acrstealer | 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.8MB
Sample260927-eelw4ayblf
SHA256 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811
MD5 d3cea61538aa5030e90a1d38cca762b4
SHA1 dd39fafbdba994169991cea092c6428e1d3b1539
SHA512 9672ce4ba4bef67039cbd5274a7e3e6010261d961b5eb2c45df254397b567923d72c40130ec7524cb15fcc6d32b5a50908f870329568c6830fe10916144f9af3
SSDEEP 49152:pJ1O7EpfelenkVglN5suzIEUP7ZmQNRBDXG+Chg9GPcPIvGqgu/2JZfy:pSVqkVglN5ye+m9cPW
TLSH
T1A4857D71279BC43AC57E80B02529FDBF943D5D269F5598C3A3D87D1E29384C21B32B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer sectoprat persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

xor.hex

Extracted

Family

acrstealer

Version

4.4.3-alpha1

Decoy

googlesyndication.com

Attributes

ddrs
https://telegra.ph/String-Methods-08-01
guids
019fd862-6a3a-7ae0-9126-4c50bf4131ad

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral1/memory/2344-7756-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1124 created 3280	1124	Setup.exe	56
PID 1124 created 3280	1124	Setup.exe	56
PID 1124 created 3280	1124	Setup.exe	56

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
223	2864	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4652	AutoIt3.exe
2344	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\0007d9757dca\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\0007d9757dca\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1124	Setup.exe
1124	Setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 2344	4652	AutoIt3.exe	153

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5980	msedge.exe
2848	chrome.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{E5188869-E70F-415F-9ED4-37E9A5B69F35}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1124	Setup.exe
1124	Setup.exe
1124	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe
Token: SeManageVolumePrivilege	2864	powershell.exe
Token: 33	2864	powershell.exe
Token: 34	2864	powershell.exe
Token: 35	2864	powershell.exe
Token: 36	2864	powershell.exe
Token: SeDebugPrivilege	2344	RegAsm.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4264	msedge.exe
4264	msedge.exe
2148	firefox.exe
4652	AutoIt3.exe
4652	AutoIt3.exe
4652	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4652	AutoIt3.exe
4652	AutoIt3.exe
4652	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4036	1124	Setup.exe	104
PID 4036 wrote to memory of 3728	4036	chrome.exe	105
PID 4036 wrote to memory of 2848	4036	chrome.exe	106
PID 4036 wrote to memory of 2212	4036	chrome.exe	107
PID 4036 wrote to memory of 2212	4036	chrome.exe	107
PID 4036 wrote to memory of 5176	4036	chrome.exe	109
PID 4036 wrote to memory of 5176	4036	chrome.exe	109
PID 4036 wrote to memory of 5288	4036	chrome.exe	110
PID 4036 wrote to memory of 5284	4036	chrome.exe	111
PID 4036 wrote to memory of 5288	4036	chrome.exe	110
PID 4036 wrote to memory of 5284	4036	chrome.exe	111
PID 4036 wrote to memory of 5388	4036	chrome.exe	112
PID 4036 wrote to memory of 5388	4036	chrome.exe	112
PID 4036 wrote to memory of 5744	4036	chrome.exe	113
PID 4036 wrote to memory of 5744	4036	chrome.exe	113
PID 4036 wrote to memory of 1228	4036	chrome.exe	114
PID 1124 wrote to memory of 4264	1124	Setup.exe	119
PID 4264 wrote to memory of 2144	4264	msedge.exe	120
PID 4264 wrote to memory of 5980	4264	msedge.exe	121
PID 4264 wrote to memory of 5912	4264	msedge.exe	122
PID 4264 wrote to memory of 5912	4264	msedge.exe	122
PID 4264 wrote to memory of 5912	4264	msedge.exe	122
PID 4264 wrote to memory of 1000	4264	msedge.exe	124
PID 4264 wrote to memory of 1000	4264	msedge.exe	124
PID 4264 wrote to memory of 3428	4264	msedge.exe	126
PID 4264 wrote to memory of 3428	4264	msedge.exe	126
PID 4264 wrote to memory of 3428	4264	msedge.exe	126
PID 4264 wrote to memory of 3256	4264	msedge.exe	125
PID 4264 wrote to memory of 3256	4264	msedge.exe	125
PID 4264 wrote to memory of 3256	4264	msedge.exe	125
PID 4264 wrote to memory of 4004	4264	msedge.exe	127
PID 4264 wrote to memory of 3800	4264	msedge.exe	128
PID 4264 wrote to memory of 4004	4264	msedge.exe	127
PID 4264 wrote to memory of 4004	4264	msedge.exe	127
PID 4264 wrote to memory of 3800	4264	msedge.exe	128
PID 4264 wrote to memory of 3800	4264	msedge.exe	128
PID 4264 wrote to memory of 5252	4264	msedge.exe	129
PID 4264 wrote to memory of 5252	4264	msedge.exe	129
PID 4264 wrote to memory of 4336	4264	msedge.exe	131
PID 4264 wrote to memory of 4336	4264	msedge.exe	131
PID 4264 wrote to memory of 5728	4264	msedge.exe	132
PID 4264 wrote to memory of 5292	4264	msedge.exe	133
PID 4264 wrote to memory of 5728	4264	msedge.exe	132
PID 4264 wrote to memory of 5292	4264	msedge.exe	133
PID 4264 wrote to memory of 5432	4264	msedge.exe	135
PID 4264 wrote to memory of 5128	4264	msedge.exe	136
PID 4264 wrote to memory of 5128	4264	msedge.exe	136
PID 4264 wrote to memory of 5544	4264	msedge.exe	137
PID 4264 wrote to memory of 5544	4264	msedge.exe	137
PID 4264 wrote to memory of 5488	4264	msedge.exe	138
PID 4264 wrote to memory of 5488	4264	msedge.exe	138
PID 4264 wrote to memory of 1112	4264	msedge.exe	139
PID 4264 wrote to memory of 1112	4264	msedge.exe	139
PID 4264 wrote to memory of 5356	4264	msedge.exe	140
PID 4264 wrote to memory of 5356	4264	msedge.exe	140
PID 5404 wrote to memory of 2148	5404	firefox.exe	143
PID 5404 wrote to memory of 2148	5404	firefox.exe	143
PID 2148 wrote to memory of 2960	2148	firefox.exe	144
PID 2148 wrote to memory of 2960	2148	firefox.exe	144
PID 2148 wrote to memory of 2960	2148	firefox.exe	144
PID 2148 wrote to memory of 2960	2148	firefox.exe	144
PID 2148 wrote to memory of 2528	2148	firefox.exe	145
PID 2148 wrote to memory of 2528	2148	firefox.exe	145
PID 2148 wrote to memory of 2528	2148	firefox.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaaabec728,0x7ffaaabec734,0x7ffaaabec740
    3⤵
    PID:3728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,11960582472816315596,4950339408777185165,524288 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,2701510051263073575,7121737888708222319,262144 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:2212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,9475185570562484148,3116079419814491103,524288 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2564 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,2949803564428494390,5136919762183274672,2097152 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,10489886271672414655,6405294903246905587,2097152 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,12372684132913503699,13418421337627483194,2097152 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4220 /prefetch:2
    3⤵
    PID:5388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,10478700488488910707,17113796899133418800,2097152 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,11334268587764530763,56148914141632755,524288 --field-trial-handle=2144,i,6437817713646946135,8510180949727050960,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2a0,0x7ffaa201c188,0x7ffaa201c194,0x7ffaa201c1a0
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,3781769951204321143,2811210222614733738,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,5459582917915914471,15548431301761112540,262144 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12936675910398033503,3833009710230748104,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,652446095228237513,791623232668406802,2097152 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15391562241938563475,7030070795793654075,2097152 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,7170942435023888879,7242698152193815036,2097152 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,6984574948817791000,3884020561188786505,2097152 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,11188719043720294352,16957726964874552940,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,3680092104175942675,16582431684649864367,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,2176942238022296626,4008046168046972539,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11118034137723678948,2692897733602364974,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15855232672260724067,17896093294035042737,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15855232672260724067,17896093294035042737,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,17392593363806649505,4960482653913599457,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,3381054017288669592,3767563482795816068,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,15306472094903419592,384047896604420443,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,11672147410142943943,14476123434004426115,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,12034342404154500593,15823949601322319907,524288 --field-trial-handle=2284,i,15722026565847023261,3838576521616193752,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
    3⤵
    PID:5356
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2724 -prefsLen 24447 -prefMapHandle 2728 -prefMapSize 268500 -ipcHandle 2792 -initialChannelId {f87df66b-0cea-40fb-9b3e-d0b199af9cb7} -parentPid 2148 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2148" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1752 -prefsLen 24657 -prefMapHandle 1968 -prefMapSize 268500 -jsInitHandle 3540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1748 -initialChannelId {d559a5f4-42b9-4943-937f-598cd93d5846} -parentPid 2148 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2148" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3604 -prefsLen 25543 -prefMapHandle 3608 -prefMapSize 268500 -ipcHandle 3640 -initialChannelId {d1e632ae-449d-4ced-a5f4-808daff4ae2f} -parentPid 2148 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2148" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3984 -prefsLen 25606 -prefMapHandle 3988 -prefMapSize 268500 -jsInitHandle 3992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4000 -initialChannelId {364f411a-e9e2-4a89-a4e2-efe53c632ed3} -parentPid 2148 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2148" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 36251 -prefMapHandle 1724 -prefMapSize 268500 -ipcHandle 4996 -initialChannelId {6d83bf66-f8a2-4179-9cf2-8faf8f8cfb9d} -parentPid 2148 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2148" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4716

C:\Users\Admin\AppData\Roaming\0007d9757dca\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\0007d9757dca\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\0007d9757dca\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4652
- C:\Users\Admin\AppData\Roaming\0007d9757dca\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\0007d9757dca\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Debugger Evasion

T1622

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 38a249f30338ea895670cab66560f3cdbc776a7d5e753f2c0609ac19f3046fb7
MD5 1004a1eac9655ffd703cda5a8a5fb20c
SHA1 2394f17745b963f88d1af349d153bea7ce472b2c
SHA512 47b75de5951f177dc7188b0fe975cb2684d1659c784bd21da04663fdbf1b0731ba3127d0f3558612856616c8cdf7316722eb49c1741f57b0039a5d424a3c921f
TLSH
T19AF0F9A9CC21AC3718FC1B6A60A81B4AF79113672742845F7B3D820D4FB463B4649C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 66a5c9c710b4eb19139388983289175994706fa5db5390b5d77aa4c1da4abeda
MD5 18843dd17ea320de60ae53d1194412cd
SHA1 5c7bec2d85d7b9044cb70bf404466b418e2b4bdf
SHA512 0f49c81de227e5dae2c15a65a635a2ffbea0c734c9a7a1be2609ad5b8fbfe7e8b17694df85e5f4387f06cd4555e381dbe6512ed65b2878c5d0c3ef5d2598c311
SSDEEP 3072:wJE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wm+hFD+7t56OD9ZfSAppr3
TLSH
T1A5D31232AA94D8BBC9BC6541F157A300CE626CED45DE7A09444A9F8EE09FC5C0673A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 19e53bc1388c7dbcc611d61d7cf8661d68e2283e5ee00f99e98033447f0907ae
MD5 74e2488dcc35639b94e4effe56396280
SHA1 511cb362a73fac87d835c80cc462c8cf72ba1ea5
SHA512 9d511c27892270e31a96d2f9129b30f8f3620a9024cf79ba773b2c11dacb9bacae7f541004e711e416824f18bb4934695e864317305eccd28f48635616b1cff1
SSDEEP 192:sxZjRBat/fdsYfo6cbhwPdpmCHW6+WNBWLq0/Y3Co8IIg4J:sxZjet/fdsYgfwr1HbMe0/T0c
TLSH
T13042E9166E24687B8CC7D229BA15BF53E6FD503295D50E4CA6FCCA1C04F66CD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a647ed258320e113503fb21bede401007f368daf0705c0cce5d766d4d5aeaf5d
MD5 a0e8d7e94bb43b155fecb9dbfb75faa3
SHA1 8dbde5aea9c7ccc4ae03047a91392a5f5be9d71d
SHA512 bcaaeefd54cb691bb8f158f9ea5d8d3186df7f8e662bcca64385de912158c651a500bd9c474c673717622ac5bfddadb05427a9aed2a4ab63c2169ca487d2df4f
SSDEEP 768:Xh30AiV7pLuLbWSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVQBLmLlLJ72YroU:Xh30AijEbWSWvS2l9u1jaBBLmLZ12jH0
TLSH
T130E2FC7B680CCA7E4FC04A9DDC2A7F9E6EAC02CB9698C94047F9945C02C76EB51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 1KB
SHA256 c44be074e24a00704948eeb941bac3e49ba6fb8147bfa2c6388ecfd7229a3606
MD5 bf1a23c9958b9801f11f25ce353257fa
SHA1 a7be4f75d1a3431942ed2f83c1305a68772add01
SHA512 664e81a96fc055cbfb30298efcd868165baf0249ba0de2a889fc80d7adda963b64233c12b3f4f11163aaf46d500f8387cfbfa81a7143982ca7f040f24f2484c9
TLSH
T12B2121564E935A67FE945238203E2856B37091CC43547F1F63FDD135DC92740A889498
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598534.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe598534.TMP
Size 1KB
SHA256 d1e9a7346b2e41940a4453d71f4e15eafa9ed0c69566dc516e53d659914c901c
MD5 592a3d084b829185d5db3fafd2540d1a
SHA1 5d8e63b9e2c22f1661acdc4d031a1d30dc53825a
SHA512 894608f1f146ff7297a7fedca3c070d7c006493d76011f8268dbf2ef04918845133c686a14418678325d107996882a0b5c251cae1f8b39102d55a4463a0ebd36
TLSH
T12621846241A30B27FC542332156D68933331D54853443B0F63F2A03AEC81B40AC86EA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d49e505d12378d3124429d62b441d91354e677b85f67c30fde8534c839a87ef0
MD5 19a1d0e5b40ba31ecaf52a0ee1b1b968
SHA1 fc74444eedd1d76e60415a2651fee74c31e88e09
SHA512 b5806746bb4a174415fc3bd2bf2b03d3c811cbcb7cc20b2b7076f82cbaaccaec50a4beab8dcf1dd44e48ed7dbae440f447c50941e33d6a730ff18ac1ab131137
SSDEEP 384:nkZcIhsN3hTlqpu7Hk9iX5F71sFq7sjtgOIwZOyaLNsod:ChRwga8bjXspmK
TLSH
T1CB828E35A8B89C7B68EBE105F18B37039FB864B7DAD59F44E8E9971D01C2188170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4bfd20facf76909168c9fa0eac616ef6263872719e58e7b8a48e204ebbdb49e1
MD5 fdbaa85b78dc3dac0a0e34bba63917df
SHA1 028ce0d97dadcb0f0f8b3a76f004cf631d6d8eb2
SHA512 04062a3743c0131901d31b2dd1a58e0ed04d1e89cca6b9837b91f1f84fea5db39e9d919ef027ee880c275a309adc19f2a065afd7bd10c5453eb7fde2971ee76b
SSDEEP 192:LONy6AmwpTQmiUyAfksiX5F7wksFqwKPeQlRXqv+NU6:LONy6ipFJksiX5F71sFq7DjU6
TLSH
T18E122B35A8B9AC7B5DD3B514F0873653AEA421B7DE846F44D9E81B2C05D628C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8229d3be433313bc67cde658999cafffe577b785707d63878ae61ed481254d3
MD5 c080ccc82e76553f827b53d6a1676962
SHA1 b8c7777e06fed7c3fbef47a258bb6cfc4ce62937
SHA512 1165b90df940dc05af00d40abd6da4f32c39dcf582a5835cd6a2af8a1f1874f54b89bb46eb0d8b7e18eaea019899f7b2f0852673fd9f1a92c60290f6e91186d8
SSDEEP 192:LON/6AmwprQmiUyIf6siX5F7wksF+JiLpU6:LON/6ipd76siX5F71sFr1U6
TLSH
T1A202F935BD786C7B9EF2AE45B04B3713AFA5117BEA902F84C9E81B2C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1afde21b41040fb5bd7c69a38ad21af4ee7e3aa70dd12a6968dd0e346b7df595
MD5 9c6940c7b73d3fde32c18f7e6b7446fc
SHA1 50943a03dd7be5a94d61b1dbc5a4f149c86928f8
SHA512 6383f52080eafe0111b3df47ce3ed375a2d30bb1cde3842e7fa3d35baa0465518026bfd363b15d2f2c37fc1958037193a109f45c8460c42489483a1d4310c722
TLSH
T12E41186CBAFD1148B3B76F4A9FF6A97E487A79772E06D56D00110D4E0623A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

6a05a8de-219c-4690-bde6-8b7ecd969325.tmp

Path C:\Users\Admin\AppData\Local\Temp\6a05a8de-219c-4690-bde6-8b7ecd969325.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_22gdfdr5.yjg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_22gdfdr5.yjg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e924e7f8-666b-48ae-ba8b-1bdea2eaf93b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e924e7f8-666b-48ae-ba8b-1bdea2eaf93b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 7e9647245f5e7f8f8eb54262025879a73fd59019238aacf89bb0cef8c5f0ac6f
MD5 510b8df104aeb13e7c6fcc0ad10a0026
SHA1 af864f06a24bca36a2976b51016c2022b2c474fc
SHA512 810221831a0aa88f1e5cb04b38da71e1d632a38f253622dba3f755cc684c968e7ea57121fa8780e0104a67e0008c0fbe40606f593ed21322e8414a64cf5f3e86
SSDEEP 12288:WsbWgkBgRb+EHmFBku9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlO:dbhLRqEHmFBku9RmAHhnFaXF7jGvhjZO
TLSH
T1C7C402FAF7607CE3A77E430B9D867EAD1B625122878F90CC447B5BC2455332AAFA5404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4264_1050591932\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f0ae3b0-1c52-49a1-9805-354a24572046.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4264_1373216798\2f0ae3b0-1c52-49a1-9805-354a24572046.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\0007d9757dca\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\0007d9757dca\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\0007d9757dca\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 781d385da174b91f4084a605376180c363a332133eade7cbb6c7a358ae28e0d9
MD5 19d080ea59afe4cc42828bfa7bb78732
SHA1 3631721f28b4bb5b985257a56bf6215eb630b7ad
SHA512 90b40974810cebe152d8c0ea31c284db1ba66c161ed83dc83f9b36c33036d978f1689179cf89c81b0aa49e57feb2bd9a0b408622cbf71fe12333e421d5364cce
TLSH
T16B413EB955448FAFE4FA736CBC284966EEB3417BB67F289210B49480010CF3456F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 8e7ce1233bfd976cab9c3dadaf2b95d8506294c95b4361d673db323421531c1e
MD5 5f54a5c2f089bf2c5fabdc3c95d461e7
SHA1 e9082498c47898470439f5bbfd9ff2ec72400690
SHA512 b0ba99520f30b43b183791b4429878cbd0d8eff504fb03fdb5d761c64a1da2f009b2371f15633289594158d301fdc2f1e0d3ab3fb0db1017396802adaa114011
SSDEEP 96:xHa4qGq7dDzvV6ElU9FnRRHV+NnDBw8h9cniI:sTR7d16EQ90DBw8hzI
TLSH
T1B5A10F785544CB7F75F6776CBCA48C319AB2013B76BF68D610E48484051CF3846E9AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 d5006b5fd7945a54581a82eb97a920aadb3b1906255697b4793c8f3c394fbce6
MD5 52adb4c04f5d6954294ae13fdea725c2
SHA1 3b3ad8b9df99437dc6851f4d36bbe87bdc6e794c
SHA512 df3051c82e0085ee5b85b0d697ce3e0847b918a71e472ace45444a0c304c9499e003c3401a578a3b3cd2e94d94d4e461e2e913f844472f4db59749283428493e
SSDEEP 96:xHa4qGqIdDzvV6ElW9FnRlX+Nn1w8h9cniI:sTRId16EWlQ1w8hzI
TLSH
T1DE911E786544CB6F75F6776CBCA48C31AEB2017BB77F688610A594C4010CF3886E9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 de1ea01a394753d20c1a81c80aca8c73a55b1863c2ddec69f6fa393804a616ff
MD5 8b67a45a3d82bd8597f16de2a9ba3445
SHA1 81db6bbe4f90b81d461f657d8c72f5c7d07619f6
SHA512 f45ab1798554f84d85c545a4ee7c6bd9f74bb6de30bb81fd570ee54220b25d8609e69dcef1a2ec0f608d45c407339f38415a43ad87fe48ba7f639c7d906ee489
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0+ZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWHyh44CfiaR/skL0H7
TLSH
T1EF23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-1953-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-3560-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-1911-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1846-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1904-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1897-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1890-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1883-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1876-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1869-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1862-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1855-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1848-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-1840-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-1837-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-1835-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-1834-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-2077-0x00000000FF370000-0x00000000FF375000-memory.dmp

Download

memory/1124-2090-0x00000000FF390000-0x00000000FF391000-memory.dmp

Download

memory/1124-2092-0x0000000000B30000-0x0000000000B34000-memory.dmp

Download

memory/1124-2091-0x00000000029B0000-0x00000000029B3000-memory.dmp

Download

memory/1124-2886-0x0000000003C00000-0x0000000003C03000-memory.dmp

Download

memory/1124-2891-0x0000000003E00000-0x0000000003F00000-memory.dmp

Download

memory/1124-2887-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2892-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2896-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2928-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2933-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2935-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2975-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-2976-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-3398-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-3399-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-3400-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-3401-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-1925-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1932-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1918-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1939-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1946-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-0-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-4105-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-1960-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1967-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1974-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1981-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1988-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1995-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2002-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2009-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2016-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2023-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2030-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2056-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2063-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2067-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2072-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-2037-0x0000000002820000-0x000000000284D000-memory.dmp

Download

memory/1124-1843-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-1019-0x0000000077A82000-0x0000000077A83000-memory.dmp

Download

memory/1124-22-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-5-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-6-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-5449-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-5450-0x0000000003FA0000-0x0000000004062000-memory.dmp

Download

memory/1124-8-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-3-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-14-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/1124-10-0x00000000FF1E0000-0x00000000FF1E1000-memory.dmp

Download

memory/2344-7756-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/2344-7757-0x000001476B2B0000-0x000001476B472000-memory.dmp

Download

memory/2344-7758-0x0000014769F00000-0x0000014769F50000-memory.dmp

Download

memory/2344-7759-0x0000014769F50000-0x0000014769FC6000-memory.dmp

Download

memory/2864-6002-0x000001E3FFB20000-0x000001E3FFB44000-memory.dmp

Download

memory/2864-5996-0x000001E3FFB20000-0x000001E3FFB4A000-memory.dmp

Download

memory/2864-5819-0x000001E3FF730000-0x000001E3FF752000-memory.dmp

Download