2776	5180	msedge.exe	124
PID 5180 wrote to memory of 2776	5180	msedge.exe	124
PID 5180 wrote to memory of 1172	5180	msedge.exe	126
PID 5180 wrote to memory of 1172	5180	msedge.exe	126
PID 5180 wrote to memory of 5988	5180	msedge.exe	127
PID 5180 wrote to memory of 5988	5180	msedge.exe	127
PID 5180 wrote to memory of 5988	5180	msedge.exe	127
PID 5180 wrote to memory of 5012	5180	msedge.exe	128
PID 5180 wrote to memory of 5256	5180	msedge.exe	129
PID 5180 wrote to memory of 5012	5180	msedge.exe	128
PID 5180 wrote to memory of 5256	5180	msedge.exe	129
PID 5180 wrote to memory of 728	5180	msedge.exe	131
PID 5180 wrote to memory of 5340	5180	msedge.exe	134
PID 5180 wrote to memory of 5340	5180	msedge.exe	134
PID 5180 wrote to memory of 1840	5180	msedge.exe	135
PID 5180 wrote to memory of 1840	5180	msedge.exe	135
PID 5180 wrote to memory of 1508	5180	msedge.exe	136
PID 5180 wrote to memory of 1508	5180	msedge.exe	136
PID 5180 wrote to memory of 2136	5180	msedge.exe	138
PID 5180 wrote to memory of 2136	5180	msedge.exe	138
PID 5180 wrote to memory of 2660	5180	msedge.exe	139
PID 5180 wrote to memory of 3720	5180	msedge.exe	140
PID 5180 wrote to memory of 1536	5180	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\SakoraSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SakoraSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Sakora\download.ps1" "http://sakorarevival.duckdns.org:8080/setup/SakoraClient.zip" "C:\Users\Admin\AppData\Local\Temp\SakoraClient.zip"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\AppData\Local\Temp\SakoraClient.zip', 'C:\Users\Admin\AppData\Local\Sakora\Client')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "try { ([string](Invoke-WebRequest -UseBasicParsing -Uri 'http://sakorarevival.duckdns.org:8080/setup/client-version.txt' -TimeoutSec 20).Content).Trim() | Set-Content -Path 'C:\Users\Admin\AppData\Local\Sakora\client-version.txt' } catch {}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Sakora\download.ps1" "http://sakorarevival.duckdns.org:8080/setup/SakoraStudio.zip" "C:\Users\Admin\AppData\Local\Temp\SakoraStudio.zip"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\AppData\Local\Temp\SakoraStudio.zip', 'C:\Users\Admin\AppData\Local\Sakora\Studio')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "try { ([string](Invoke-WebRequest -UseBasicParsing -Uri 'http://sakorarevival.duckdns.org:8080/setup/studio-version.txt' -TimeoutSec 20).Content).Trim() | Set-Content -Path 'C:\Users\Admin\AppData\Local\Sakora\studio-version.txt' } catch {}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Sakora\network.ps1" install
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" interface portproxy delete v4tov4 listenaddress=127.0.0.2 listenport=80
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3440
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenaddress=127.0.0.2 listenport=80 connectaddress=sakorarevival.duckdns.org connectport=8080
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3720
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2136
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "Sakora Connection" /TR "powershell -NoProfile -ExecutionPolicy RemoteSigned -File \"C:\Users\Admin\AppData\Local\Sakora\network.ps1\" install" /SC ONSTART /DELAY 0000:30 /RU SYSTEM /RL HIGHEST /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sakorarevival.duckdns.org:8080/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffc4a96c188,0x7ffc4a96c194,0x7ffc4a96c1a0
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,4379581646767303140,14612724549747322207,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,3522124638366756890,11420929349799684639,262144 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,9286954218975374662,18035292577594334746,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,4664262280481164424,14121017173487602321,2097152 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14750536867643485179,9584676171396364727,2097152 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4603811925129360196,5804819963618389352,2097152 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,3040075466368815162,4239196816094314170,2097152 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6003493175702287974,10344390167933153997,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5448,i,4608966940475121435,2517566323952421170,2097152 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11387076545694078465,17207777974692757435,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,16633683815279943400,17981337311249671983,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,1649568232259221662,7362915555626434007,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,1649568232259221662,7362915555626434007,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,1910788150118463985,8425670096510702479,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,12525535879142671534,14300412628426182686,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,10649229938349331573,16018440783405292067,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,3675132652285518865,16263410245640266086,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,17144067325548841153,5496363986578672081,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,1052375700713164363,17599528446090810808,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,2469136095134394280,9529619680706317395,524288 --field-trial-handle=2520,i,11288591409016090732,5678270468489798555,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:14
    3⤵
    PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
1⤵
PID:4688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

272a8fb0-86a5-47c9-b2e6-ed9bc2aeb006.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\272a8fb0-86a5-47c9-b2e6-ed9bc2aeb006.tmp
Size 33KB
SHA256 f46c328b2df30bf1c76bcaeb7821f6e1eb85f82904155d0c1c0c80d1ad646ada
MD5 f39fdc14e84e70122a0bfa9eb4bbb238
SHA1 11ef0530ed362d8a3d4e6530a40faf2bff1eb31f
SHA512 3c4af51cd6e9b3b368de62352d773d8719240f27b66ede2c591ef069e29147a2532c577f46bab640180ad11535847a266785e782be78e411b0655f5d3ee17e73
SSDEEP 768:vm3OWGmc7fZrKrHCp5XSwQs88uBkiT2Y6ruAL4:vm3OWotrG8ILNBhIZs
TLSH
T121F2AF38EC949C639CA79381775A3743AFE46157C8C80B98D9DE661D01C739E2B8B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a23862-33b3-41f2-8c9c-482b7f6b7421.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56a23862-33b3-41f2-8c9c-482b7f6b7421.tmp
Size 33KB
SHA256 2a9237b1f65e6ba052e257ceb83860659cd352a3d6018b8d4993fc8039034322
MD5 61a473132beab525a8c4ca60db56295b
SHA1 59df9f77208f2dae0d385dac922e62f038fee10a
SHA512 98c0eeab3330732e474125f46c77bffa2e2f6264177795b1ecce2d7919295775a5d01467624c94e8873d25c0f7df4256eb6ff8b7b184a8dca49fe16149f4202d
SSDEEP 768:Vm3ZWGmc7fZrKrHCp5XSwQs88uBkiT2Y6ruAL4:Vm3ZWotrG8ILNBhIZs
TLSH
T1EEF2AF34EC949C639CA69381775A3743AFE46157C8C80F98D9DE661D01C735E3B8B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

603feb91-09bc-4e66-af30-d8b8891395e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\603feb91-09bc-4e66-af30-d8b8891395e2.tmp
Size 38KB
SHA256 3c5b74c606934fba1cf890591c9b51b4f992440f0168a32a0584036b0f49a811
MD5 59c4695cffcfbafbe38ad7d4e5b43f7d
SHA1 6230cf99ece57d4c8aab51ddd69ce161ed87c3ed
SHA512 3ef054c7b5cc27628b01651beec43dd3e3006592b8fcc35d7f9aaa8f80d5199e969797249f071107d17ef399aafb53642501d07bf6483953f4d115209d66d2a1
SSDEEP 768:z/UxvxjgC+W3ciwc7fZrKrHXp5XSwQs88uBkiTzY/P84g:GZj3+W3cGtrG5ILNBqHg
TLSH
T1D103C139F8945C63ACB7D345375B275BAFF02063C4C40E9489EE6A0E028775D6B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

0aec5461-0b14-40c3-a2ae-fc6dc11ddf2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0aec5461-0b14-40c3-a2ae-fc6dc11ddf2a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3be8af00-3722-402e-ade5-3bba980d21bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3be8af00-3722-402e-ade5-3bba980d21bd.tmp
Size 12KB
SHA256 ebec19a6754a0a1b85ea42b1948b50461abb782f2d14098d10064a7941a503d0
MD5 13cfe383147fe5993b5bc352cea7a478
SHA1 bebf8f5f81d7d76ce58197d2ac4672b21e8429d5
SHA512 13b21a25bb084390bc25075f3208bc3f4de33c46fd4053e00769ab3352ff646d190bb27405223f65d69eccce81666af8da9b40367639e785f0197862301ce67f
SSDEEP 192:sxRaR7CA/fSsm0ZA1gzoA8pEX/g6+WNWqh/YErgxnGsIgDu+HJ:sxRaQA/fSsmK8m/5F/v6Hp
TLSH
T1C042D815AD28A93B8CDBE319BB657F53D6FD1032A1901E48BAFC8A1C04E76DD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4df13509-ff09-4851-b45d-729bebe668cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4df13509-ff09-4851-b45d-729bebe668cc.tmp
Size 29KB
SHA256 ae1bf924547ce389ed40ee52455e33e4ea6979d400eebc5ea0d9508c9f3bcdd2
MD5 3b98095ed9604f474e1d51665bdef01e
SHA1 1994925835ed244c36559856e34f32f9a8702927
SHA512 55860589344d266d9b9c1a79fb7d8d8df8e612bbe67c85fe47bda366840d024a17499e8a251b4a50c0f568962e8ca920762e94e1b4ca047222554cd7ef08e10b
SSDEEP 768:U/pCy37pLuLjJmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAXuyhpZroJa:U/pCyxEjJmWg8KfrLu1jarXu8pSQ
TLSH
T16CD2D97B740CCA7F4F804ADDA8197ADB6DA802CB9A98CD4047FE941C02C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cd12f4d-98ac-4c16-9c12-df43210284e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8cd12f4d-98ac-4c16-9c12-df43210284e7.tmp
Size 11KB
SHA256 4847e1cde69258068c734ef50805e6166a6d82fb7d1aabe38059d5022be0fa7d
MD5 9ded5823e5d5a71f185b18ae48bd6bdc
SHA1 b04f2f620258e7d5fa549d090b5d4d20179e256d
SHA512 e18039fee8cf29c2e4242abec4b347d499baf7705a6bd2fad62bacf2bda2b5118671d818b465e8c459cd5cbdf7189a0968acf807426802268940feb12b393b5a
SSDEEP 192:sxRpR7CA/fSsi0ZA1gzoA8pEX/g6+WNWqh/YEWnnGsIgV+HJ:sxRpQA/fSsiK8m/5F/Esp
TLSH
T12F42C905AD28A93B8CDBD319BB657F53D6FD1032A1941E48F6FD8A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 34KB
SHA256 13017fba91e21e476d94aa0b149a6e5b667794ac61dacb7c6c37e63dfb09ba33
MD5 04f707c2ddafdc0e5356011dbdbf3b17
SHA1 10eb933d3bfba5d532aca605cb9a2c75884fc2f9
SHA512 06710e3fee5e7bd6c590f1f12cf8f7222ac40358992e544bcde03cef120439a014768dc20c43c6d51155a400b68a8f1aef1f1d2c5197a7c25aa8d08ef3ab3786
SSDEEP 384:fKWHVcGdiPulI5rTRuqCNz99bYVmwjEdCzL7nG84EDGTjVp7LoatPZcdOQxu9zsh:yBVu8rTkzldCzL7njMdpLtBemAJ
TLSH
T1C5F2F17E8780DDF6CD06DDB940BE5456DA40220EBAD70441FEFAD059BB50B77005E9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 8809c4c5626218074b1a66b456e82ba56692aea6d4971e6f86211f5d5add7802
MD5 1f41e3abfe8168309be129afad1f1332
SHA1 00d2de8b9b3f4e1c2dc705bdcb3809591093d927
SHA512 f336915688422ac94251bcda763d7bbee65a791df8c76027d3b7f014400d01bdc2ebc8b2c59aaca7ed3327efb7cd137cef13336347986ea0d41e2eda93be6e8c
TLSH
T1DC51A3A044D168B3EBB42731C1CE36E77E74DEB556832E4312AADFBD6F467A48002174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e3655ca8854783b8f237b15440ba67611a7ee262c3a251727ae616372bdda90e
MD5 cd46f6d7a9d89afca59e542f66e93078
SHA1 6e25ab77adfd0de31318eef4cfb88d0054efda8d
SHA512 7077e8087d96cbbd7f1e95ce66590735cf1bb35a46cb54b436028729d6d0d188f0e171e2d849b7a7f28d4d23cdf2c07102548ef097fd2cca6f7098076d4bef78
TLSH
T1CB51B6A044D128B3EBB46731C1CE36E77E749EB556832E4312AADFFD6F467A48002174
MD5 SHA1 SHA512 TLSH

Submit Download

31f584a6-e299-4339-88a7-3ff2f8a0133c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\31f584a6-e299-4339-88a7-3ff2f8a0133c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e1fe6610-86e4-43e1-8d35-625188776cb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e1fe6610-86e4-43e1-8d35-625188776cb0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e68b6ec2-c7a7-4872-81d4-6a7ec60a3536.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e68b6ec2-c7a7-4872-81d4-6a7ec60a3536.tmp
Size 11KB
SHA256 cdd3116fabf4082c19e8490c3bc8954f173581bdae39ac72b73ba1a72fd1bea2
MD5 cf232aff7fc5e8a6675573bec05c852e
SHA1 8128e4718862f23aff11ffe1ff64bf2fb9d71db4
SHA512 46e6f815a7b57a91c9d26caf66c654324c2281fc284bc9e04f31e374365989f357916a78aa038a502c8c94ebff4d27c56c226c685a6161823e0bf80fb0660145
SSDEEP 192:sxRaR7CA/fSsm0ZA1gzoA8pEX/g6+WNWqh/YEWnnGsIgD8+HJ:sxRaQA/fSsmK8m/5F/ENp
TLSH
T11B42D905AE28A93B8CDBD319FB657F53D6FC1032A1901E48BAFC8A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0af98e9-1d35-4e91-ba6f-44b7b48fa5cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0af98e9-1d35-4e91-ba6f-44b7b48fa5cf.tmp
Size 37KB
SHA256 1e0bf58edc218d24cc2c1464f7483e481ba2e3e9557c72c855316d37cf4fc090
MD5 117411bfca6cd1fb9e988eff295113f2
SHA1 3a2bb7dbd5025b35fa2769cf258e23baa63aad46
SHA512 3ff13dd6a21be99461e812078abebf5c67d7c59aaf6fb1d703e0114a9ea3afa12b71558a2781a29db60dd65e6cb66e1dacc2ebe16ae774c5ad7b3cfa81b46112
SSDEEP 768:R/UxvxjgC+W31ihc7fZrKHp5XSwQs88uBkiTCW/P84g:kZj3+W31ftrYILNBrHg
TLSH
T12E03D039EC946863ACB7A385375B275BAFF05053C0C40BA849EE7A1E028B35D6707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bad126f4-7eab-4ef5-89ad-7c01fd4c089e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bad126f4-7eab-4ef5-89ad-7c01fd4c089e.tmp
Size 38KB
SHA256 6d73c0ff1a2481942784382c45408b66280ee07509efc8747ea76cb33790babc
MD5 9942e682754db44de0f019e06092ddea
SHA1 df483b73f6bbf8ac5a0966e6b9df4339ae7eddd0
SHA512 9e749d80050fc03d4203cbc8dee2725fecabbc037591ff249434cbdff24755d7a01ad2ede6ba5585a9d642d7967aae2bcd53980cf21c08b4e7f792454c7d1218
SSDEEP 768:S/UxvxjgC+C38WWmc7fZrKrHjp5XSwQs88uBkiT2Yicf:XZj3+C38W4trGNILNBhVf
TLSH
T15403B038BC94AC639CF7E345775B2757EFF4205384C40AA899EE9A0E028735D2B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99967f23-36ed-4335-a20a-43ec4a42b53f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\99967f23-36ed-4335-a20a-43ec4a42b53f.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

e482aec9-925d-4fcc-b1b0-c2e9ec1b7888.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e482aec9-925d-4fcc-b1b0-c2e9ec1b7888.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 2de31f5d5ed56cb061201caade51a36a94ca72dc0ad43cf9f3f4fa7375bd463f
MD5 272a1c104c747b46c906704bff960ff9
SHA1 bc113d9e9bc3d490908e4b8af17a5839a50cb9d1
SHA512 e6a57b2ed9daae0173441fdcdebca947927f9c8b58c91a8a031babb8e985139dfe3c5134331289d1f8b7e2f4b84ab2d0762c09f8dd4f96de79831d3f82267802
SSDEEP 1536:5td5Yo2hO3vdfKQVrflJdCHYWh4iUx9R40i71YidyPcMrxzi3jiRjdvRwa5eDjIj:5v5Yo2hO3vdfKQVrflJdwYWqiU9RCqe6
TLSH
T1585374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download