acrstealer | 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17294ae5b3fd.exe
Size 6.5MB
Sample260828-rxea7adc39
SHA256 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f
MD5 4780771e3d27ff89d6f81648c197b8a6
SHA1 7e295dbfbb54c73ef9a1cb0d567e25043a4add21
SHA512 1d8f96ff993c4caa09508fa46f5367bca234ba1a0740dc22b3d582edb0217a283392469d733aff26c1cc6d346f961987e1927fd604a06912dd9252591db7e8ca
SSDEEP 98304:nX6hoeIhDcgndodDjuEfJhkt8sfeJ36/i5Sq54IizhvMScU:nXvhDcg+DjBJhq8H30i5Sq5UF5
TLSH
T13966D02BF39B9536D48E067624B75325A37DE50443034BD763E8693CDE222F12F3A686
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer installer spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha1

stream.echovale.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 21 IoCs

resource	yara_rule
behavioral1/memory/3500-47-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-53-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-54-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-58-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-90-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-95-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-96-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-137-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-138-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-143-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-359-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-358-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-360-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-361-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-362-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-365-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-369-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-374-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-444-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-561-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3500-662-0x00000000050C0000-0x000000000518A000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3500 created 3256	3500	AutoIt3.exe	56
PID 3500 created 3256	3500	AutoIt3.exe	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	17294ae5b3fd.tmp

Executes dropped EXE 3 IoCs

pid	Process
648	17294ae5b3fd.tmp
2728	17294ae5b3fd.tmp
3500	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3500	AutoIt3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17294ae5b3fd.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	chrome.exe
4592	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2020-0-0x0000000000260000-0x0000000000349000-memory.dmp	innosetup
behavioral1/memory/1584-6-0x0000000000260000-0x0000000000349000-memory.dmp	innosetup
behavioral1/memory/2020-9-0x0000000000260000-0x0000000000349000-memory.dmp	innosetup
behavioral1/memory/1584-14-0x0000000000260000-0x0000000000349000-memory.dmp	innosetup
behavioral1/memory/1584-45-0x0000000000260000-0x0000000000349000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324012918399838"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{B9EE5DBF-6B02-445E-8EB9-9AE6A951531C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2728	17294ae5b3fd.tmp
2728	17294ae5b3fd.tmp
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2728	17294ae5b3fd.tmp
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3500	AutoIt3.exe
3500	AutoIt3.exe
3500	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 648	2020	17294ae5b3fd.exe	85
PID 648 wrote to memory of 1584	648	17294ae5b3fd.tmp	86
PID 1584 wrote to memory of 2728	1584	17294ae5b3fd.exe	87
PID 2728 wrote to memory of 3500	2728	17294ae5b3fd.tmp	95
PID 3500 wrote to memory of 2016	3500	AutoIt3.exe	104
PID 2016 wrote to memory of 2592	2016	chrome.exe	105
PID 2016 wrote to memory of 864	2016	chrome.exe	106
PID 2016 wrote to memory of 864	2016	chrome.exe	106
PID 2016 wrote to memory of 2792	2016	chrome.exe	107
PID 2016 wrote to memory of 4172	2016	chrome.exe	108
PID 2016 wrote to memory of 4172	2016	chrome.exe	108
PID 2016 wrote to memory of 3412	2016	chrome.exe	110
PID 2016 wrote to memory of 3412	2016	chrome.exe	110
PID 2016 wrote to memory of 3472	2016	chrome.exe	111
PID 2016 wrote to memory of 3472	2016	chrome.exe	111
PID 2016 wrote to memory of 1056	2016	chrome.exe	112
PID 2016 wrote to memory of 1056	2016	chrome.exe	112
PID 2016 wrote to memory of 4884	2016	chrome.exe	113
PID 2016 wrote to memory of 4884	2016	chrome.exe	113
PID 2016 wrote to memory of 1748	2016	chrome.exe	114
PID 2016 wrote to memory of 1812	2016	chrome.exe	119
PID 2016 wrote to memory of 792	2016	chrome.exe	120
PID 2016 wrote to memory of 3676	2016	chrome.exe	121
PID 3500 wrote to memory of 3012	3500	AutoIt3.exe	122
PID 3012 wrote to memory of 3884	3012	msedge.exe	123
PID 3012 wrote to memory of 2740	3012	msedge.exe	124
PID 3012 wrote to memory of 4592	3012	msedge.exe	125
PID 3012 wrote to memory of 2740	3012	msedge.exe	124
PID 3012 wrote to memory of 2740	3012	msedge.exe	124
PID 3012 wrote to memory of 464	3012	msedge.exe	126
PID 3012 wrote to memory of 464	3012	msedge.exe	126
PID 3012 wrote to memory of 3520	3012	msedge.exe	128
PID 3012 wrote to memory of 3520	3012	msedge.exe	128
PID 3012 wrote to memory of 3520	3012	msedge.exe	128
PID 3012 wrote to memory of 632	3012	msedge.exe	129
PID 3012 wrote to memory of 632	3012	msedge.exe	129
PID 3012 wrote to memory of 632	3012	msedge.exe	129
PID 3012 wrote to memory of 4712	3012	msedge.exe	130
PID 3012 wrote to memory of 2400	3012	msedge.exe	131
PID 3012 wrote to memory of 4712	3012	msedge.exe	130
PID 3012 wrote to memory of 4712	3012	msedge.exe	130
PID 3012 wrote to memory of 2400	3012	msedge.exe	131
PID 3012 wrote to memory of 2400	3012	msedge.exe	131
PID 3012 wrote to memory of 5572	3012	msedge.exe	134
PID 3012 wrote to memory of 5572	3012	msedge.exe	134
PID 3012 wrote to memory of 4724	3012	msedge.exe	136
PID 3012 wrote to memory of 4724	3012	msedge.exe	136
PID 3012 wrote to memory of 5940	3012	msedge.exe	137
PID 3012 wrote to memory of 5448	3012	msedge.exe	138
PID 3012 wrote to memory of 5940	3012	msedge.exe	137
PID 3012 wrote to memory of 5448	3012	msedge.exe	138
PID 3012 wrote to memory of 3396	3012	msedge.exe	140
PID 3012 wrote to memory of 4312	3012	msedge.exe	141
PID 3012 wrote to memory of 4312	3012	msedge.exe	141
PID 3012 wrote to memory of 4012	3012	msedge.exe	142
PID 3012 wrote to memory of 4012	3012	msedge.exe	142
PID 3012 wrote to memory of 5700	3012	msedge.exe	143
PID 3012 wrote to memory of 5628	3012	msedge.exe	144
PID 3012 wrote to memory of 5700	3012	msedge.exe	143
PID 3012 wrote to memory of 5628	3012	msedge.exe	144
PID 3012 wrote to memory of 436	3012	msedge.exe	145
PID 3012 wrote to memory of 436	3012	msedge.exe	145
PID 3012 wrote to memory of 5624	3012	msedge.exe	149
PID 3012 wrote to memory of 5848	3012	msedge.exe	150

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe
  "C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\is-KH5VXB4472.tmp\17294ae5b3fd.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KH5VXB4472.tmp\17294ae5b3fd.tmp" /SL5="$50114,2860944,890880,C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe
      "C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe" /VERYSILENT
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\is-A1F70FNYNK.tmp\17294ae5b3fd.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A1F70FNYNK.tmp\17294ae5b3fd.tmp" /SL5="$60114,2860944,890880,C:\Users\Admin\AppData\Local\Temp\17294ae5b3fd.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcf365c728,0x7ffcf365c734,0x7ffcf365c740
    3⤵
    PID:2592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,9300255235614186175,12201779442106109107,262144 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,11036376249225775135,15433846202914696084,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14936005207815012537,8416628750583827685,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13864425700559756813,7917127741468930536,2097152 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,8862603458445816391,6953019590973215864,2097152 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4052,i,6087158069331801728,9607447066407655181,2097152 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4104 /prefetch:2
    3⤵
    PID:1056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,17973145537275810469,14269097430100206661,2097152 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,9766784721203976757,3141243593291242037,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,16258653457333363696,12908207440099089227,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,17706953811347676569,4986439979289932410,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1732 /prefetch:8
    3⤵
    PID:792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,4225488975986089464,2710341694502813352,524288 --field-trial-handle=1988,i,3544561682683195190,17111445648365738055,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffcec03c188,0x7ffcec03c194,0x7ffcec03c1a0
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,17157775510394223933,1637870326251427830,262144 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13048987414704139685,7543251180914524552,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14155534852349023191,15096817225422467945,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5301225378263918534,1559351047765398475,2097152 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14283708204289216152,5857548188382226379,2097152 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6579088046211060282,15011329879777573784,2097152 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,5664873926301704408,13167940700530721801,2097152 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,16800472068157218938,14233697841223109565,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16298567331760916641,11740987377620162062,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11873193033756684313,9495346051314078002,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5972379155858506679,2337582649443797545,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16845751909528143335,11227120107471681020,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,16845751909528143335,11227120107471681020,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,1817016993343549319,8036241233472940044,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7187001523592284967,10584153199354823514,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,352120224959437387,17374928952854153229,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,10139629960358092753,16610407639992160262,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,372171052442492855,16483447287684192712,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,17325854119403862157,13257048147491094191,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,13156303628743726513,16690369792063934377,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12019733763067124138,12226867655327482726,524288 --field-trial-handle=2272,i,6283598543452255357,15891681393049912326,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
    3⤵
    PID:5568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4174d9fc9cb201ef75949557aa75d2c5f68492688742661b4678b0ca17965117
MD5 d22a64df15abca88a52acfa5bb0c3108
SHA1 15584f7fd519f77d403bc92473a760e0a8615901
SHA512 8ef59442fe74bd66db39d39ce973c89c63efe50856db9a37001a8532bb436fa2953614127345a743d2f170b98e8eb0f3029ba07d51c0ad3b0a8027da2633fbb3
TLSH
T181E02BA9CC21FD2B5DFD571D60500B46DA6013572BA1885F363C8508CFB16A78685C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb7d4748e1d2129c95af60372d70fc364e0f35ad04f6fe176ce57203d7cf6c36
MD5 91f3fbf3201ec22b92db07e6f99724d8
SHA1 f747b0d29f67842010c498434bdd05ab5a244a48
SHA512 f384db513c3ebb0a9009aa7b9fab82f129fdf87e017b484a38706d0e9508abffc6c2d3dd69ada90d9f9c49be6d55ab76067c49547b909e315fc34f85d0ce6eff
SSDEEP 192:GRO+si816Ov7ApAPRp2l9qHsb+WNn9i0MFHyyDVyIsnAUgtaJ:GRO+JqkUXmkwE0sR8
TLSH
T10F42C72EFA10693B9CDBD219F9217B57DBF5203921942EC4EAFC8A2C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f0b1b6c6576b6eaff30d26dbd935018ec1ca4ab91add727d7949c4df5e22e417
MD5 e1e7716fbf080ea736cccaa86fa795dc
SHA1 8fb4a99a062b25dcad2e9d31e484fc955272dcaf
SHA512 169901ff53dd0e5090ce4621aa100727a93933a4a52321fd24103d5cd579eb8913e22f0fc28dd763798cee292de0a17b44ad39cd255925d405c34b70b2277ea9
TLSH
T14FB012418082A103C45702F0236214887154AF20D70B2B0543E0E922D8251A1C01C050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594675.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594675.TMP
Size 96B
SHA256 07215a9e7b825eba2114a8fecf437ff4a85991c8659d8d459b8278a40cec1920
MD5 da6e6cc217cda5f86a78d35b1eb82795
SHA1 793a26359b00acc97eb09cfc537b6026c459b7fa
SHA512 69c4d753e284d6978570df026abf2049156163170cf30ee3c6ba3792e8136365262c309e65e090ad6954386d1c2773e83c6dc82ee07eaf2c0efd4eea18e41674
TLSH
T17CB0220ACA033222C20B03F020F2AAC83030CF28C3030303C3E82A22EC282328830220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4332b6b079c62d7740a65521a9dd2dddb162b6cabba8f29bc2ffc2fa5273a3a4
MD5 16216b70a9c66cb32d90de869021e891
SHA1 af5ee727a5cb7db78f21bbce7eddf733a525ae58
SHA512 442e87dbf2e8e3f76ce004525fb50a4a939b787bc8efdd4e203a7ce54353d906160005e566a8330a7c76bb96285c65b6d47028303c0d71af2be0359ce03a29df
SSDEEP 6144:efWnkvaMuff8iuG+XWqkOAv5cMm7Rkm1tYpBeh2BAos:WSTMP3p4v5U9oBGcAos
TLSH
T1F4341265ACA67C378C36E62B318E0E1F2CF19AB5D028D902C4D59F097BFB7995A42434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d1ce78a75136452701a20bb7a579d203e41121567a25e63dc3d2ed0c222eb49b
MD5 c7dbdf88742e9ce77f250780a8c772af
SHA1 a6321bbf230b530e0a55125df2fdd77ff21492c4
SHA512 13a2320449fddcd88c1a773bc973af8cca323959285c2d2945d802d77a7e7265bfbe9541fbac299c55516a28c35b32aea3f7d2ee87ac0fa7f57ea04b020803c1
SSDEEP 6144:LfWnkvaMuff8iuG+XWqkOAv5cMm7Rkm1tYpBeh2BAos:zSTMP3p4v5U9oBGcAos
TLSH
T115341265ACA67C3B8C36E62B318E0E1F2CF19AB5D028D902C4D59F057BFB7995A42434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c49faae4e9c0b2eb10fba430ed86f858f546075e60106169a81fb15a525464c1
MD5 2f324abed9076d1453359ec11abf71a5
SHA1 83093626b5af66f93d438d5e148acd24b004941b
SHA512 dad53118d7c10525c98ecae17e9502407dc5ae8cfac9dd826d5bc1e16f9d2d5f7d6d14085923636ce0c5da39a74f335b7e5e236c447c2e50428fc00d7b5822c0
SSDEEP 3072:AXGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Jm7Rkm1tYpBeh2BAog
TLSH
T16AC3023B5D75E83B5CB5A74EB48E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2aacc511b79b03cceda21f4f3aaf4101a494ebe059c7aa50823bd97bc6e7c5f6
MD5 a463ccd7f93c041506aa1a58963ff403
SHA1 31006ca175dd2fc35b3d1cdea8836e48d66da086
SHA512 5e0a92310dd69b15a0886ba35d68c0a43ac3e34e61c68081f5b5e6cb47aba03974fb0a8abfc38feadf96d8ddbac16980125060876132fc3c58951a7a3c4e461d
SSDEEP 96:qaDNeF/fMNbGLUyrQ9yOyMlgdonueihbiaFnm5:qaZeF/0NK/urlgdonuz9nK
TLSH
T121D1BB344ABABEA0FB6D0AF1A7D00E4434794AE6FCA7BF8731427B74340779161C9216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2c51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2c51.TMP
Size 3KB
SHA256 0ee4eda3b6af87f91e221563f6ae058d747223ad826278593f32a6e7aa2a11bd
MD5 d411205ab2e976f6bdeef28c0ccce655
SHA1 26a05bc85c69b9b8aecf5037c2e9faa45e714f28
SHA512 a181272926dd61f28a965af1e0999962a76ed576f6a78d67e3f745edbaddcbe5f310e19a5247d5f6e1480c023bdb61ba44468f50ddae92f9941888e0dfef746d
TLSH
T12F81A7380E6F00B5F3B11FF2B3D14B44347E82EBF993BD9A62816A74790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4a7215c453181b7dcf3c36717cb44972b957c1c1f3cb2ecd600c1d0245ff391a
MD5 077580b54bdf237a784e820ac0a1eb14
SHA1 a44cacc8f8efebbec2f3f09f0cff2469ffc5f8b6
SHA512 4efe5c0988d3671dd4f77be4b7bd9e259f06d38d8f572ae54a0753b6b842e4254cf3529f09aee49a23090251834da64310ddf48ceb6979ba825d4541a0bd294d
SSDEEP 192:sxZf9RjyM/jK1Ml8MEQ/f6sEN3x5bzbdpm1HW6+WNBWE/YzKdSVqIg4J:sxZf9NcQ/f6sEN3/X2Hb7/3c
TLSH
T18552F7026A24597BDCDBD208F9517B53D6F81563D5904E48AAFCCA1C04E6FED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fa8ecf1a8102e3d6ea3790d75d6751ea17df07d2cee3c53cb1f377a552f03fb0
MD5 ffeb8a774cb854bce244f0fe2aa8adcb
SHA1 eddb7000fec628270568ca0b64b8f0f0fcf5c79e
SHA512 92280a7b7cffa3c5534f44f5af8360e6f74d23e25f167b0cb94afedf444f4cef1c00d3d75bee808ad6061a90f220e870249b111ec61c1980d2b0e404eb127d40
SSDEEP 768:tcW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVt5LlWYSjiroII1uY0:tcW7k+0Wvqidau1jam5LA3j5D0
TLSH
T18DE2FA3B684CCB7E4F840E5CEC266F966ED801CB6698895487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 864B
SHA256 e03c7f91a6b36a6935a91a5fc8bab6e520dc02d2c76010a1e0a49bd43d905912
MD5 f2278d127b9c03919084d5ad5f8b2426
SHA1 b61d31b5089cd34abb6b5d20b52ee35ffbe374f4
SHA512 31b754419274f93156720c674b0602ed2b58342633e5adf6d067525ff02ae9d4e13062da00e936a2c212b1cd55b8465fdd7b0b4e02b73ac62d9c96360e3088af
TLSH
T1B611D3564EA18D2FD95901B719FAA0E4B33119DC6321E5679C1C1A762C6734968071DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 8898c3de92167110308097df1ae8778a46a6fc97dc1f7c518d9ca443a7293813
MD5 304290c31ba2fb0b8c49a585eaedc5ae
SHA1 8d4585d0dc9453ac13057677c246ffa82271c41b
SHA512 5a4128af00e9df92d011b381c963424b30828c27e491c8cf1da1cbe0ba3362949ea979307cc2a4a7fd9a8a8634dbd3a1101ba0ce48b933698dbb266582a13bb8
TLSH
T17E51D71F8E4A1E6DE89C95710CFA1C56333459EE1788AD0752EED330A8E33381E89645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c114.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe59c114.TMP
Size 864B
SHA256 bf8c1bbc6d03168f7564eded5b92e1dfdef95fddf693357badeec8422d5406c8
MD5 fbb93a5288a47d7d713aaf8c07c9270a
SHA1 2a3934afd738ae3d87351cca6b778f861895c4a7
SHA512 578a8a5765572769aed0ff334a2d1609c13dcb465213f553c353d713745521eb7f29736018653f2963675b456df5719f119abc431efab8152efcd200d9704338
TLSH
T1A911025A4AA24E1FE844117B1DA5E0F8F3314C009322F7E3A42D193A5C7ABC959070CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 bb949aeac2278f0c4d1cf87b52d7f681f47573101a3d8f4966a819f36a282c48
MD5 4c796927e2d2b7a39a61729af3bce15b
SHA1 716e40bcad45ad48ada0d74f2039b4a432596ff0
SHA512 80c421ae07ff8a2be76a236500a51756ca4a212e49b5821c9393cd09d7f44ac59730b9f1f00016d31c0e58de5e9b74b4b5725c7b6276d25c7db520f25c8fae4f
TLSH
T141A002118BC0821AD01B51F2165317511304C8902100574740D15084CC544918E4510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 2dfc78a44a267b9e9f0fcb1f3686330287fb895bee9340956dadf2f9c308a003
MD5 427e72e16e94a8ad5a5ec4a2c968bef5
SHA1 e91eb1dd2fc9478f634dd25c9d4f184bccaee15a
SHA512 28b619b6491010c3fb4726e8718a60671f4f09884096e1dc0e67a0c952068cd44673220a4c77447d5b2ebe63ac3780440eb1359d33e78e8d7a40505f0122fab8
TLSH
T152A0025542C05861D41617F626F705452710CD10C30353C75598124DDD505569EC164E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 108ab2cc15029c227b9f4c7d4e3d3afc3c126834974ee74952cd96a5280b2206
MD5 fe22475ff45c69bf66de09a425e479d1
SHA1 8f7bf4f344d273f251f4f192298df6d01355c08e
SHA512 8ffb6b68a008037850384e9d89d1590795cb07273a4e60c2853d31a8c2ef1739a3ae02a3bb9a9fe5a9b582a97b7c56cbe363d8af8c05fd902acc7691f0ca7b19
TLSH
T157E068BB2DFB1820AC6F87C538B054A0818539188500EC4E3067A28770F2351240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4cb0b9cf2177405297542c26fcc46cb9df6de72374e47e31ff6f4075a6946741
MD5 a24a876f3847cd00f0768523422a6c99
SHA1 920a6336b0c6b1e05996d50fca5f7a136c29edb0
SHA512 bb2424560190d9bdbe3233ba842528d95ac84b04384c8925611a046231f13250ca889872891efb81f4e86dc8a8a310b7cd1532fab5afb57712de38185125571a
TLSH
T1E0A00221D9599C46C08907F0A8A1028863519FBC4649275350FC00D58ABC14057A2304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a14f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a14f1.TMP
Size 48B
SHA256 22e79012f2b8b1dba7b5fab0ed4064e369031a69fb35518cf138c9e7ffee4f67
MD5 bf115c178555c82e43a47a9569030946
SHA1 573962a060da83be74da153f1ca9b2e466491500
SHA512 e4ada09fedbca627c5706d8830b628dcae420ac7f2d8b210b473223149a82ace21190ed5683bbfe4c9114283ed5416fefc7d76782b6cea96811417090aea7929
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 408e0089739a6d5290f42ec161951d0963f9850fc6d0ccf92c9386570b79805f
MD5 8832e97e2ca46d9484e1e5057bb17b95
SHA1 13d1295fb29cb4523a3c888c6ada2415b71a81ae
SHA512 5a50e47ca5691c521f224591a83f881ce035d90ce1281db341c6c96f03c0a5852764952cbf1cd6108a2c2929b4125e1f0e0f1a14c800d6b220eca33bb2848cbb
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcj52K8:sCFp/
TLSH
T1E1914101747F060138BE28089666C9369F4271673658A8FF7BB914630EA7E114EFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 11bfedb6a0bc129957abcaad1a40fca0febc4bcea389d2f3f87303918195e19f
MD5 f4cfe1a07d099578eb7189bb4d8c2abb
SHA1 a071e3d3dc89a121047e29f6961303ad02d5d954
SHA512 e1ac56044f9c5993918981c0821a896bbce8245475f30b06aa2117f0834254fe284c6b0ea1b6a00b9f8aaf62b5c484d3f85e701d67a87ba433608887e306c47d
SSDEEP 192:P+xWefywz6rfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx5fwrfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13324730A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bc7c153f8d0800546e11b48a5284f9725bc9f9de3394bafbb0854dd7f2a40d7b
MD5 648d946a89a964fc69861d44702c07a7
SHA1 0c88899c8bb6a3c6ec9039f2c605cafdf6a2f4f9
SHA512 307171bffe774284a49b4022f762219d21c66bf7eebe2cc2ad613fba8ab06147ed19d2d41b95e96eb0262362d634dfd0bf201b42eec0654f733c8f00def50cea
SSDEEP 384:nhZcIhsNcWThbk7DIdEaACEJrT30X1puLNQao2:phAikyhT3syLNQad
TLSH
T1CB828C705C799C7BA8E6F101F58B37074EF81037A9C85E44F2E9DB1C0196B892B0B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 903d5142c387b24a3c5c0fbcdcd9c078c00a5aafc73f0adaa48489d46303860c
MD5 7d22edf4b818861f9870220fc7def096
SHA1 c5927cb8cd7f8c6d190e2bc2194f3cfa6bd96dbb
SHA512 97d757b600b13fc8be47285c4fbf43a04a16ef9acb69eb482702c137d66fe84bc71cdc2c0f8a53d190dccd3cce950826b57fa300041d0ed484a0b43bab6e3ec6
SSDEEP 192:MON664BAQmiUyO1xW5GBPKXo+FdGJaraD3hLU6:MON66eAtTWTdEaQRLU6
TLSH
T19602E835AC686C7B9EA2AE45F48637175FD8113BAAC51B44EAE85B1C019764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8e92419a26363425dea230665de50de7bfaae2e4db1d3b334c21510ef695e61
MD5 71f02229eec5d703e336d42cf00c7703
SHA1 d9928d47610fa3f81d6c51dff3696fc965d9d4b0
SHA512 cc3e55063e183686c0bd81e4ec4b0f97266429e3c041637e07022d17f2e1408454638eaea3893c15323f4f75acd071ea44422f91c54b45c64d1297550559449d
SSDEEP 192:XONV64BMQmiUyuxR5GBPKXo+FdGJaV6FC1SJr9Ww1quzU6:XONV6ecpRTdEaACEJrh3U6
TLSH
T10D122A34A869AC679EA2B501F4C737539EE4117BEDC56F44F6E89B1C00D7B4C3B0A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8a4211efb921e9ecf239a667a7d9bbd049ef9e2702558643f3c684a2bdc1bd1c
MD5 f9335ec406c11518dd03ad6a0faed8e3
SHA1 f2cad7ba2e27c90e3c1e9b8ff48e2178772f6e3c
SHA512 3bc0d65f65994b574b1dbc8909a83f87f8eaca1c8ffd6e2048d0576d2c9aa056b12a079e60b434f4291f1a870554f2562fd2064da257e5979985dc703a4f0be3
SSDEEP 384:noZcIhsNceThbk7DIdEaACEJrb30X1puLNQao2:WhQikyhb3syLNQad
TLSH
T1EF828C705C799C7BA8E6F101F58B37074EB81037A9C85E44F2E9DB1C0196B892B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa43488b-2b7f-4990-9dec-19dad19f3095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa43488b-2b7f-4990-9dec-19dad19f3095.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8d9ac17833da124c193f314aede9aeffb6551cfba41aa6d33985dde121137c23
MD5 c911c8dd2453b0f953d649cfad0beece
SHA1 3cba8fdae37f78778322ae2e01c741a2f8f9e21b
SHA512 2d97363a9e189276e7cd62cdcee11a5e9ecac35c3a6dbe6491e0d22580bc4a1e6fe8244468c5ac7df5f69ecc0235b20044170205ff30c1cfdc3929646989b153
TLSH
T10741E759AAF91148B3B76E1AAFF7AC6E447B79332E0A855D00110E4E0A27B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

43119e33-4b59-4a15-aa90-15be56fc8b09.tmp

Path C:\Users\Admin\AppData\Local\Temp\43119e33-4b59-4a15-aa90-15be56fc8b09.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58af37ef-95ae-4987-811a-a4a4e2868e31.tmp

Path C:\Users\Admin\AppData\Local\Temp\58af37ef-95ae-4987-811a-a4a4e2868e31.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

17294ae5b3fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KH5VXB4472.tmp\17294ae5b3fd.tmp
Size 4.2MB
SHA256 a08d482f5e3127d09659f55f99cffb6eea813c8be6ad5995d09314ba5f7d88dc
MD5 e2480370b710d9046394c5b677364313
SHA1 dd7c5de2a5fb76c5bd2f7c8e83327d6d9d942c23
SHA512 da18bdc01ae5daf8a9072e66fe50f98dea75642de6d176be0b36c885939b33ec7a93f7e2326ef50fee200978b463a65d4d105d053f6a79298874189dbc658e68
SSDEEP 98304:KiDj+6GqBH6KwsvcHJ4c91usxgkod1sc+333PR:XjpG5ucZus5Qn8R
TLSH
T158267D13F784653EE46B1A3A4837A254993B7E303A16CC477BFC298C4F396406D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13b9c536-0ef2-4f33-983d-2cadfc013b39.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3012_1560252935\13b9c536-0ef2-4f33-983d-2cadfc013b39.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3012_1770621890\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asartools-1.1.0-py3-none-any.whl

Path C:\Users\Admin\AppData\Roaming\Programs\node-runtime\asartools-1.1.0-py3-none-any.whl
Size 1.2MB
SHA256 3e570a5fa02da91d9e2ead9ecf43aadc5cee9e8732ad8b7c059238556f599c21
MD5 92df74d2050fe8d64225f3a9fee2cbf3
SHA1 8fb689f8d51594c09035e5599b297e291c282303
SHA512 99fec742d4b8cab3034e160bff680f74433d62f19a369a550faeca09191f4327d28fb6c4643fdbc9558941bd9e8f4237fbc611e66917525da6e4fe1f6a4b6701
SSDEEP 24576:XykRkk4SFVRXxs148+C5hMU40j8X0LnQ4coN30EKZFfkZ8JleAGIMaGq:ikR40VNmjL//j8EnQ47ekeTGIM2
TLSH
T1A94533033DDA474BF8E192F7B9FD8DB63336845E0E782804B616966D439F6B5980E60C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-8-0x0000000000ED0000-0x0000000001322000-memory.dmp

Download

memory/648-5-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/1584-14-0x0000000000260000-0x0000000000349000-memory.dmp

Download

memory/1584-6-0x0000000000260000-0x0000000000349000-memory.dmp

Download

memory/1584-45-0x0000000000260000-0x0000000000349000-memory.dmp

Download

memory/2020-9-0x0000000000260000-0x0000000000349000-memory.dmp

Download

memory/2020-0-0x0000000000260000-0x0000000000349000-memory.dmp

Download

memory/2728-18-0x0000000000860000-0x0000000000CB2000-memory.dmp

Download

memory/2728-15-0x0000000000860000-0x0000000000CB2000-memory.dmp

Download

memory/2728-16-0x0000000003100000-0x0000000003101000-memory.dmp

Download

memory/2728-13-0x0000000003100000-0x0000000003101000-memory.dmp

Download

memory/2728-43-0x0000000000860000-0x0000000000CB2000-memory.dmp

Download

memory/3500-137-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-662-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-46-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/3500-47-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-53-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-561-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-54-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-58-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-90-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-95-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-96-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-360-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-138-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-143-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-359-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-358-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-444-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-374-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-369-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-365-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-362-0x00000000050C0000-0x000000000518A000-memory.dmp

Download

memory/3500-361-0x00000000050C0000-0x000000000518A000-memory.dmp

Download