acrstealer | 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.8MB
Sample260927-eelw4ayblf
SHA256 594033ed58e27b42bb1bef7e5b21eac87f0d660c7cc3d48881a2e5575e3ac811
MD5 d3cea61538aa5030e90a1d38cca762b4
SHA1 dd39fafbdba994169991cea092c6428e1d3b1539
SHA512 9672ce4ba4bef67039cbd5274a7e3e6010261d961b5eb2c45df254397b567923d72c40130ec7524cb15fcc6d32b5a50908f870329568c6830fe10916144f9af3
SSDEEP 49152:pJ1O7EpfelenkVglN5suzIEUP7ZmQNRBDXG+Chg9GPcPIvGqgu/2JZfy:pSVqkVglN5ye+m9cPW
TLSH
T1A4857D71279BC43AC57E80B02529FDBF943D5D269F5598C3A3D87D1E29384C21B32B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.3-alpha1

Decoy

googlesyndication.com

Attributes

ddrs
https://telegra.ph/String-Methods-08-01
guids
019fd862-6a3a-7ae0-9126-4c50bf4131ad

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Extracted

Family

acrstealer

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 956 created 3424	956	Setup.exe	81
PID 956 created 3424	956	Setup.exe	81
PID 956 created 3424	956	Setup.exe	81

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
159	5008	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4460	AutoIt3.exe
2848	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\c6012527df7c\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\c6012527df7c\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5008	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
956	Setup.exe
956	Setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 2848	4460	AutoIt3.exe	151

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4256	chrome.exe
4864	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{53547E08-3C86-4159-B059-57C92D4BEDEC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe
956	Setup.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
956	Setup.exe
956	Setup.exe
956	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeShutdownPrivilege	2408	chrome.exe
Token: SeCreatePagefilePrivilege	2408	chrome.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeIncreaseQuotaPrivilege	5008	powershell.exe
Token: SeSecurityPrivilege	5008	powershell.exe
Token: SeTakeOwnershipPrivilege	5008	powershell.exe
Token: SeLoadDriverPrivilege	5008	powershell.exe
Token: SeSystemProfilePrivilege	5008	powershell.exe
Token: SeSystemtimePrivilege	5008	powershell.exe
Token: SeProfSingleProcessPrivilege	5008	powershell.exe
Token: SeIncBasePriorityPrivilege	5008	powershell.exe
Token: SeCreatePagefilePrivilege	5008	powershell.exe
Token: SeBackupPrivilege	5008	powershell.exe
Token: SeRestorePrivilege	5008	powershell.exe
Token: SeShutdownPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeSystemEnvironmentPrivilege	5008	powershell.exe
Token: SeRemoteShutdownPrivilege	5008	powershell.exe
Token: SeUndockPrivilege	5008	powershell.exe
Token: SeManageVolumePrivilege	5008	powershell.exe
Token: 33	5008	powershell.exe
Token: 34	5008	powershell.exe
Token: 35	5008	powershell.exe
Token: 36	5008	powershell.exe
Token: SeIncreaseQuotaPrivilege	5008	powershell.exe
Token: SeSecurityPrivilege	5008	powershell.exe
Token: SeTakeOwnershipPrivilege	5008	powershell.exe
Token: SeLoadDriverPrivilege	5008	powershell.exe
Token: SeSystemProfilePrivilege	5008	powershell.exe
Token: SeSystemtimePrivilege	5008	powershell.exe
Token: SeProfSingleProcessPrivilege	5008	powershell.exe
Token: SeIncBasePriorityPrivilege	5008	powershell.exe
Token: SeCreatePagefilePrivilege	5008	powershell.exe
Token: SeBackupPrivilege	5008	powershell.exe
Token: SeRestorePrivilege	5008	powershell.exe
Token: SeShutdownPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeSystemEnvironmentPrivilege	5008	powershell.exe
Token: SeRemoteShutdownPrivilege	5008	powershell.exe
Token: SeUndockPrivilege	5008	powershell.exe
Token: SeManageVolumePrivilege	5008	powershell.exe
Token: 33	5008	powershell.exe
Token: 34	5008	powershell.exe
Token: 35	5008	powershell.exe
Token: 36	5008	powershell.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
2408	chrome.exe
3044	msedge.exe
2084	firefox.exe
4460	AutoIt3.exe
4460	AutoIt3.exe
4460	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4460	AutoIt3.exe
4460	AutoIt3.exe
4460	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2408	956	Setup.exe	89
PID 2408 wrote to memory of 1432	2408	chrome.exe	90
PID 2408 wrote to memory of 4256	2408	chrome.exe	91
PID 2408 wrote to memory of 4780	2408	chrome.exe	92
PID 2408 wrote to memory of 4780	2408	chrome.exe	92
PID 2408 wrote to memory of 5020	2408	chrome.exe	93
PID 2408 wrote to memory of 5020	2408	chrome.exe	93
PID 2408 wrote to memory of 4704	2408	chrome.exe	95
PID 2408 wrote to memory of 4236	2408	chrome.exe	96
PID 2408 wrote to memory of 4704	2408	chrome.exe	95
PID 2408 wrote to memory of 4236	2408	chrome.exe	96
PID 2408 wrote to memory of 4440	2408	chrome.exe	97
PID 2408 wrote to memory of 4440	2408	chrome.exe	97
PID 2408 wrote to memory of 6036	2408	chrome.exe	98
PID 2408 wrote to memory of 6036	2408	chrome.exe	98
PID 2408 wrote to memory of 5872	2408	chrome.exe	100
PID 2408 wrote to memory of 5840	2408	chrome.exe	101
PID 2408 wrote to memory of 5840	2408	chrome.exe	101
PID 2408 wrote to memory of 4460	2408	chrome.exe	102
PID 2408 wrote to memory of 4460	2408	chrome.exe	102
PID 2408 wrote to memory of 952	2408	chrome.exe	106
PID 2408 wrote to memory of 2460	2408	chrome.exe	107
PID 2408 wrote to memory of 5384	2408	chrome.exe	108
PID 2408 wrote to memory of 952	2408	chrome.exe	106
PID 2408 wrote to memory of 2460	2408	chrome.exe	107
PID 2408 wrote to memory of 5384	2408	chrome.exe	108
PID 2408 wrote to memory of 3284	2408	chrome.exe	109
PID 2408 wrote to memory of 3284	2408	chrome.exe	109
PID 2408 wrote to memory of 6096	2408	chrome.exe	110
PID 2408 wrote to memory of 6096	2408	chrome.exe	110
PID 2408 wrote to memory of 1504	2408	chrome.exe	111
PID 2408 wrote to memory of 1504	2408	chrome.exe	111
PID 2408 wrote to memory of 5524	2408	chrome.exe	118
PID 2408 wrote to memory of 5524	2408	chrome.exe	118
PID 2408 wrote to memory of 4912	2408	chrome.exe	113
PID 2408 wrote to memory of 4912	2408	chrome.exe	113
PID 2408 wrote to memory of 1592	2408	chrome.exe	114
PID 2408 wrote to memory of 1592	2408	chrome.exe	114
PID 2408 wrote to memory of 2280	2408	chrome.exe	115
PID 2408 wrote to memory of 2280	2408	chrome.exe	115
PID 2408 wrote to memory of 5968	2408	chrome.exe	116
PID 2408 wrote to memory of 5968	2408	chrome.exe	116
PID 956 wrote to memory of 3044	956	Setup.exe	117
PID 3044 wrote to memory of 5524	3044	msedge.exe	118
PID 3044 wrote to memory of 1348	3044	msedge.exe	119
PID 3044 wrote to memory of 4864	3044	msedge.exe	120
PID 3044 wrote to memory of 1348	3044	msedge.exe	119
PID 3044 wrote to memory of 1348	3044	msedge.exe	119
PID 3044 wrote to memory of 4308	3044	msedge.exe	121
PID 3044 wrote to memory of 4308	3044	msedge.exe	121
PID 3044 wrote to memory of 2080	3044	msedge.exe	124
PID 3044 wrote to memory of 2740	3044	msedge.exe	123
PID 3044 wrote to memory of 2080	3044	msedge.exe	124
PID 3044 wrote to memory of 2080	3044	msedge.exe	124
PID 3044 wrote to memory of 2740	3044	msedge.exe	123
PID 3044 wrote to memory of 2740	3044	msedge.exe	123
PID 3044 wrote to memory of 5544	3044	msedge.exe	125
PID 3044 wrote to memory of 5320	3044	msedge.exe	126
PID 3044 wrote to memory of 5544	3044	msedge.exe	125
PID 3044 wrote to memory of 5544	3044	msedge.exe	125
PID 3044 wrote to memory of 5320	3044	msedge.exe	126
PID 3044 wrote to memory of 5320	3044	msedge.exe	126
PID 3044 wrote to memory of 4660	3044	msedge.exe	127
PID 3044 wrote to memory of 4660	3044	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe92e4c728,0x7ffe92e4c734,0x7ffe92e4c740
    3⤵
    PID:1432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,5257170651815265891,7100203963376882328,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4330700237259752323,574864673485525176,262144 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,8160917329249035811,517437264433967623,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,15336265671927144474,15575881158728663593,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16500422646570307726,3484319815405256018,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,816643402225012969,16493226844944880126,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,10575071680089109834,3632126394582240143,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4820,i,8369425085552541564,5785684839616845398,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4852,i,7056433913564181508,9550292100565354717,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5420,i,8156818882130755169,14936298182691622957,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5612,i,11361327756293260213,12043134237539877500,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,10173647735456021246,1433376208790232585,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5824,i,370498068098684101,16553634664238006144,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5532,i,16122891838962061494,2956049249086461726,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5412,i,9849482417862391870,15624241108133214949,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4768,i,7577509011285162250,15925813857261436581,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5528,i,9428643871856886656,15609315028536089190,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:5524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,2608260066415661647,1468793249222236581,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:4912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,763955171568179868,13419566468454195906,524288 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5820,i,12550978930782239761,4995861041631869515,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5996,i,8387902665754567781,5092146532346044430,2097152 --field-trial-handle=1912,i,8083230242911699428,14780201583543586709,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:9
    3⤵
    PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2bc,0x7ffe8e42c188,0x7ffe8e42c194,0x7ffe8e42c1a0
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18378387149547768943,13049275725837194158,262144 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,519893546971350857,383978595647248954,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,838692053641706268,2476022287016405716,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,6503732996864545623,5475894991308204911,2097152 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,1808393847838474887,4888606148379815547,2097152 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,9608113277785262707,3450278474431248689,2097152 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10712232107574005103,2277218028958295923,2097152 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15137974018484575071,863100944530909696,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,765896503920988661,8757880710524910836,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,14151593915289353334,2841237588855602601,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6816581160236352968,13793719298953289551,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6816581160236352968,13793719298953289551,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,17161604517685031533,9334062042164544759,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5545266100277167081,3105654299363733105,524288 --field-trial-handle=2684,i,593269158990211782,8636196542162607565,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
    3⤵
    PID:264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:2084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2764 -prefsLen 24445 -prefMapHandle 2768 -prefMapSize 268500 -ipcHandle 2844 -initialChannelId {0194a0b1-2bb9-4a58-80f9-15beb3a95468} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1816 -prefsLen 24658 -prefMapHandle 1988 -prefMapSize 268500 -jsInitHandle 1708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2028 -initialChannelId {c03bc640-a16a-4df1-9313-cab0920b4db9} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3732 -prefsLen 25542 -prefMapHandle 3736 -prefMapSize 268500 -ipcHandle 3764 -initialChannelId {d6eb3b50-129a-40d6-a99e-6455d4157a4c} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3672 -prefsLen 25604 -prefMapHandle 3668 -prefMapSize 268500 -jsInitHandle 3664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3656 -initialChannelId {8b38b660-43d7-46df-865c-572916c8bdb8} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:3452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4848 -prefsLen 36486 -prefMapHandle 4852 -prefMapSize 268500 -ipcHandle 4864 -initialChannelId {cb5b1453-f1c2-48ba-b9d7-f9c82314c1cd} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:3084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5044 -prefsLen 34446 -prefMapHandle 5048 -prefMapSize 268500 -jsInitHandle 5052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4844 -initialChannelId {85759b48-cc88-4359-a3a3-2b15c9ee92fb} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5084 -prefsLen 34446 -prefMapHandle 5088 -prefMapSize 268500 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5100 -initialChannelId {856b9bda-06cc-4cfe-908c-d7ce3e3123e3} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 34446 -prefMapHandle 5060 -prefMapSize 268500 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {8216516b-aae7-4c18-ae10-bbbe90a3b923} -parentPid 2084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5588

C:\Users\Admin\AppData\Roaming\c6012527df7c\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\c6012527df7c\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\c6012527df7c\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4460
- C:\Users\Admin\AppData\Roaming\c6012527df7c\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\c6012527df7c\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Debugger Evasion

T1622

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c79a187dfb536ac7e9fff3e52ad74d06ca905fa85f2a380b89ba9c7d10380e33
MD5 ebea5a70d543b9e3b502ea1552b21132
SHA1 d21142d2a532bf5ab9911bee95efb99480514e6e
SHA512 3e202e97461537b14d038111752bfb2f8d1c805a307a1317d4334160f31c60bf716b8c8093947566b53b002661298cb8b0e616bca538f3f475d1fcb12e1b866c
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok56QiDsB6m8dGyvELkzAwrbuj1v4a:kC0pB+fTbnvDUD6jg4w/gAwrbu1
TLSH
T1B6A12B30E4B88CB758F5C185B5963E43CFB462EBA810AE80C9DE5F0D10A71F82381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 1e0b04f1a1e8508a58c04110ef4695d1fa746f691c836ed07acf4541affe4336
MD5 b8d942f698bf5f13babc6e2783949c09
SHA1 1e7c58ac111cfe1acd029aa85890ff9b97f59e47
SHA512 cae6413aa9639fbbb22d33714e9ed42ce418a948b95d5156ccc1d37d9a79aa774bc220ae99fafc63c3e3000f645bcadaa1c71700e8b0a39eef782fcf0924b157
TLSH
T11AE0D8FB2DB71814FDDFC3D5147250A50441BD65C945ED8F406B7AD315F23152426C66
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1f95ac9a656cc14300d132e1a7ef7be7d6a3b96f17242737b8bcd63364b18349
MD5 ac26931f30c1d5b420b705b23951fbcb
SHA1 8f15ab5e19b63cede0f8c5223d7feb994d7ff353
SHA512 0db4e8f105182e3c30a5ed210d54a1754fbbc1d71d8f3267e2a9124866f520be2710f0deb74454cc9acae31f81b020a753036366cde9062e1cebffca7a7032bc
SSDEEP 48:KiaSS+givlIxA+KyLKW+eYuHXGQfyZsIDKF6cTyFPsr/dhFkVhCPICHkKDBLlk3G:KcjyKo4CasQKF6iKEgK9mNh4bXhrLxz
TLSH
T1DE91CC1572BE420138BF3A4A81B5871F524131B37458E63B7FBD10A68A67E046EFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 df2cb4032667f9780fe9eec0ad166462cbc33a7fb7f83dc08df0a4c07a7aaca5
MD5 e69233b15cff821adee588ce49f0b945
SHA1 9058f406a999668e0facdd512130c51a3411ee12
SHA512 5adb8b150f1fecd9ceacc3673685fe9b70b3bf39c81f64185729e49dce409df53a0b20dad356405011e9e9cbc13f2f910c5465aa1fbc9405eb467e4cf420cb1e
SSDEEP 768:R/UxvxjgC+W3TCovc7fZrKRIp5XSwQs88uBkiTC3/P84g:kZj3+W3uftrtILNBiHg
TLSH
T1CC03C039EC946873ACF39385365A275BAFF06053C4C41BA849EE7A1E038B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 562KB
SHA256 7e9647245f5e7f8f8eb54262025879a73fd59019238aacf89bb0cef8c5f0ac6f
MD5 510b8df104aeb13e7c6fcc0ad10a0026
SHA1 af864f06a24bca36a2976b51016c2022b2c474fc
SHA512 810221831a0aa88f1e5cb04b38da71e1d632a38f253622dba3f755cc684c968e7ea57121fa8780e0104a67e0008c0fbe40606f593ed21322e8414a64cf5f3e86
SSDEEP 12288:WsbWgkBgRb+EHmFBku9RmAAAh11X0aVl5Ud9Yk6uwcLy2e6PaW4nebUlO:dbhLRqEHmFBku9RmAHhnFaXF7jGvhjZO
TLSH
T1C7C402FAF7607CE3A77E430B9D867EAD1B625122878F90CC447B5BC2455332AAFA5404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2408_465729729\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3044_115774807\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\c6012527df7c\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\c6012527df7c\Fabrics.a3x
Size 1.2MB
SHA256 11630873f322c788d5b8cbde26e9214bced21f5a3b317a2529f02e7c8d756ddc
MD5 a949348dd547855fdb650e004fe0f5e1
SHA1 fe8fb752581ffea530e67db2b638491e38f59343
SHA512 5847f8f10f4c616a1c1fb0afba759bbb5efb2c2c7fe0b9405477f14c0622288f7138e1e3e8edc78b7b1b8065950a98d960980407b58432ec551294e056864b38
SSDEEP 24576:WPooWlCLnjQp5xFBenWyxBmGQJ2fAC4YpcUe0/GmcYGPgj9W66Ik:DlC7UBfeTxwGQJgABdR/VaR6r
TLSH
T140453381BDA4C11C2D7C630B199F7B237E6DDB06A68A850CBC65237F18D3168B6C7927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\c6012527df7c\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 9bc159f315ed2b28ecf88562b63e7db95e12b3aca64f37da1018bf8729fefa4f
MD5 90d19f8498d8800776de82d8b3b2ee34
SHA1 66719c8a7b684874249c0195595b014a27fb58b9
SHA512 e1b7d5ea14e6521fe8d10ba1078f08cb82f47087825e0a2e18eb486682bb952ff20b15999ca59d4ab62ad54c81e2271e4b6244cddba650014213658197e51878
SSDEEP 384:HalwSiO024YdWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAhL+qS+Q:6l8ZYdWTToXJWTTogB7S/AmVAf+hRMIS
TLSH
T174728D7D8F413CEC275790E8C8B943558D1CB6A7DFF5C06D22983E09CA84A5A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c688e299852d3cd5faa6e82e89d25ce4b9700292d9ecf075913a7ccfcdc2787c
MD5 577916dea8beda4b570b4a68fe75fe30
SHA1 c97887c46eb0414dc392df9167d9a774db7d8831
SHA512 ca031a29678dc7a30b1bde43135301fd3050eaf576fa20b0343f630f8bb10a3beff79b41bbabdcfc52dfc538a4e6a0c4c8aaab0071c83d1f94c325f215d880d9
TLSH
T174514719EB2D8A3FD418813AEC5657009F747458E46E2F1A35ACA14E2D4B3DE3ACD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6c8662e1fcedfd39cdef21a98953e57c15f3b984e323ce2597ed30e2e5cda515
MD5 c5374b31276d1ba0381a42e8f088d5e0
SHA1 6ec3177a7b367c9b92ee5bb8b4df4e0229909caf
SHA512 dbf11c2b570e284fbb1c8ca7539ab85b1f646005279dde5c8be0c24438532aae79a1454a4950d2a970b5fe1a379a996c777edf39db3954c439cc6eec4777d5cd
TLSH
T1BD514819EB2D8A3FD418813AEC5667409F747458E46E2F1A259CA14E2D4B3DE3ACD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 45d599d09e29a47cbd367ec9ea7976ec54dba9831560d90349da993f862f0884
MD5 e64501f54edd2dc1f796255b5413eb29
SHA1 d7541228116ffba9490037078b3b1fe25292d9a4
SHA512 93581378fbb386e685fe42bcbecce1b0b8eae9c3d39b8055784d6648a648abf9fffb5eb730b1682c4b5772a3d85582ab0cc4bb811ebe89ce6e64d9c2d76477bd
TLSH
T1A7617558E629863FD445413ECDA64B004F747599E86E2F2A31AC644E2E4B3DD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 f1d9f3acb814c11e3155e348af798e6f4631269ec73aa56d3d3c3b8ba0d39556
MD5 eded5c875cc51e59dcd5c8b0d53b5859
SHA1 8ba76ed7fbb4d77d22b35b1604d0597ea5cf9b5d
SHA512 b7fcc2a25d97aa99df980b4bd3eb2a6e826d0fa351e806387a1b04979c5efdd451962129554e287ed57b204edb24b97b640585aa1fb1066ddc520ac7f870eecb
SSDEEP 96:m0Fw4tFw4eJ/dd66JoztdzgClKtmBM2/PSdF95/7bkW6ArQxxx16bxeztdzgClKx:mbfF1d66JoztdzgCl6mBM2HOv5zbo8iA
TLSH
T184B18B28E2298A3FC445423ECDA54B041E793989E85E2F2E35DC745E3D572DD368D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 eb2b0722ee11bde73b7b66c9bc892042c088ee3b1f17c1b55a6529f4dd8b89eb
MD5 ad19f392f69982982678122a67274bcd
SHA1 fc13be486e1f5728ec895a101876077591dfbb88
SHA512 f9ec7280e70969e4d82fac775007f622f524d27c250836b35627adbe7e40e5db96db9d9e88771b31dda5b6def292a00b225a66a101ef3843cfee288d0351e7d1
SSDEEP 96:BSdF95/7bkW6ArlyUR6Wx1Wb0Fw4tFw4eJ/dd66JoztdzgClKtmBM2/u:BOv5zbo8lyjAcbbfF1d66JoztdzgCl6T
TLSH
T143B1FC64F628863FC444537ACDA11B044E3A399AE84D3F2A35EC74593D5B2DE368D0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 193b590f8e6c6d74573a340cfe51356473f057deea63fff5720a43214f89160e
MD5 100b6f70d854f044daf75c8967f1ab79
SHA1 c338a64cc40eace8999aed92b4492256ce8bef19
SHA512 2a4a25ecbb0c842d36be145005bd1a161137584c0a7e8e9b8f1acd9c184764a6d3a3986e5de028f0c743606a04125acb80fc365a172908c88340b6ec98cc5486
SSDEEP 192:mbfF1d66JoztdzgCl6mBM2mOv5zbo8WMyjAcLc:6fDd66Joz/zgC1OMbo8WMyj
TLSH
T12BD11E64EA28873FC444637BCDA12B044F3A395ADC4D3F1A35ED6518295B2DE368E1BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e8f571d2b406571d96ef4bad98f7070541eb3ffef99a60988a20fe7f415fc914
MD5 a96b41cef24f6de941a765436ac35d82
SHA1 a827a43290b925a9498f8fa48656b94c69b3ebaf
SHA512 9200ffc8b9a856faf90f23d4f35fd90f5903653e3e9d8d8b7ceae5720a1dc6c73eb9339be1165f42b3fb720c95aa6c37fb1033070092ea6fbf6b11e3fc0c9bf9
SSDEEP 192:rbfF1d66JoztdzgCl6mBM2yOv5zbo8WseyjPc:ffDd66Joz/zgC1Ogbo8Wseyj
TLSH
T18AD12C64E638863BC444537BCCA60B054F3A394AD84D3F19319D66592D4B2EE368E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b6ebdb8f7e1b28980b4971ced7ffeb7b0964bd883b16cd04a8fb57b3b6c11b7f
MD5 71f6dfe1184eb488d6d351b87ae48a67
SHA1 31d7975bfd8fbae9e02b9c14e6cc7e084da710b8
SHA512 bdb87e1671830ee7decbba1f9df85cb520f6b417270b52e43217bb9312ef440d81261bd4f503e539fa620effbd81ea0f57af2f666baf9516e3c2898f650a7f51
SSDEEP 192:VbigF1d66JoztdzgCl6mBM2XOv5zbo8WseyjPc:JigDd66Joz/zgC1OZbo8Wseyj
TLSH
T114D12B64EA38863BC404537BCCAA0B054E36395ADC4D3F19319D25592D4B6DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cb5676c943691701a4ed048bb243b66391255d08b11c6c43c3de64f6e80faa7e
MD5 c9f2acad9b9878e19bbed0e9e37a85ba
SHA1 6d9ebe1f52409f53211d9825193b2cee9f1ffd9e
SHA512 e3246310f3b1cad8664d3172b3e3ccb0882fc71b7af3b3e76655b5c43035b89dbf584b8ad77ade31083d3a1f2a03b1bb025cdef75a3d815c38664ebe2a21218e
SSDEEP 192:VbigF1d66JoztdzgCl6mBM2oOv5zbo8WseyjPcD:JigDd66Joz/zgC1Ogbo8WseyjA
TLSH
T1EAD13C64EB38863BC404537FCCAA0B054E35395ADC4D3F19319D25592D4B6DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d0c3d6333231c5be60156b3e108d10f90ce7076b9466d7362841970fcdbf47e7
MD5 cc01d3ebf07219f873e1864ee29421cb
SHA1 5819d9e0ba194c1eafa3c1723a67d540294f1446
SHA512 d595e1f25103a0f4e8b7aad3a6bdc21b8e491f3c064b857fabfe226ca37a4c46c903c83756f401a8cb43b5abeacdb250392f3f13332ce8548411d71c5e46f848
SSDEEP 192:+Ov5zbo8WseyjPcTbi7F1d66JoztdzgCl6mBM2z:Vbo8Wseyj2i7Dd66Joz/zgC1OG
TLSH
T1F9D13B60EB38863BC404537BCCAA0B054E36395ADC4D3F19319D25592D4B6DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0e04d8a906fcd744d9c58be2ebb1a3784cdda0d92999eb3623a0065aaceaee84
MD5 ce38ab42a82b665a66db3598e06bd04e
SHA1 3dc9f3e855df435c29d1909d431f48d56ba5e188
SHA512 0b8ecf2ce5ad4354ea9bceed1aa3208b1f15e76fd17436821d4c3df0627b0f6272fd327dbc127373c3b2324dcb670b1fa4209c5a36f20d2985098f840855b244
SSDEEP 192:Vbi7F1d66JoztdzgCl6mBM2mOv5zbonMsseyjPcD:Ji7Dd66Joz/zgC1O6bonMsseyjA
TLSH
T1A5D12C64E638863BC404137BCCA60B454F39399ADC4E3F29319D255D2D476DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98261b34-7567-494c-b553-a9bdab136ac8

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\98261b34-7567-494c-b553-a9bdab136ac8
Size 796B
SHA256 579b2848ff1a66c802eeba6216b31536d0cde18776db14bb8ddadbc095d54c5e
MD5 5fd659b45a78c8e81d1ed4b5a0536e47
SHA1 8768cfae1329503826b140d3a0bc4a451e783d43
SHA512 e95716f25c9c7f129fdcf24d6015896849a208accf67a0b1ad20fae0b11e2a5a82e456494027cb95c5633f10c0e1934d94c1714305ba47cc996ceb843d3cb446
TLSH
T198014140977471B38C38E34F889A3B868BE47013C4C654183E91AB084D6A50F37A6B0F
MD5 SHA1 SHA512 TLSH

Submit Download

9c933d1a-b507-4851-98e8-1e5785767ebe

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\9c933d1a-b507-4851-98e8-1e5785767ebe
Size 235B
SHA256 8b1cf60706c68ca74a548d7775e7ee80ee8a6244203fe2de009bb3bfcddbb8ca
MD5 04ee2ddd8d5f4f568535d076344db0ec
SHA1 192e4e480373386ebdf7e979c3d22d11b0bfe6c0
SHA512 e93412002b28c93597f518516f3ba6b453e68d17d93c9b3b8c72d25f4e97b25f9acc9993408edacdd6eb5b2564f1f7d97b5aefc1a731eba38e26efad0941b324
TLSH
T1DAD097C0AC88277C48040F07F0E268C270888C331874A830899104748ABDDC803A1867
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 714B
SHA256 413953f686723f8da4d183ec6a2ce4c4ef91fea25ffa1d4466a883c8fbe694fb
MD5 123a81b6ec01244e4370f971684b88a5
SHA1 0c224c4f6cbd1e6959d397e85024837f312af433
SHA512 4b09733ddc6d87fd2fca419e6e80ea6d7daa656a95c001d617f2f77a26b0afd287db459bfa701b2535a88586667ba3ffddedd42f2433d2021a87978d11fb362c
TLSH
T19D01CBE91E454FBFA1F531A8DC4843E2E272053AB9BF68402AB8C0890214F7801F79E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 d077360e6e6fd1b305ef9d8ff7a47297aa4e2d8c942edb69e0cf5874a5c19659
MD5 841568cb26f2b28cf4d9c115834aeffc
SHA1 c30444568783187b04c94a569928ddfc1b9cbe47
SHA512 edbdbe4f29d6fdbbc5761b8e9e0a6cecb3ca2f8dcfe2a12967f47fa9836d41555ff196ee4636ce8e4c619cad718abbcc9786a2b761067311e4df7861b75b29d0
SSDEEP 96:xHaEqGqwpdkzv76ElU9hnh4gRHfk3IBw8hGcns:s3RkdU6Em4g9fk3IBw8hi
TLSH
T157B111785544CB7F75BA776CAC648C71AAB2013B77BF28C650E584C40108F3895F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 c70ce2a84483559aafa8d7d9f3ed35c88ce89df89b861eb3991ab343356893c6
MD5 d2767579510cab0ff32e9382409663dc
SHA1 90d4b1797dbf14e972d7fb0b5ec3c705fa5eb0b3
SHA512 ead97a68571e5186f0a320a4c755b58512575e95fca5a4dda0827bd32e996dcb1852ed6582d932bf9cddde937026d498c928e9c8137614369a613afdd88af8fd
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0bZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWayh44CfiaR/skL0H7
TLSH
T10423448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-1995-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2067-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1900-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2135-0x00000000FF120000-0x00000000FF125000-memory.dmp

Download

memory/956-2148-0x00000000FF140000-0x00000000FF141000-memory.dmp

Download

memory/956-2149-0x0000000000D90000-0x0000000000D93000-memory.dmp

Download

memory/956-2150-0x00000000005B0000-0x00000000005B4000-memory.dmp

Download

memory/956-2907-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2911-0x0000000003EF0000-0x0000000003FF0000-memory.dmp

Download

memory/956-2906-0x0000000003CE0000-0x0000000003CE3000-memory.dmp

Download

memory/956-2912-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2917-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2949-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2953-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2955-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2995-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2996-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3419-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3418-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3420-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3421-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3480-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-1891-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-1897-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-1902-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-1909-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1916-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1923-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1952-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1959-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1940-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1945-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1982-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1988-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-0-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-4407-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-2009-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2017-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2024-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2039-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2046-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2053-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2060-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1930-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2074-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2089-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2096-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2118-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2122-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2130-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2107-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2081-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2031-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-2002-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1973-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1966-0x0000000000D40000-0x0000000000D6D000-memory.dmp

Download

memory/956-1894-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-1889-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-1888-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-919-0x0000000077A08000-0x0000000077A09000-memory.dmp

Download

memory/956-22-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-14-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-8-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-10-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-5567-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-5566-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-5570-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-5572-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-5575-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-5573-0x00000000040A0000-0x0000000004162000-memory.dmp

Download

memory/956-3-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-6-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/956-5-0x00000000FEF80000-0x00000000FEF81000-memory.dmp

Download

memory/5008-6017-0x000001D2AB200000-0x000001D2AB20A000-memory.dmp

Download

memory/5008-6079-0x000001D2AB750000-0x000001D2AB76E000-memory.dmp

Download

memory/5008-6195-0x000001D2AB210000-0x000001D2AB21A000-memory.dmp

Download

memory/5008-6225-0x000001D2AB790000-0x000001D2AB7AC000-memory.dmp

Download

memory/5008-6288-0x000001D2AB220000-0x000001D2AB228000-memory.dmp

Download

memory/5008-6295-0x000001D2AB770000-0x000001D2AB776000-memory.dmp

Download

memory/5008-6300-0x000001D2AB780000-0x000001D2AB78A000-memory.dmp

Download

memory/5008-6380-0x000001D2AB750000-0x000001D2AB77A000-memory.dmp

Download

memory/5008-6383-0x000001D2AB750000-0x000001D2AB774000-memory.dmp

Download

memory/5008-6005-0x000001D2AB440000-0x000001D2AB4F2000-memory.dmp

Download

memory/5008-6002-0x000001D2AB1E0000-0x000001D2AB1FE000-memory.dmp

Download

memory/5008-5931-0x000001D293000000-0x000001D293022000-memory.dmp

Download