acrstealer | 9705bd691a0be1f2fdb19b72b12e25097c39ce9c2173c3d5e7b106b4e97fa548

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
930600062.exe
Size 5.4MB
Sample260827-wqfmwsyscs
SHA256 9705bd691a0be1f2fdb19b72b12e25097c39ce9c2173c3d5e7b106b4e97fa548
MD5 578a002dc5631dc1b34773fd828a0f02
SHA1 d4bbc90188af74bf2d0eeb0feb2ff37de49e5ceb
SHA512 dea55eaf6e98755d4e00200af7f3fbaea79408ca2f113fa1fc254134867f73dcc84464d0f7a68a55db879e33a727b689ba4561747575d1244b1f45106cda9d8c
SSDEEP 98304:++ON+Col9cCq/sKIyA0wyhCZ6HByYFaEUmFJxGsNq5zL:++jmf/CyA0V/EYkEJFJxGQq5H
TLSH
T18D46D03BB7A4D52AD41EC23998A6E758B437F0705F3282DBA1D9235D9E375E00E3D221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer installer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.7-alpha2

health.indigowell.cc

Decoy

fonts.gstatic.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

01a0353f-0ad2-7efa-8507-e484ee70ce02
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 50 IoCs

resource	yara_rule
behavioral2/memory/3680-25-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-31-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-32-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-36-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-68-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-73-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-74-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-115-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-116-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-122-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-355-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-356-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-357-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-358-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-361-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-363-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-384-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-401-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-406-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-419-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-916-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-1038-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3051-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3054-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3055-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3057-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3059-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3063-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3065-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3070-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3071-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3075-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3077-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3079-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3085-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3089-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3091-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3094-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3096-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3099-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3105-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3143-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-3179-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4296-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4294-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4301-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4303-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4305-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4306-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3680-4324-0x0000000005560000-0x0000000005627000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3680 created 2060	3680	AutoIt3.exe	81
PID 3680 created 2060	3680	AutoIt3.exe	81
PID 3680 created 2060	3680	AutoIt3.exe	81

Executes dropped EXE 3 IoCs

pid	Process
3280	930600062.tmp
5968	930600062.tmp
3680	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3680	AutoIt3.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4624_2136809489\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_672632345\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	chrome.exe
4776	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3416-1-0x0000000000240000-0x00000000003A2000-memory.dmp	innosetup
behavioral2/memory/4876-6-0x0000000000240000-0x00000000003A2000-memory.dmp	innosetup
behavioral2/memory/3416-9-0x0000000000240000-0x00000000003A2000-memory.dmp	innosetup
behavioral2/memory/4876-17-0x0000000000240000-0x00000000003A2000-memory.dmp	innosetup
behavioral2/memory/4876-23-0x0000000000240000-0x00000000003A2000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323276734149229"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{3A92F8D5-3D46-4D4A-AE47-C36F016CB090}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	AutoIt3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5968	930600062.tmp
5968	930600062.tmp
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe
Token: SeShutdownPrivilege	4800	chrome.exe
Token: SeCreatePagefilePrivilege	4800	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5968	930600062.tmp
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe
4624	msedge.exe
4404	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3680	AutoIt3.exe
3680	AutoIt3.exe
3680	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3280	3416	930600062.exe	89
PID 3280 wrote to memory of 4876	3280	930600062.tmp	90
PID 4876 wrote to memory of 5968	4876	930600062.exe	91
PID 5968 wrote to memory of 3680	5968	930600062.tmp	92
PID 3680 wrote to memory of 4800	3680	AutoIt3.exe	94
PID 4800 wrote to memory of 4796	4800	chrome.exe	95
PID 4800 wrote to memory of 4968	4800	chrome.exe	96
PID 4800 wrote to memory of 2976	4800	chrome.exe	97
PID 4800 wrote to memory of 4968	4800	chrome.exe	96
PID 4800 wrote to memory of 1716	4800	chrome.exe	98
PID 4800 wrote to memory of 1716	4800	chrome.exe	98
PID 4800 wrote to memory of 4920	4800	chrome.exe	100
PID 4800 wrote to memory of 5952	4800	chrome.exe	101
PID 4800 wrote to memory of 4920	4800	chrome.exe	100
PID 4800 wrote to memory of 5952	4800	chrome.exe	101
PID 4800 wrote to memory of 5220	4800	chrome.exe	102
PID 4800 wrote to memory of 5220	4800	chrome.exe	102
PID 4800 wrote to memory of 4304	4800	chrome.exe	103
PID 4800 wrote to memory of 4304	4800	chrome.exe	103
PID 4800 wrote to memory of 3756	4800	chrome.exe	104
PID 4800 wrote to memory of 52	4800	chrome.exe	105
PID 4800 wrote to memory of 4656	4800	chrome.exe	106
PID 4800 wrote to memory of 52	4800	chrome.exe	105
PID 4800 wrote to memory of 4656	4800	chrome.exe	106
PID 4800 wrote to memory of 5040	4800	chrome.exe	108
PID 4800 wrote to memory of 5040	4800	chrome.exe	108
PID 4800 wrote to memory of 2072	4800	chrome.exe	111
PID 4800 wrote to memory of 5356	4800	chrome.exe	110
PID 4800 wrote to memory of 2956	4800	chrome.exe	112
PID 4800 wrote to memory of 2072	4800	chrome.exe	111
PID 4800 wrote to memory of 5356	4800	chrome.exe	110
PID 4800 wrote to memory of 2956	4800	chrome.exe	112
PID 4800 wrote to memory of 5400	4800	chrome.exe	114
PID 4800 wrote to memory of 5400	4800	chrome.exe	114
PID 4800 wrote to memory of 4480	4800	chrome.exe	115
PID 4800 wrote to memory of 4480	4800	chrome.exe	115
PID 4800 wrote to memory of 2492	4800	chrome.exe	116
PID 4800 wrote to memory of 2492	4800	chrome.exe	116
PID 4800 wrote to memory of 3540	4800	chrome.exe	118
PID 4800 wrote to memory of 3540	4800	chrome.exe	118
PID 4800 wrote to memory of 1484	4800	chrome.exe	119
PID 4800 wrote to memory of 1484	4800	chrome.exe	119
PID 4800 wrote to memory of 4252	4800	chrome.exe	120
PID 4800 wrote to memory of 4252	4800	chrome.exe	120
PID 4800 wrote to memory of 5736	4800	chrome.exe	121
PID 4800 wrote to memory of 5736	4800	chrome.exe	121
PID 4800 wrote to memory of 5176	4800	chrome.exe	122
PID 4800 wrote to memory of 3924	4800	chrome.exe	123
PID 4800 wrote to memory of 2464	4800	chrome.exe	124
PID 3680 wrote to memory of 4624	3680	AutoIt3.exe	125
PID 4624 wrote to memory of 3756	4624	msedge.exe	126
PID 4624 wrote to memory of 52	4624	msedge.exe	127
PID 4624 wrote to memory of 4776	4624	msedge.exe	129
PID 4624 wrote to memory of 52	4624	msedge.exe	127
PID 4624 wrote to memory of 52	4624	msedge.exe	127
PID 4624 wrote to memory of 2400	4624	msedge.exe	130
PID 4624 wrote to memory of 2400	4624	msedge.exe	130
PID 4624 wrote to memory of 2744	4624	msedge.exe	131
PID 4624 wrote to memory of 2744	4624	msedge.exe	131
PID 4624 wrote to memory of 2744	4624	msedge.exe	131
PID 4624 wrote to memory of 5376	4624	msedge.exe	132
PID 4624 wrote to memory of 5376	4624	msedge.exe	132
PID 4624 wrote to memory of 5376	4624	msedge.exe	132
PID 4624 wrote to memory of 3008	4624	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2060
- C:\Users\Admin\AppData\Local\Temp\930600062.exe
  "C:\Users\Admin\AppData\Local\Temp\930600062.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\is-K5E9KLGGDO.tmp\930600062.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-K5E9KLGGDO.tmp\930600062.tmp" /SL5="$400A4,3105456,1360384,C:\Users\Admin\AppData\Local\Temp\930600062.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\930600062.exe
      "C:\Users\Admin\AppData\Local\Temp\930600062.exe" /VERYSILENT
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\is-MDTO8HWKUU.tmp\930600062.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MDTO8HWKUU.tmp\930600062.tmp" /SL5="$500A4,3105456,1360384,C:\Users\Admin\AppData\Local\Temp\930600062.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5968
      - C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffae513c728,0x7ffae513c734,0x7ffae513c740
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,17048981257020464286,50229337223803866,262144 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,16848917022782138200,6431055453079167673,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,9526832849856254060,13260656423480355536,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,7797537338941371875,17896764679400475551,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,6134703134764708869,3909940367954921630,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,3708796877852269367,7109342950038452475,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,8758320436302349009,2991065092849133478,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,1174891646360979553,14265981148824258327,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5404,i,8127364918602625852,7545852611302125407,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:52
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5416,i,11886380494115859389,11277392969746726064,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5744,i,8841648327916482061,16294543132781991429,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,5019742573243285154,10247076690205750019,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5892,i,5219162450101160167,2662770299381385406,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5700,i,2365287958536165149,4446634573087115346,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5428,i,5360487311259825932,15969156575760346856,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6248,i,7319472254764534781,4249914333584574215,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:4480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5792,i,15355769245644816276,4095497628652150780,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,3377870700121322015,12197728361059505425,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,13646115918510067020,15382548761995515000,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6072,i,9176121212114414061,6450032598345988217,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5344,i,16057911842659059616,955788292993603941,2097152 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:9
    3⤵
    PID:5736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,2119649771160517409,5093624502610153098,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,2337217236095756475,10979785747165714450,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,3920557354678389279,11237904492018695498,524288 --field-trial-handle=2068,i,4384100216406799262,11771120696943922705,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
    3⤵
    PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffadc8ac188,0x7ffadc8ac194,0x7ffadc8ac1a0
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1675306626998652245,1706680630933791905,262144 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:2
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,6836820833121818928,13277163318357336672,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,1574077368091390385,10931018685076910592,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:13
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,33157546009365039,13128088405864770256,2097152 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3308,i,7016100688964875880,1114386930747727597,2097152 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,12183773304703868562,13138553145931224159,2097152 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:9
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4074703273934857450,14436036665503872694,2097152 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1204915896193631408,18035227598520368598,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,188855711912040727,13935135980961811041,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,460252108420064009,762509429232774980,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7337962177436513886,6777437383843299283,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7337962177436513886,6777437383843299283,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,3916985118470064696,11220930376318344006,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12679842726488527858,4740864860816619484,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,14179591525870066108,5086912861745905710,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,7027914392603433302,13875295667275953637,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,2469415319196923732,809053139386185294,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,11666450159674277960,14240650971050232131,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,3411308666587923675,8854955441600108419,524288 --field-trial-handle=3044,i,7383667861813785739,797132918524346566,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:3008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2300 -prefsLen 27097 -prefMapHandle 2304 -prefMapSize 270315 -ipcHandle 2368 -initialChannelId {2a4276c1-d61f-47c5-ae48-af3622614190} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 27238 -prefMapHandle 3724 -prefMapSize 270315 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {3183525e-81b9-4770-9ad7-96ab472a8dde} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27238 -prefMapHandle 3908 -prefMapSize 270315 -ipcHandle 3960 -initialChannelId {0057e24c-becb-4cd2-a668-8787e3321367} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3064 -prefsLen 34786 -prefMapHandle 3048 -prefMapSize 270315 -jsInitHandle 3052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3196 -initialChannelId {87a9a5ff-d621-4338-b91e-56b8aced4efe} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1512 -prefsLen 34974 -prefMapHandle 2716 -prefMapSize 270315 -ipcHandle 1612 -initialChannelId {d7217ac0-f3b4-42d4-9600-a01829d78b2b} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32864 -prefMapHandle 5192 -prefMapSize 270315 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {3b832586-9410-4cb8-9d58-787b1ab47e1a} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32864 -prefMapHandle 5224 -prefMapSize 270315 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {c734e7da-0b33-4c35-8f46-c6c807814432} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32864 -prefMapHandle 5660 -prefMapSize 270315 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {da351ae1-a5a6-4b7d-ae07-a0461c27a557} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77c35c95-cbd5-4731-a803-a1b86f10ea04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\77c35c95-cbd5-4731-a803-a1b86f10ea04.tmp
Size 4KB
SHA256 2b6eeada13a9c7218acba4894e0c78512d7f48b224ca3cb11637cd5674375b94
MD5 c0a560081ceb3419172d2da085729496
SHA1 5094168c78e7f1611ca2500a7ff5370022f120ed
SHA512 a9eb188efa290792baab0cf47009280911c97d6de6abb3d7ec2ecfb20100aab1dfa2d0ce4c62f654c3ac6db51ba6b66295b8432b8ee7371f9642c3a615d51ad0
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5J4DkB6vGyvk54EATboRYv4a:5C0Ngjf5ZKSNqDUDoI7qEATbog
TLSH
T16DA109B1A4694DB394B6C589F1427B43DEE531A7A561EF80E8DC5F0C00FB5E81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 41a25406c8231e761620a07fed8cd479af853c5d3117a4b188caf9cafcf96459
MD5 f9a98b9cf9cdbf1bb9c0738671434b1c
SHA1 6b7d9c1fa63b530893dc3eead0f1a3889b449877
SHA512 16d2b376a7b7b5b3b56fff7f31aff17d723afd5cb66239a1d021e16e72fc723b9985519edc7333088491ee264d4a1248240f82b77ad620a417a910897322b80a
SSDEEP 384:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRXODCB+ErU3tsHGKuSber7K:GUH+7KxkXqKf/pUZNCgVLH2Hfgsn1Oex
TLSH
T11B52E82B648D9A3B0F98D68CDC17AF4FACB5025766684C2457FA5D0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e27d844fed7f694bcbbf044a9b38debc2f6442e636ca0fcc263acec384a6c428
MD5 94e1a90d0b7efa9fddb66a96729bfe1f
SHA1 056e885975cbb39e747c943a8aa4d1032c25a5ea
SHA512 f9a27d6fb8d0731259ed5e2f660971a84843f00524849ef181d5327e54e97be0de72a42df86376f982d48ad9345f6c26ef42ba82e9a9f4dbd2fa1111d2f7ef78
TLSH
T1F3A0021461C02C11CF90437570A385C57B7248953AD14703559144448CEB5D07185100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2750.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a2750.TMP
Size 48B
SHA256 e33d91cfe837c1767f2222122a01a44ecf1f00edc87a7e70e3c5c38afbd41ec4
MD5 c140561fd3b8a23aa70928fc619411cc
SHA1 385fb85737b3f14aa8ecdc2ee8c84f0ad7ebb2b3
SHA512 6d7bea391b1ddfd650ea0e940f0f0d42ae469863f3ab4eae3aba8518da1f225e3898b2f27526d79e2615f6b94ed67bb50210eea9d344b092e811b060a6a06266
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bff61264-3a63-420d-a976-522a3ff83878.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bff61264-3a63-420d-a976-522a3ff83878.tmp
Size 11KB
SHA256 a72d757761ca3d1194fdca97141855664ab1d56b0de49bc47e42ea7363504fe1
MD5 f9525bd22c7ab0b00cb46f9d695959af
SHA1 36012fe659feb4f25071c39516611e655feaf6af
SHA512 b4fc991637659d8ef9ec21bb8354c1df6f35103b93a9a72d2d8a6d5e7293ab633b638a447cfad7ddf12854dd12acecc6ed5c2e903bdcf961ddc6b44f66676e74
SSDEEP 192:nR2vALQv7JQAPRp2799Hsb+WNnDw0M8sAkw5YYajVyIsnAUge:nR2voMPXcvws0RZNaFe
TLSH
T10532A62EAD10653B9CDAC229FA227763E7F6202571D42E44EBFC8A2C15E7ACC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ba9955a046b410ab4bce5867cedd3f8f2b3e274287d5e0a41aa876e7ffd08a8b
MD5 75511459947e145db2a1ced1ccfa596a
SHA1 59bc8e17a48f17b273b90910b122b6cdf0729c50
SHA512 a22d4ae6266830aaa21490e1074edd5cb605a6606f0bca2a73cb233e48f74ae09c09f127a82da101dbf13066d2ccbf0696775c66c4c9525518f553f225f0e45c
SSDEEP 3072:fSbgETyl65BHms3stloO+Is70REN9xDKv3qJuhH:f4gwHmDloXIGnxDKvaJWH
TLSH
T162D312B5FF4E3DD226CFD9E9C5C0686B2DE9D335D045E65E08C54AA2A18A78303F2221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 099f6796ec81d4b4685d5fa022ddb5e620f417da58d62e6ab34091f25587989c
MD5 f020822be4c9859f61dcd39b1162b067
SHA1 d6dfd7dc802a8cc936c2c67941a13a4ba09620a9
SHA512 36581e15204663ac3e624a182208cd6201d3c2c61107700e906a9687a0c999583c9486a6b254496b290af9471a6434e051280325050b3820298b846f8b135751
SSDEEP 3072:gSbgETyl65BHms3stloO+Is70REN9xDKv3qJuhH:g4gwHmDloXIGnxDKvaJWH
TLSH
T129D312B5FF4E3DD226CFD9E9C5C0686B2DE9D335D045E65E08C54AA2A18A78703F2221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c0035ee8f81c34d3b52db6c1a966c7d880c7d66ea96e292ff8a327890c10ea76
MD5 4d847e32818353428070729224d30644
SHA1 08ac75edf0df5b397036ff043933665281ef03b8
SHA512 8b11d11fc799710aab2e601a7c1af3958e26c3c98ece710db3024fa44d52cfb6836afb872b3722e6f4ecf0abaa563f9d420344e3142a875130265673a6ee107f
SSDEEP 48:vGbtM1OtifPpoOrthH7DV3d4HE5dOHRp7zBlgyzQehkL74B5Gls07ohvRuXlRqrS:+JMwt+XnhBdMsN17UIopRu1Ar6MU
TLSH
T15191FFC8879EE6D1EF98457C6CA1FFF526385D0A28C9573202FC136529C3E9A21F2124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5aea23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aea23.TMP
Size 2KB
SHA256 a715f27fbc64f49af58c8579c770f7dffe2a017d265978ef6edb877f7a633513
MD5 1758f1075a8df93b444fa11814dda1f5
SHA1 42bad1ddc6c8000929a7ad5124a57269ba58d699
SHA512 2f5b069e79c38e1760163b138a86bdb802d19127579c6813082392031cd6bee03a3b45c654a8c3a66704bfb9a276b200176d06fe58e2446b408834cb3b4022f1
TLSH
T1B65163D4872FDBD2E72456BE25E148CA36709E572907AB3113BA52B65CC2F0D34F0224
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 921e78ebff4fb8d85d0719c447e1021c9f832aa50a0b74b53b1e29d2f0d0559b
MD5 0714b384f518efa5d374e2c3b930985e
SHA1 6f61b9f2b617c167f9a06bef0cb60c663375c234
SHA512 62b1f601509085a210cb1da53b616aa8a12def47e21941bce194c28eee2c4b9f142c032e35592b5972d60dce615e27e4993709cc750e3a650c28625440890ab4
SSDEEP 192:sxRtRixvf/f+s02eZA2T8Z3lJbsxoA8pJT/g6+WNPJB/YZ7ot+s8GkIgDqsIFJ:sxRtCvf/f+s02YA2YZ3c4J/5j/dAS
TLSH
T14052D716AD24993B9CC7D26DFA167B53E6F96022E0D45E48A6FCDA0C04F77CD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0f9ac357f82adb4d44e287e85b3e179d65a438da97242023ee3b7f82a9f4da4e
MD5 9d6d325fab24a11828e4ebef42f87ae1
SHA1 9665182341e40ae19ff179a0dd261ae5b2a0842c
SHA512 ba7ce4a90332b34959c76493c1103e9048fab5195fc0bcffd5f43ef834ffde0f867e43dbc74d33ff4ad4335170bacfcc262f04cde1f6f23caa5711cea50cebe8
SSDEEP 192:sxRSRixvf/f+sOCeZA2T8Z3lJbsxoA8pJT/g6+WNPJB/YZ7oqKs8GkIgVsIFJ:sxRSCvf/f+sOCYA2YZ3c4J/5j/0AR
TLSH
T19852E7166D28983B9CC7D26DFA167B53E6F92022E0D45E48A6FCCA0C04F77CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0206fb1bfbf988a54dac5413c3b04e7f83a973e2b59c618a95b230abd51c9180
MD5 911a4303f1474c59244e03bf7355c4d4
SHA1 8524868c0120162d35779ca99a31238783657be1
SHA512 7c61dfa463ff68927a3f66d02cb426d3d2859f45d947ed3fde0d0d912fee959d1f7e507d16dbe0762db1f69ca95fd5a69231165951c67f486c139a9bfcdf324c
SSDEEP 192:sxRtRixvf/f+s0CeZA2T8Z3lJbsxoA8pJT/g6+WNPJB/YZ7oqKs8GkIgDIsIFJ:sxRtCvf/f+s0CYA2YZ3c4J/5j/0AU
TLSH
T19F52E716AD24993B9CC7D26DFA167B53E6F92022E1D45E48A6FC9A0C04F77CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 de79d537b66248cef460c8ba3595b81f886a9c637bd744d23e4921f749b31f5f
MD5 e7ecda64f98bc0931119cbff1e47dae5
SHA1 0c54cfc81d7c8053f4a6c821d36db73aea19dfe2
SHA512 8e09d3db3132b0799adc59143a23f07af25cea0233debad4b47a046adcc819c7fa0cd7cb9ac9bfd51f0a5e1c8857459968834b9b4253d2acca92d9490b943902
SSDEEP 768:ky2SSh7pLuLzsvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8GuSV4FroXk+/:ky2SSXEzsvWgd5f/bu1javGuU4+Xz/
TLSH
T180D2D97B640CCB7F4F804ADDE8197F9E6DA802CB9698C98047FA951C03C6BEF51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index
Size 3KB
SHA256 94bb711ffe36bd9340e97d41061307878ba2d0661d6abd7c5fde4c06373277be
MD5 57de899bc7a285d0c357a2e8bb84f840
SHA1 c24e0231b39149544c653261beada6f481c68e83
SHA512 8435868ee5935de5b9492607a9746c6d8ec224d4ee3ef304099e232acf48b77b486bc3607525ecc58dc65053804d3a6fdfe7e4463cf6411af30008abb2b21d6f
TLSH
T1AB51A54F8D8A1D5AC9AC06B268FE1481337818EE1740D9872AADA13174D337D2D1C45A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index
Size 120B
SHA256 e83060c025330972e89d83259835c86d57f2c14eb88810d7106f15a9025c1f06
MD5 5ca5bd259a8e46206c06fef459d208cb
SHA1 8009abd0950a011cbbf1574fa690cea3c864c072
SHA512 7fc2d5cfa43a0ea69e9b9537c7a0fb42effe25f600885ce450606b360f55b1ff9ecb47d84f5301e4fe4abfd26c7d3ba7fb59808a14118e2c3132af37f809a8fb
TLSH
T1BBB012104D690D91CD0A963107B73154673717ED0C61270310DC101B94910ADA10D554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a79b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index~RFe5a79b5.TMP
Size 120B
SHA256 8e8a893f5a5ff79b47ebf36f3f3ff42321dc9e81a80da6487cb4928a0200c8a0
MD5 9f20d5ba6bd0d40bb72cb93c22cec435
SHA1 50f17107a223c7958a9394e2d0bd8e219e508e34
SHA512 ed36ba109e388d0d1305ddc552993cc47a8959641b26517b884729d194e9b1bb9a53b693a19679ddc0ead660ed86797387331ebdfca1457c32614338bfda2d83
TLSH
T1C3B0121201A40CA0CC0A96701053D25433271C140820630320E9048B4C610C45145544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index
Size 72B
SHA256 3dbaf3fc1ae3eff8499df059d3ae2bbaf9bbe2665c042fb79afa9f0bb5c1e8a1
MD5 009b55513ee20a0f61862bd3a37d3c0c
SHA1 3283364d5ba0cf2332080ad680c8a587d98de2f8
SHA512 c880f93e4bb02eaa215935c58d49a59fe901271db5cccbd0055073c102c618f349de250510db1fbf891fd8c29a7cf3d253e05316a37ac4848733d64772316a63
TLSH
T128A0022A02C14089C00392F06DE796713767FA124311130761D40474DD515758FE751C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad032.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index~RFe5ad032.TMP
Size 72B
SHA256 2ced0cd824073e8a755f5294e6eb7e602fd062f3d55c86347ff3e12b6935016f
MD5 54fd8222829d2bb26244c12ff3d907fd
SHA1 c52c7c3ccc2379c67a758d58d24f9e028e892b38
SHA512 367ba57d5530eaa8ab6dc5dae694e336d58c3b9dbb16f06ac97758d220ff92fcf6047d94b01b7bc8d51e6898f858016cff1980a322f1aa5a30783de993d6ef7c
TLSH
T1CDA0026013C58686C81331B515A2C7D536D089115280970FA0F11044CC504C4458204C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 adafa8986a3ccbaf85d1f4d51a4f619aceb5866b48d040edf97acce581faa15c
MD5 4853649723ee08851d974520176862be
SHA1 1a4ad64275298b100acf7400a3aedc109ddf781e
SHA512 388e601d6fa504ce3d32503727d1d8282266a578e2773df4b0d86315d4dd9d2bdb1521f262ff3b465202a67091bf1987b979d1c004b57e6cd2b43c9355a3b916
TLSH
T160E0C0FB3DEB0828FC9FC3E6683584B144023E804644DC0ED01A418310A1B10202BCA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c2f292499f9d131aa45023b9ac6b95312cf5894bb48e1505b16c74b2294cb29a
MD5 d566f4e730b00dcd65c94f39ab05043e
SHA1 a3d1aa62759876d5f7ea106aa39e619f043a4263
SHA512 c298bbd065d01446b48b4a213aef8b596bb9a5e6e04e86e9cd2c0ded389377a78a5a5831c0254ab350fdc54660b9958dab976ef2e3df12f48a87604c45ecee03
TLSH
T140A00221C9A58046C19903F0966156EC7F148CE857452365C0EC60DC89699E066D6115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad09f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ad09f.TMP
Size 48B
SHA256 2186b962492e6a1b9ca2304cede86483773633992b122c8d3d9ab488047687a2
MD5 98b1731cd63a5413eaaba844c167a763
SHA1 44f70b98bbb31ac097659e97848e2c2ec19579cb
SHA512 711889c38b3e602c4501fcd3ae63719168bd73e1b043a76bcb690b29c2368581a3a968b2e0bd5d7526bc60fe9a8d36d744101cfbbe182d24a2f2d9d2f233da0a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d350fdb1209d8709e668d6bc25abe087b7bbc44a7e3390ead2b4d5648057581c
MD5 2512c7484a689d9caf5cbcdabc473439
SHA1 a830e81a024d70721c11f50dc5cf14881815b967
SHA512 8204ac6c6774134c8f26de9935ff703679fc0fc7c13c1b23932d6f4b81315b67ca38487266eb4f7cd5c0d068bcc382f29e501102f15ed2b3763958f45221ac09
SSDEEP 384:nQZcIV38N5bTIFumivCWC6d+dfYb9UUMcmWmkA1QiZh6vPqQMQYeJfjWca4G2KCx:uV3GyqlvAam6aQMGdjWca4Ghf97Hy
TLSH
T1EEE29F305865DC779CABA295F62B2783FEF4217388D84E44D9DD9B0D029364E270B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3bf2467916cb521341013385d6a23abf351ca008ae04fc81a181c97bd1268840
MD5 ae5c89fa7520072a4fe2fac62648e173
SHA1 6f6e52dc78d432f890916702d2a9688a5a56dcff
SHA512 e8f3dc5ec7cd69ed70964a63298dee8c377aabfc81d5ae36601fb295571af239bce1ecb872c10a32633764b72d687e44b736969e31453b70ce8d0f27ade9eaf8
SSDEEP 384:noZcIV38N52TIFumivCWC6d+dfYb9UUMcmWmkA1QiZh6vPqQMQYeJfjWca4G2KCx:WV35yqlvAam6aQMGdjWca4Ghf97Hy
TLSH
T11DE29F305865DC779CABA295F66B2783FEF4217388D84E44D9D99B0D029328E270B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4155db736470d8ced8d7240551e73b9f48696fdcda3e08c156594667ffb6b5d0
MD5 2384b6a3d8552be5fd7df6f1e8d7e46f
SHA1 22767e4087803964bbd76ef411584df79c2328e2
SHA512 cf2cc9e2b960473a5d80348c362cce5a1bb598a03eef84bf0c6675b39f06371f69095f07c502b1cc3dec9c65a21e5fd65372dbc00650c0c878a807f5d171d3b1
SSDEEP 768:/rv+4UNbdq3F3q8AAam6aQMGdjWca4GhfBUPeU/:/bsbc3dKmaME6psH
TLSH
T150F2AE31A87C9973DDB79A99F21B6687BFB021A384D40E80D9D91B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 37b1229af48c5fd63f644c9af3a883bf4a7e18f6b07e9d23b8b7330debead72e
MD5 754bbb176f316e7fe799e81219fb2064
SHA1 3da0bae5c3e9376af0b3e0db2c1a07c3d1455cbc
SHA512 031477f40d094bd648b1745b2786efb95e8fdc220944e207d69bf6d8918fb7c2e15d219bcb94c1c19daff104f0ab020cec0776cd7f336939a96bd23e8f2b913d
SSDEEP 768:urv+4UNbdq3Qkql0Aam6aQMGdjWca4Ghfw7PeU/:ubsbc3+WmaME6pQH
TLSH
T104F2BF31A86CD9739CB7A695F25B7683BEB421B388C40E80D9D96B0D439718E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

260f854b-d282-41ba-a9b9-8867b6bdcd3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\260f854b-d282-41ba-a9b9-8867b6bdcd3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a97dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a97dc.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

f64278c9-9293-4f22-a596-19d983749a3d.tmp

Path C:\Users\Admin\AppData\Local\Temp\f64278c9-9293-4f22-a596-19d983749a3d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

930600062.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K5E9KLGGDO.tmp\930600062.tmp
Size 6.6MB
SHA256 3200683faa84e19c834d5f4725e0355475cc1712d7bab404a4fe0e456aa09045
MD5 4b75636c79f793cf4bf63d0771a064b3
SHA1 6a99e32e8a22dd70b9acf69458786447cbabade7
SHA512 2aa7ee42b8865794e1005bd544baae2ee06f2c34c9001732292b9b96bbc197c21d06df5e59c78d6c31285e00c8d5ae38c2ce240a43c443461d034322f1c0df76
SSDEEP 98304:WYmkcxJ9/WUEYJ0VzW8hJH9XM2Hn333PD:WliPH9XM2HfD
TLSH
T18C666B6BB2E4C22DD16ED23EC1A78F44E433B0B4173BC1EB529412951F26AD49E7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_798286675\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4800_119847108\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 00cced70cbfbd04f6b771f07d69ed23e6a585c483b89edd8b6f10e46041cb749
MD5 cc860af2085eafb42da0c56f45e41e65
SHA1 204f7d961e66ee1b980c1236d0b3ee98f514b674
SHA512 2f4687158d234e8b37c51384b584f52be5b4c665f6f204dbb3e9a1ce3d88a008d973cd1b2d891791c54c2992f269a4ff294ab8b5d27c20e12ba26b3ef00f3ae8
SSDEEP 96:dtVKE2FW4F4Fc/dd66JoztdzgClKtmBM2/URk+HSdF95/7bkW6ArWAHAyUR6dcWI:7oD1d66JoztdzgCl6mBM2eOv5zbo8WmO
TLSH
T109C1BB68E629963FD408423BCCA61F410F36384B989E7F2531ED644C2D572DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5629430a7830f528531f91ed6cd72bfc48dbbb93d34c4ea7a94b2ed2a085d864
MD5 b3cec9b4cbeadbd1605b58335a7739cc
SHA1 5e5e685b7fbc28615c148c64c7c4c7ea977d3591
SHA512 9dd5af0a9426685ff524eb22bce84889ea3e42538a553a150d23f7ab9bbc4bce6bebc328e39b0377ca810aa67ca896712221b643ffdb916d08fec1419c5d4e45
SSDEEP 192:ROv5zbo7asmAyjXMCoD1d66JoztdzgCl6mBM2:ObomsmAyjAhd66Joz/zgC1O
TLSH
T12BE1EE64EA29863FD408427BDDA21F410F3A384B984E7F1931AD645C2D472DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4b9342112d88b5c05f754ab0b78ff1418c5360dd43191c6a8d7341b572c372af
MD5 d58dee2bc9d37f4822b3e3bcf0c82013
SHA1 799e97fd58197c39f33194f180c24523bf66b4de
SHA512 98a30b09a226143884724e48474c0dd6d2f0a13ea01fc38e02d119c5548e9a08d41633577f2714f49da7c2210b1f13e0f5c5bab32de294bc029f0d9f1497ee3e
TLSH
T19F113A5C3EB94D6A9D8BE3AC7451028DA3564E06058F1D474E12FF8CCE81ADD326A87D
MD5 SHA1 SHA512 TLSH

Submit Download

1e16bf4f-8a4c-4f3c-9d3b-0ec0f95fa25a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\1e16bf4f-8a4c-4f3c-9d3b-0ec0f95fa25a
Size 886B
SHA256 a8c5b1543da2670cfa8c9231d9fca068be001e69fb1c47553dabddb6b591dc35
MD5 36ccac283945abc62ca7bde67a2a25ca
SHA1 563b4c7559b18fc88ffba9b42055df82cb5dbd16
SHA512 d20680086f5c600a39a128609dfc167f1be80a5cdb9cbe40ace3d3532db118da36dd9820fe69ad84a98a12a60712920d76829c6a27f2be24814be0c075a005af
TLSH
T19D11235085B9B5B2CC28D18BD9A17B438BB47413C0C658043DA15E180DEF51FE797303
MD5 SHA1 SHA512 TLSH

Submit Download

26bb1846-5bad-4d02-9a50-c694c5219818

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\26bb1846-5bad-4d02-9a50-c694c5219818
Size 235B
SHA256 780bc48e6d60a54c47a89f7d92db4bb5f4c3e91426b34b9c6b5edad293c4314b
MD5 eab21e209b44b05be628def6c1636eb3
SHA1 c52919259ddbb2ca6868d5491010a640b626e97b
SHA512 5db379e3d09ba085e2d32491cbb1dfc96f9932b66331fe48f4fa250cd6cfe07a68346b55138be72d0d6ec2f7a25b1d2d860347f058dcb6189d1e2fb501ba5279
TLSH
T17BD097C02C9C631C4C144F0BF0E069DA31488C3360756810EA91487899FEEC84222C07
MD5 SHA1 SHA512 TLSH

Submit Download

464e2663-9388-4152-9477-8457db44a5ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\464e2663-9388-4152-9477-8457db44a5ea
Size 2KB
SHA256 b935bb2b516f40fb5e652423f3352fda6209d34e1762b8367aa3f6b0b44a34f6
MD5 7e22a2124b5f6119baeaf7e632dfe8c7
SHA1 515e96c6b629abef05d25ca0f135282350e9438e
SHA512 441ec10273e1f90398296534929400b0f586938983cc6238777a3049b8547a3ca665edd818a7bde58d3afc47015c57e59427ddafdccb439cec5f468c9565939c
TLSH
T19941645C35B85CB68CCAF59DD542378A93A09A4314C62C432D91EE0CCE9379E736A52A
MD5 SHA1 SHA512 TLSH

Submit Download

559ba8e1-93f7-4653-8330-212233a6ef7d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\559ba8e1-93f7-4653-8330-212233a6ef7d
Size 883B
SHA256 f3f70cfb0adbef8e2e0d071cc56c5e7ce5a38b9be61a3bc86e88307fd03840fb
MD5 2d9abf699f60a26f85f70fb9f0de1872
SHA1 f2fa88f83d366b7cac7127462d4adb24a1ee5454
SHA512 99535b5b90da3f4adc902d418a06e19bd145f487463f5d02e2967202612069bb2600b89289943bc91e78d2f5e1d59630c498702e9b102853f895c709c2fda26c
TLSH
T13C11C044D635B572CC3CD24BC9627B429BE9782380C754143DE15A140EBE51FEB9B647
MD5 SHA1 SHA512 TLSH

Submit Download

6dc3969b-e6fa-4037-b129-d2bf52206b9c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\6dc3969b-e6fa-4037-b129-d2bf52206b9c
Size 235B
SHA256 b47d83b660b0c5c93d6751ccd0c60409c7a5927839571b2f67b7c7878da0ca03
MD5 60cb4667c4651e3ae1ecc0aeea752966
SHA1 38ef911620f76e77cad9ab1ca69a81d6d5ef5f59
SHA512 07309717a8d510ecad9c1d4bead44d6e9c110d5bdc71028341d5d46024a3be1ea6756c306df4a508252dc57437aabeaeabea0362b49ada44b16a8e3bd843effe
TLSH
T19DD0A79A7498775E4C190F0BF0A07AD670488C3314A46C50D9A18678A9BEAC55161C5A
MD5 SHA1 SHA512 TLSH

Submit Download

76e1f94f-2b56-4480-ae40-3ff5849cc542

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\76e1f94f-2b56-4480-ae40-3ff5849cc542
Size 16KB
SHA256 ca915039a60955dc4969fcc02fef08aaedaeb6fa7250a4ad22c177a3f0ea5629
MD5 e9f0e03c3c0e595ce9a58a49be1a096b
SHA1 33803ba05371aeb2ef3bdf63b76a57bfd1eb765d
SHA512 620332c81f2befa58a9563268a8159543eca586f7f67b425966ef785586a50083d7f4b2969448f79c12a722030cd9613cf6cc50373ce84cb2db4e061627896fa
SSDEEP 192:3aR7QcejNVaM7lDSL4+4LOxNKnJmx0zAEBEKRw1EM4clVLgxJLzxRitJgS75n:GQcehVplD4EmclCklRitGS75n
TLSH
T14D72D956687055BA8591E358D4F87FC3E2F638CF4C019FCA8BE4BD0869DE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 9bd39eb9082125f9c68380378dc5700f39b2120de986bf6ef7b6bce6be7c8040
MD5 67175ce6087437e3c31084bea811f75b
SHA1 6c8946d479acd32c8e07bf997f9d50491530d76c
SHA512 97223c66a91e9f82bbce3a9a6382fb32d03d390fb660649adae4e21a80ffec2dd0bca73381b4e8322e0e290da6ac87e2b94162abb4f9c97d444918be1e78e90d
SSDEEP 96:xHdUTUZqGqofy/z1zSrMSSlcdv9jCnUHgYETBw88u8L4cn7yTM:P0Rofy/zuMSSSgYeBw887
TLSH
T1D1E12F7854088B7F74B677ACAC648C316AB2413BBBBF68C710B59484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 61d4fcff367736e68c64a850da8e7c21868799a903924db1d7bbe1e36ef2bfcd
MD5 4ad87c8bf1f6a0010382f0f4e692b422
SHA1 852b2d5f20d338dc385935b05e1d8a40b9503baa
SHA512 430b3d8aebd24dde35f409fb38f02a788f232a4114367a94495577be39c76b4a1b3fe4274e3f089aed71bb882efaa1631d188f198057709b50f0c6f61120a58c
SSDEEP 96:xHdUTUZqGqofyP21zSJSSlcdv9jRnUHgYETBw88u8L4cn7yTM:P0RofyP2sSSxgYeBw887
TLSH
T18BE1307894088B7F74B677ACAC648C316AB2013BBBBF68C710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asartools-1.1.0-py3-none-any.whl

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl
Size 1.3MB
SHA256 98a6aa98cd364165036d76ae6252443cecd24957006d55bbf2f02d56f31eda46
MD5 51d8dcf8cff925c00f47a749b3e3e872
SHA1 94e0029bbaaac787f2557c79452dc728f0841fe1
SHA512 03026e147ee80dd0d511ae7f560390e1f49acae50c5a45556a35322635a3c360ef0daa43468c4b9e31aa538a4c6ccb2c72a67ab6951f98a6442f85d128c1175a
SSDEEP 24576:zg+gEwiW23qQbpmv9zEKisLR6+A3jabcmpQJo46xu7Xd:z3gWW2xmvZEMLkpjaomeJcx+d
TLSH
T1D65533B951BE69BC44A9207FC31D5B6E4C0716B9B015FDB901DC8E835B4BEFA8434B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-4291-0x0000000003090000-0x0000000003662000-memory.dmp

Download

memory/3008-4293-0x0000000003090000-0x0000000003662000-memory.dmp

Download

memory/3008-4292-0x0000000003090000-0x0000000003662000-memory.dmp

Download

memory/3008-4287-0x0000000003090000-0x0000000003662000-memory.dmp

Download

memory/3008-4286-0x0000000000C60000-0x0000000000C63000-memory.dmp

Download

memory/3280-5-0x0000021594550000-0x0000021594551000-memory.dmp

Download

memory/3280-8-0x0000000000510000-0x0000000000BC2000-memory.dmp

Download

memory/3416-1-0x0000000000240000-0x00000000003A2000-memory.dmp

Download

memory/3416-9-0x0000000000240000-0x00000000003A2000-memory.dmp

Download

memory/3680-406-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3059-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-916-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-419-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-401-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-384-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-363-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-361-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-358-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-357-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-356-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-355-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-122-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-116-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-115-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-74-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-73-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-68-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-36-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-32-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-31-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-25-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-24-0x0000000003180000-0x0000000003181000-memory.dmp

Download

memory/3680-3051-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3054-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3055-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3057-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-1038-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3063-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3065-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3070-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3071-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3075-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3077-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3079-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3085-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3089-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3091-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3094-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3096-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3099-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3105-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3143-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-3179-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4296-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4294-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4301-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4303-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4324-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4306-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/3680-4305-0x0000000005560000-0x0000000005627000-memory.dmp

Download

memory/4876-17-0x0000000000240000-0x00000000003A2000-memory.dmp

Download

memory/4876-23-0x0000000000240000-0x00000000003A2000-memory.dmp

Download

memory/4876-6-0x0000000000240000-0x00000000003A2000-memory.dmp

Download

memory/5968-21-0x0000000000390000-0x0000000000A42000-memory.dmp

Download

memory/5968-18-0x0000000000390000-0x0000000000A42000-memory.dmp

Download