11 mincritical
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days
Multiple state-aligned actors rapidly adopted the BlueMoon exploit kit chaining Chrome and Windows zero-days to deliver espionage malware like GemStone and ShadowPad. BlueMoon chains a V8 type confusion RCE, a V8 sandbox escape, and a Windows kernel LPE to execute payloads via curl. Four espionage-motivated clusters, primarily China-aligned, used it in targeted spearphishing campaigns against NGOs, aerospace, and manufacturing sectors. The kit shows potential AI-assisted development artifacts and high detection signals.
Sens:■ Immediate
IOCs72
32domain17url16sha2563cve2file path1ip1registry key
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch Chromium-based browsers to latest stable versions immediately
- Update older Windows builds (17763, 19041-19045, 20348, 22000) to latest releases
- Block known BlueMoon delivery domains and C2 infrastructure at network perimeter
- Hunt for default process tree: chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe
Key Takeaways
- TA412 first used BlueMoon on August 28, 2026, targeting US NGOs and mining firms.
- BlueMoon exploits patch-gap zero-days in Chromium V8 engine and older Windows builds.
- Default exploitation executes a curl command to download and run msgbox.exe.
- TA412 delivered GemStone, a malicious Chromium extension masquerading as Google Gemini.
- UNK_LateNight delivered ShadowPad using a DLL-sideloading chain and scheduled task persistence.
- UNK_DoubleCheck used a Rust loader connecting to a Cloudflare R2 bucket for C&C.
- UNK_QuietRacket used Google DNS-over-HTTPS for C&C resolution via TXT records.
Attack Chain
- Initial Access: Spearphishing emails with actor-controlled links to BlueMoon exploit kit pages
- Exploitation: V8 type confusion RCE (CVE-2026-85046) and sandbox escape (CVE-2026-87491) in Chrome
- Privilege Escalation: Windows kernel LPE (CVE-2026-85880) escapes renderer sandbox on older Windows builds
- Payload Download: Shellcode injects CreateProcess stub into Chrome broker, runs curl to download payload
- Persistence: Payloads use scheduled tasks, registry, or malicious browser extension for persistence
- C&C and Exfiltration: Implants beacon to actor infrastructure over HTTPS, Cloudflare Workers, or DNS-over-HTTPS
Affected Systems
- Chromium-based browsers (Chrome, Edge, Brave, Vivaldi)
- Windows 10 1809 / Server 2019 (Build 17763)
- Windows 10 2004-22H2 (Builds 19041-19045)
- Windows Server 2022 (Build 20348)
- Windows 11 21H2 (Build 22000)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85046 | Chromium V8 JavaScript engine | High | Type confusion in V8 JIT compiler TurboFan allows remote code execution in browser renderer. |
| CVE-2026-87491 | Chromium V8 JavaScript engine | High | V8 sandbox escape via corrupting WebAssembly module metadata to execute shellcode. |
| CVE-2026-85880 | Microsoft Windows Kernel | High | Windows kernel LPE zero-day in older builds used to escape renderer process sandbox. |
Detection Availability
- Published: YARA, Snort/Suricata
- Platforms: Proofpoint ET rules, Proofpoint YARA rule
YARA rule for BlueMoon exploit kit and six ET rules for loader and C2 beacon detection are available.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Default chain produces high-signal process tree: chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe. |
| Network Visibility | Medium | C2 uses Cloudflare Workers, DNS-over-HTTPS, and standard HTTPS, blending with legitimate traffic. |
| Detection Difficulty | Moderate | Default deployment has high detection signals, but obfuscated variants and legitimate infrastructure abuse increase difficulty. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for browser processes spawning command interpreters that invoke curl to download executables (T1059, T1105). | EDR process trees and command-line logs | Execution | Low — unusual chain for normal browsing |
| Hunt for scheduled tasks named EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, or GeForceService executing non-standard binaries (T1053.005). | Windows Task Scheduler logs, EDR | Persistence | Low — names mimic updates but paths are anomalous |
| Hunt for DNS TXT queries to dns.*.com domains resolving to Cloudflare Worker subdomains, indicating DoH-based C2 (T1071.004, T1568.002). | DNS logs, network proxy logs | Command and Control | Medium — DoH usage is increasing legitimately |
| Hunt for Chromium preference file modifications followed by browser restarts with --restore-last-session, indicating extension hijacking (T1547.001). | EDR file modification logs, process command-line logs | Persistence | Low — specific to extension forgery technique |
Required Log Sources
- EDR process creation and command-line logs
- DNS query logs (including DoH)
- Proxy/web gateway logs
- Scheduled task creation logs
- Registry modification logs
Key Behavioral Indicators
- chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe process tree
- Session storage key v8ctf_exp_attempt in Chrome
- Mutex named Dataupcheckinfo (UNK_DoubleCheck)
- Registry write to HKCU\SOFTWARE\Classes\CLSID{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32
- ChromeUpdate.exe or msgbox.exe dropped to %TEMP%
- Scheduled tasks: EdgeCore_AutoUpdate, Avpcheckup, GeForceService
Control Gaps
- DNS filtering may miss C2 over Google DoH TXT record lookups
- Cloudflare Worker domains may be allow-listed as CDN infrastructure
- DLL-sideloading using legitimate binaries may bypass application whitelisting
- Browser extension HMAC forgery bypasses Chromium Secure Preferences protection
False Positive Assessment
Low — Default BlueMoon process tree and known IOCs are highly specific, though Cloudflare Worker and DoH usage may blend with legitimate traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block DNS-over-HTTPS at the network perimeter if not required for business
- Implement SSL inspection for Cloudflare Worker traffic to detect C2 beacons
- Monitor and alert on TXT record lookups to dns.*.com domains
- Block access to known Cloudflare R2 bucket and Worker C2 endpoints
User Protection
- Deploy EDR with behavioral detection for process injection and DLL sideloading
- Enable browser extension installation restrictions via enterprise policy
- Monitor for unauthorized browser extension installations and preference file tampering
- Implement email filtering for spearphishing lures targeting academic and conference themes
Security Awareness
- Train employees to verify unsolicited internship and conference invitations
- Warn users about clicking links in emails from external senders posing as students
- Educate staff on verifying sender domains for government and aerospace-themed requests
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping22 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
A new hacking toolkit called BlueMoon lets attackers break into computers by exploiting unpatched flaws in the Chrome web browser and older versions of Windows. Multiple government-backed hacking groups, mostly aligned with China, started using it quickly in August and September 2026 to target organizations in the US, Vietnam, and Singapore. The attackers sent phishing emails with links that, when clicked, silently installed malware like ShadowPad or a fake browser extension called GemStone. Organizations should patch their browsers and Windows systems immediately and educate employees on spotting phishing emails.
Additional IOCs
- Domains:
msbenefit[.]com- TA412 delivery and download domainattcdn[.]com- TA412 delivery and download domainchecrity[.]com- UNK_LateNight ShadowPad C&C domainaurexdefense[.]online- UNK_LateNight suspected delivery domaincyclokinetics[.]online- UNK_LateNight suspected delivery domainsncorp[.]fit- UNK_LateNight suspected delivery domaintcomlp[.]online- UNK_LateNight suspected delivery domainbosch-sensortec[.]site- UNK_LateNight suspected delivery domainsmxtech[.]xyz- UNK_LateNight suspected delivery domainlindes[.]ink- UNK_LateNight suspected delivery domainsilvustechnologies[.]online- UNK_LateNight suspected delivery domainworldview[.]fit- UNK_LateNight suspected delivery domainemcore[.]ink- UNK_LateNight suspected delivery domainairindia[.]fit- UNK_LateNight suspected delivery domainairliquide[.]lol- UNK_LateNight suspected delivery domainapollohospitals[.]fit- UNK_LateNight suspected delivery domainhaloengines[.]net- UNK_LateNight suspected delivery domainjetoptera[.]co- UNK_LateNight suspected delivery domainairproducts[.]ink- UNK_LateNight BlueMoon exploit delivery domainprecipart[.]ink- UNK_LateNight BlueMoon exploit delivery domainepsilonsystems[.]net- UNK_LateNight BlueMoon exploit delivery domainrocketlabusa[.]ink- UNK_LateNight BlueMoon exploit delivery domainspectrolab[.]fit- UNK_LateNight BlueMoon exploit delivery domainopenlumakara[.]com- UNK_QuietRacket exploit delivery domaingetaiexo[.]com- UNK_QuietRacket C&C domainvelodynaity[.]com- UNK_QuietRacket C&C domain
- Urls:
hxxps://recommendation-letter[.]secboxes[.]com/ChromeUpdate.exe- TA412 download URL for ChromeUpdate.exehxxps://project[.]secboxes[.]com/ChromeUpdate.exe- TA412 download URL for ChromeUpdate.exehxxps://download[.]secboxes[.]com:443/dist.zip- TA412 download URL for dist.zip (GemStone extension)hxxps://api-prod[.]secboxes[.]com:443/download- TA412 download URLhxxps://evidence[.]msbenefit[.]com/msgbox.exe- TA412 download URL for msgbox.exehxxps://zki0y83[.]msbenefit[.]com:443/feed- TA412 download URLhxxps://homepage[.]brianwilli[.]com/d/calibre-launcher.dll- UNK_DoubleCheck download URL for calibre-launcher.dllhxxps://homepage[.]brianwilli[.]com/d/wint.exe- UNK_DoubleCheck download URL for wint.exehxxps://homepage[.]brianwilli[.]com/d/85rY.dat- UNK_DoubleCheck download URL for 85rY.dathxxps://homepage[.]brianwilli[.]com/d/SysPr.prx- UNK_DoubleCheck download URL for SysPr.prxhxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita.exe- UNK_DoubleCheck download URL for krita.exehxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita.dll- UNK_DoubleCheck download URL for krita.dllhxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/SysPr.prx- UNK_DoubleCheck download URL for SysPr.prxhxxps://app[.]eduac[.]workers[.]dev/Service- UNK_QuietRacket DLL-sideloading pair download URLhxxps://app[.]eduac[.]workers[.]dev/Updateac- UNK_QuietRacket DLL-sideloading pair download URLhxxps://small-union-7018[.]daoahueb[.]workers[.]dev/- UNK_QuietRacket DLL-sideloading pair download URLhxxps://snowy-block-ae0a[.]daoahueb[.]workers[.]dev/- UNK_QuietRacket DLL-sideloading pair download URL
- File Hashes:
ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b(SHA256) - TA412 BlueMoon exploit JavaScripte950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004(SHA256) - TA412 dist.zip (GemStone extension archive)a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5(SHA256) - UNK_LateNight Index.js (BlueMoon exploit JavaScript)295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915(SHA256) - UNK_LateNight msgbox.exe loaderbc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360(SHA256) - UNK_LateNight mctsetup64.dll (sideloading DLL)b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b(SHA256) - UNK_QuietRacket Loader.js (BlueMoon exploit JavaScript)8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f(SHA256) - UNK_QuietRacket Indostartupexpo.js (BlueMoon exploit JavaScript)f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c869e2bc5cb8f671664e7(SHA256) - UNK_QuietRacket GFExperienceUpdate.dll loader87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22(SHA256) - UNK_QuietRacket GFExperienceUpdate.dll loader (second sample)ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69(SHA256) - UNK_DoubleCheck font-01.js (BlueMoon exploit JavaScript)ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141(SHA256) - UNK_DoubleCheck calibre-launcher.dll (sideloading DLL)3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726(SHA256) - UNK_DoubleCheck SysPr.prx (encrypted payload)3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432(SHA256) - UNK_DoubleCheck krita.dll (sideloading DLL)6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d(SHA256) - UNK_DoubleCheck SysPr.prx (encrypted payload, second sample)
- Registry Keys:
HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32- UNK_DoubleCheck persistence registry key
- File Paths:
C:\Users\Public\stomp_ext- TA412 GemStone extension extraction path%TEMP%\msgbox.exe- Default BlueMoon payload download path
- Command Lines:
- Purpose: Downloads and executes payload via curl | Tools:
cmd.exe,curl.exe| Stage: Payload Download
- Purpose: Downloads and executes payload via curl | Tools:
- Other:
extension-management-portal.centerfjdr658.workers.dev- TA412 GemStone extension C&C hostnameextension-management-portal.kmjukilo-lkjh.workers.dev- TA412 GemStone extension C&C hostnamerecommendation-letter.secboxes.com- TA412 BlueMoon exploit page hostnameasianstudies.secboxes.com- TA412 BlueMoon exploit page hostnamematerials-project.secboxes.com- TA412 BlueMoon exploit page hostnameproject.secboxes.com- TA412 BlueMoon exploit page hostnameevidence.msbenefit.com- TA412 BlueMoon exploit page hostnamedata.attcdn.com- TA412 BlueMoon exploit page hostnamems.checrity.com- UNK_LateNight ShadowPad C&C hostnameyhv41nji.workers.dev- UNK_QuietRacket BlueMoon exploit delivery hostnamewcce.joinmacket.com- UNK_QuietRacket BlueMoon exploit delivery hostnamepublish.openlumakara.com- UNK_QuietRacket BlueMoon exploit delivery hostnameeduac.workers.dev- UNK_QuietRacket delivery, download, and C&C hostnamedaoahueb.workers.dev- UNK_QuietRacket download hostnamedns.elixnovorem.com- UNK_QuietRacket C&C domain for TXT lookupdns.getaiexo.com- UNK_QuietRacket C&C domain for TXT lookupv93xdd5g.workers.dev- UNK_QuietRacket C&C hostnameblack-flower-9250.v93xdd5g.workers.dev- UNK_QuietRacket C&C hostnamemailtbox.workers.dev- UNK_DoubleCheck BlueMoon exploit delivery hostnamevncdc.mailtbox.workers.dev- UNK_DoubleCheck BlueMoon exploit delivery hostnamehomepage.brianwilli.com- UNK_DoubleCheck download hostname1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com- UNK_DoubleCheck download hostname (Cloudflare R2)[email protected]- UNK_LateNight sender email[email protected]- UNK_LateNight sender email[email protected]- UNK_LateNight sender email[email protected]- UNK_LateNight sender email[email protected]- UNK_LateNight sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender email[email protected]- UNK_QuietRacket sender emailDataupcheckinfo- UNK_DoubleCheck mutex nameEdgeCore_AutoUpdate- UNK_LateNight scheduled task name for persistenceMicrosoftEdgeUpdatesTaskMachine- UNK_DoubleCheck scheduled task name for persistenceAvpcheckup- UNK_DoubleCheck scheduled task name for persistenceGeForceService- UNK_QuietRacket scheduled task name for persistence
Showing defanged values
- cveCVE-2026-85046Type confusion in V8 JIT compiler TurboFan allows remote code execution in browser renderer.
- cveCVE-2026-85880Windows kernel LPE zero-day in older builds used to escape renderer process sandbox.
- cveCVE-2026-87491V8 sandbox escape via corrupting WebAssembly module metadata to execute shellcode.
- domainairindia[.]fitUNK_LateNight suspected delivery domain
- domainairliquide[.]lolUNK_LateNight suspected delivery domain
- domainairproducts[.]inkUNK_LateNight BlueMoon exploit delivery domain
- domainapollohospitals[.]fitUNK_LateNight suspected delivery domain
- domainattcdn[.]comTA412 delivery and download domain
- domainaurexdefense[.]onlineUNK_LateNight suspected delivery domain
- domainbosch-sensortec[.]siteUNK_LateNight suspected delivery domain
- domainbrianwilli[.]comUNK_DoubleCheck download domain
- domainchecrity[.]comUNK_LateNight ShadowPad C&C domain
- domaincyclokinetics[.]onlineUNK_LateNight suspected delivery domain
- domainelixnovorem[.]comUNK_QuietRacket C&C domain for TXT lookup
- domainemcore[.]inkUNK_LateNight suspected delivery domain
- domainepsilonsystems[.]netUNK_LateNight BlueMoon exploit delivery domain
- domainfracons[.]comUNK_DoubleCheck C&C domain
- domaingetaiexo[.]comUNK_QuietRacket C&C domain
- domainhaloengines[.]netUNK_LateNight suspected delivery domain
- domainjetoptera[.]coUNK_LateNight suspected delivery domain
- domainjoinmacket[.]comUNK_QuietRacket BlueMoon exploit delivery domain
- domainlindes[.]inkUNK_LateNight suspected delivery domain
- domainmsbenefit[.]comTA412 delivery and download domain
- domainms[.]checrity[.]comUNK_LateNight ShadowPad C&C domain
- domainopenlumakara[.]comUNK_QuietRacket exploit delivery domain
- domainprecipart[.]inkUNK_LateNight BlueMoon exploit delivery domain
- domainrocketlabusa[.]inkUNK_LateNight BlueMoon exploit delivery domain
- domainsecboxes[.]comTA412 delivery and download domain
- domainsilvustechnologies[.]onlineUNK_LateNight suspected delivery domain
- domainsmxtech[.]xyzUNK_LateNight suspected delivery domain
- domainsncorp[.]fitUNK_LateNight suspected delivery domain
- domainspectrolab[.]fitUNK_LateNight BlueMoon exploit delivery domain
- domaintcomlp[.]onlineUNK_LateNight suspected delivery domain
- domainvelodynaity[.]comUNK_QuietRacket C&C domain
- domainworldview[.]fitUNK_LateNight suspected delivery domain
- file_pathC:\Users\Public\stomp_extTA412 GemStone extension extraction path
- file_path%TEMP%\msgbox.exeDefault BlueMoon payload download path
- ip79[.]133[.]56[.]90UNK_LateNight fallback ShadowPad C&C server
- registry_keyHKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32UNK_DoubleCheck persistence registry key
- sha256295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915UNK_LateNight msgbox.exe loader
- sha256353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98eeTA412 GemStone extension background.js service worker
- sha2563594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726UNK_DoubleCheck SysPr.prx (encrypted payload)
- sha2563ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432UNK_DoubleCheck krita.dll (sideloading DLL)
- sha2566e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92dUNK_DoubleCheck SysPr.prx (encrypted payload, second sample)
- sha256779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096dTA412 BlueMoon exploit JavaScript (driver-html.js)
- sha2567d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288TA412 ChromeUpdate.exe or msgbox.exe loader
- sha2568453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805fUNK_QuietRacket Indostartupexpo.js (BlueMoon exploit JavaScript)
- sha25687b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22UNK_QuietRacket GFExperienceUpdate.dll loader (second sample)
- sha256a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5UNK_LateNight Index.js (BlueMoon exploit JavaScript)
- sha256ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141UNK_DoubleCheck calibre-launcher.dll (sideloading DLL)
- sha256ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69UNK_DoubleCheck font-01.js (BlueMoon exploit JavaScript)
- sha256b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2bUNK_QuietRacket Loader.js (BlueMoon exploit JavaScript)
- sha256bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360UNK_LateNight mctsetup64.dll (sideloading DLL)
- sha256e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004TA412 dist.zip (GemStone extension archive)
- sha256ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782bTA412 BlueMoon exploit JavaScript
- urlhxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]dllUNK_DoubleCheck download URL for krita.dll
- urlhxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]exeUNK_DoubleCheck download URL for krita.exe
- urlhxxps://1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/SysPr[.]prxUNK_DoubleCheck download URL for SysPr.prx
- urlhxxps://api-prod[.]secboxes[.]com:443/downloadTA412 download URL
- urlhxxps://app[.]eduac[.]workers[.]dev/ServiceUNK_QuietRacket DLL-sideloading pair download URL
- urlhxxps://app[.]eduac[.]workers[.]dev/UpdateacUNK_QuietRacket DLL-sideloading pair download URL
- urlhxxps://download[.]secboxes[.]com:443/dist[.]zipTA412 download URL for dist.zip (GemStone extension)
- urlhxxps://evidence[.]msbenefit[.]com/msgbox[.]exeTA412 download URL for msgbox.exe
- urlhxxps://homepage[.]brianwilli[.]com/d/85rY[.]datUNK_DoubleCheck download URL for 85rY.dat
- urlhxxps://homepage[.]brianwilli[.]com/d/calibre-launcher[.]dllUNK_DoubleCheck download URL for calibre-launcher.dll
- urlhxxps://homepage[.]brianwilli[.]com/d/SysPr[.]prxUNK_DoubleCheck download URL for SysPr.prx
- urlhxxps://homepage[.]brianwilli[.]com/d/wint[.]exeUNK_DoubleCheck download URL for wint.exe
- urlhxxps://project[.]secboxes[.]com/ChromeUpdate[.]exeTA412 download URL for ChromeUpdate.exe
- urlhxxps://recommendation-letter[.]secboxes[.]com/ChromeUpdate[.]exeTA412 download URL for ChromeUpdate.exe
- urlhxxps://small-union-7018[.]daoahueb[.]workers[.]dev/UNK_QuietRacket DLL-sideloading pair download URL
- urlhxxps://snowy-block-ae0a[.]daoahueb[.]workers[.]dev/UNK_QuietRacket DLL-sideloading pair download URL
- urlhxxps://zki0y83[.]msbenefit[.]com:443/feedTA412 download URL