acrstealer | 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample261015-1s2qcsszbw
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer hijackloader sectoprat loader persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\nthub_net35_win32
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

acrstealer

Version

4.4.7-alpha1

imap.dropstream.cc

Decoy

edgesuite.net

Attributes

ddrs
logs.fetchwave.cc
guids
4d0bf37a-3180-4974-a873-a6ec4d4dc9f9

01a10d60-3b38-753b-9223-e8749716a1c5
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024885-469.dat	family_hijackloader
behavioral1/files/0x0007000000024c62-1625.dat	family_hijackloader

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral1/memory/34784-1680-0x000001C518960000-0x000001C5189CC000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5028 created 3280	5028	TurboV.exe	56
PID 5028 created 3280	5028	TurboV.exe	56
PID 5028 created 3280	5028	TurboV.exe	56

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4344	8QnS9Smpt.exe
1396	ClMeta.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2448	forfiles.exe

Loads dropped DLL 13 IoCs

pid	Process
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
5028	TurboV.exe
1396	ClMeta.exe
1396	ClMeta.exe
1396	ClMeta.exe
1396	ClMeta.exe
1396	ClMeta.exe
1396	ClMeta.exe
1396	ClMeta.exe
34784	GrSimulator.exe
34712	XPFix.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4344 set thread context of 5028	4344	8QnS9Smpt.exe	110
PID 1396 set thread context of 34784	1396	ClMeta.exe	161
PID 1396 set thread context of 34712	1396	ClMeta.exe	162

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a131c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Tasks\devbridge.job	XPFix.exe
File opened for modification	C:\Windows\Installer\e5a131c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1AD703D2-09E7-4EEA-A184-FF8A55E65560}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B3A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a1320.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3308	cmd.exe
4848	cmd.exe
1396	cmd.exe
34952	cmd.exe
34852	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TurboV.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TurboV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	chrome.exe
4592	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{007879AF-9ACD-4CA4-9F56-9178994FA2B3}	msedge.exe

NTFS ADS 31 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\frame_io.toml:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\OUTLOOK.EXE.MANIFEST:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msaccess.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\excel.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\msvcp_win.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\OUTLOOK.EXE.MANIFEST\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\excelcnv.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\mspub.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcp100.84w:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\ucrtbase.ow:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\msvcp100.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\msvcr100.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcr100.ly:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\surfacemod.ini\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\powerpnt.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\Graph.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\Graph.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\OART.DLL\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\powerpnt.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcp_win.8d5:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\surfacemod.ini:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\mspub.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\LYNC.EXE.MANIFEST:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\LYNC.EXE.MANIFEST\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\msaccess.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\excel.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\OART.sf9:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\excelcnv.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\frame_io.toml\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\ucrtbase.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4344	8QnS9Smpt.exe
4344	8QnS9Smpt.exe
5028	TurboV.exe
5028	TurboV.exe
5028	TurboV.exe
1396	ClMeta.exe
1396	ClMeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	4416	chrome.exe
Token: SeCreatePagefilePrivilege	4416	chrome.exe
Token: SeShutdownPrivilege	68364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	68364	msiexec.exe
Token: SeShutdownPrivilege	35756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	35756	msiexec.exe
Token: SeSecurityPrivilege	35716	msiexec.exe
Token: SeCreateTokenPrivilege	68364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	68364	msiexec.exe
Token: SeLockMemoryPrivilege	68364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	68364	msiexec.exe
Token: SeMachineAccountPrivilege	68364	msiexec.exe
Token: SeTcbPrivilege	68364	msiexec.exe
Token: SeSecurityPrivilege	68364	msiexec.exe
Token: SeTakeOwnershipPrivilege	68364	msiexec.exe
Token: SeLoadDriverPrivilege	68364	msiexec.exe
Token: SeSystemProfilePrivilege	68364	msiexec.exe
Token: SeSystemtimePrivilege	68364	msiexec.exe
Token: SeProfSingleProcessPrivilege	68364	msiexec.exe
Token: SeIncBasePriorityPrivilege	68364	msiexec.exe
Token: SeCreatePagefilePrivilege	68364	msiexec.exe
Token: SeCreatePermanentPrivilege	68364	msiexec.exe
Token: SeBackupPrivilege	68364	msiexec.exe
Token: SeRestorePrivilege	68364	msiexec.exe
Token: SeShutdownPrivilege	68364	msiexec.exe
Token: SeDebugPrivilege	68364	msiexec.exe
Token: SeAuditPrivilege	68364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	68364	msiexec.exe
Token: SeChangeNotifyPrivilege	68364	msiexec.exe
Token: SeRemoteShutdownPrivilege	68364	msiexec.exe
Token: SeUndockPrivilege	68364	msiexec.exe
Token: SeSyncAgentPrivilege	68364	msiexec.exe
Token: SeEnableDelegationPrivilege	68364	msiexec.exe
Token: SeManageVolumePrivilege	68364	msiexec.exe
Token: SeImpersonatePrivilege	68364	msiexec.exe
Token: SeCreateGlobalPrivilege	68364	msiexec.exe
Token: SeRestorePrivilege	35716	msiexec.exe
Token: SeTakeOwnershipPrivilege	35716	msiexec.exe
Token: SeRestorePrivilege	35716	msiexec.exe
Token: SeTakeOwnershipPrivilege	35716	msiexec.exe
Token: SeCreateTokenPrivilege	35756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	35756	msiexec.exe
Token: SeLockMemoryPrivilege	35756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	35756	msiexec.exe
Token: SeMachineAccountPrivilege	35756	msiexec.exe
Token: SeTcbPrivilege	35756	msiexec.exe
Token: SeSecurityPrivilege	35756	msiexec.exe
Token: SeTakeOwnershipPrivilege	35756	msiexec.exe
Token: SeLoadDriverPrivilege	35756	msiexec.exe
Token: SeSystemProfilePrivilege	35756	msiexec.exe
Token: SeSystemtimePrivilege	35756	msiexec.exe
Token: SeProfSingleProcessPrivilege	35756	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4488	msedge.exe
4488	msedge.exe
2056	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4392	Setup.exe
4392	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3308	4392	Setup.exe	93
PID 4392 wrote to memory of 4848	4392	Setup.exe	95
PID 4392 wrote to memory of 1396	4392	Setup.exe	97
PID 4392 wrote to memory of 2448	4392	Setup.exe	104
PID 2448 wrote to memory of 4152	2448	forfiles.exe	105
PID 4152 wrote to memory of 4344	4152	cmd.exe	107
PID 4344 wrote to memory of 5028	4344	8QnS9Smpt.exe	110
PID 4344 wrote to memory of 5028	4344	8QnS9Smpt.exe	110
PID 5028 wrote to memory of 4416	5028	TurboV.exe	112
PID 4416 wrote to memory of 2904	4416	chrome.exe	113
PID 4416 wrote to memory of 2424	4416	chrome.exe	114
PID 4416 wrote to memory of 2424	4416	chrome.exe	114
PID 4416 wrote to memory of 3212	4416	chrome.exe	115
PID 4416 wrote to memory of 3760	4416	chrome.exe	116
PID 4416 wrote to memory of 3760	4416	chrome.exe	116
PID 4416 wrote to memory of 3240	4416	chrome.exe	117
PID 4416 wrote to memory of 4452	4416	chrome.exe	118
PID 4416 wrote to memory of 3240	4416	chrome.exe	117
PID 4416 wrote to memory of 4452	4416	chrome.exe	118
PID 4416 wrote to memory of 3572	4416	chrome.exe	120
PID 5028 wrote to memory of 4488	5028	TurboV.exe	122
PID 4488 wrote to memory of 2108	4488	msedge.exe	123
PID 4488 wrote to memory of 4592	4488	msedge.exe	124
PID 4488 wrote to memory of 4260	4488	msedge.exe	125
PID 4488 wrote to memory of 4260	4488	msedge.exe	125
PID 4488 wrote to memory of 4260	4488	msedge.exe	125
PID 4488 wrote to memory of 988	4488	msedge.exe	127
PID 4488 wrote to memory of 988	4488	msedge.exe	127
PID 4488 wrote to memory of 2616	4488	msedge.exe	128
PID 4488 wrote to memory of 2616	4488	msedge.exe	128
PID 4488 wrote to memory of 2616	4488	msedge.exe	128
PID 4488 wrote to memory of 2852	4488	msedge.exe	129
PID 4488 wrote to memory of 2852	4488	msedge.exe	129
PID 4488 wrote to memory of 2852	4488	msedge.exe	129
PID 4488 wrote to memory of 1524	4488	msedge.exe	130
PID 4488 wrote to memory of 3360	4488	msedge.exe	131
PID 4488 wrote to memory of 1524	4488	msedge.exe	130
PID 4488 wrote to memory of 1524	4488	msedge.exe	130
PID 4488 wrote to memory of 3360	4488	msedge.exe	131
PID 4488 wrote to memory of 3360	4488	msedge.exe	131
PID 4488 wrote to memory of 1756	4488	msedge.exe	133
PID 4488 wrote to memory of 1756	4488	msedge.exe	133
PID 4488 wrote to memory of 4872	4488	msedge.exe	136
PID 4488 wrote to memory of 4872	4488	msedge.exe	136
PID 4488 wrote to memory of 3944	4488	msedge.exe	135
PID 4488 wrote to memory of 4872	4488	msedge.exe	136
PID 4488 wrote to memory of 3944	4488	msedge.exe	135
PID 4488 wrote to memory of 4872	4488	msedge.exe	136
PID 4488 wrote to memory of 1356	4488	msedge.exe	138
PID 4488 wrote to memory of 1728	4488	msedge.exe	139
PID 4488 wrote to memory of 1728	4488	msedge.exe	139
PID 4488 wrote to memory of 2368	4488	msedge.exe	140
PID 4488 wrote to memory of 2368	4488	msedge.exe	140
PID 4488 wrote to memory of 3972	4488	msedge.exe	141
PID 4488 wrote to memory of 3408	4488	msedge.exe	142
PID 4488 wrote to memory of 3972	4488	msedge.exe	141
PID 4488 wrote to memory of 3408	4488	msedge.exe	142
PID 4488 wrote to memory of 3528	4488	msedge.exe	143
PID 4488 wrote to memory of 3528	4488	msedge.exe	143
PID 4232 wrote to memory of 2056	4232	firefox.exe	146
PID 4232 wrote to memory of 2056	4232	firefox.exe	146
PID 2056 wrote to memory of 900	2056	firefox.exe	147
PID 2056 wrote to memory of 900	2056	firefox.exe	147
PID 2056 wrote to memory of 900	2056	firefox.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1396
- - C:\Windows\SYSTEM32\forfiles.exe
    forfiles.exe /p C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l /m 8QnS9Smpt.exe /c "cmd /c call @path"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SYSTEM32\cmd.exe
      /c call "C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe
        
        "C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4344
      - C:\Users\Admin\AppData\Local\TurboV.exe
        
        C:\Users\Admin\AppData\Local\TurboV.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\ClMeta.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\ClMeta.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1396
        
        C:\Users\Admin\GrSimulator.exe
        
        C:\Users\Admin\GrSimulator.exe
        8⤵
        Loads dropped DLL
        
        PID:34784
        
        C:\Users\Admin\AppData\Roaming\com_srv_adapter\XPFix.exe
        
        "C:\Users\Admin\AppData\Roaming\com_srv_adapter\XPFix.exe" "C:\Users\Admin\AppData\Roaming\com_srv_adapter\XPFix.exe" /u
        8⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:34712
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\u3k0kcL0EODH2RZr\u3k0kcRrGKfgOnmn.msi" /qn /norestart
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:68364
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\u3k0kcPt1yEZMwA2\u3k0kc55AL2DtMw4.msi" /qn /norestart
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:35756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff865b0c728,0x7ff865b0c734,0x7ff865b0c740
    3⤵
    PID:2904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,5479008457482353472,13595903447447464328,262144 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,15143591810552119867,4403201288536319584,524288 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,17092807262708950343,17879256705956228359,524288 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2564 /prefetch:8
    3⤵
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,12637833157832374140,11356305518335530469,2097152 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,7741994049133752408,2311865615995655994,2097152 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,197299042289165128,18386374303126100254,524288 --field-trial-handle=2004,i,18418036815094433023,6595473409807960371,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff85fd2c188,0x7ff85fd2c194,0x7ff85fd2c1a0
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,10480745596592008929,12295030935229574867,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,10750821986840626428,14935071276389024537,262144 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,1050259938447650189,8189906265462973943,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3361943094898824587,11997490577786649072,2097152 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9599815811535588186,767956374339266491,2097152 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,11940874449516430005,2886426222604810383,2097152 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,10665189483681401670,3163670827304379966,2097152 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,10153098166017671895,6789955941480393877,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,17134537969757715329,15126965911874641260,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,3802849406193099147,7756284959407046696,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,15318049339472456891,17829290634198400011,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12027535432921016999,16832845239639548269,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12027535432921016999,16832845239639548269,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9869176143010988393,15707326461406311572,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,6548665712640691331,15886063466192887434,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,15485897509312480595,12625701965410297179,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,7195449237795471732,4913601598151784097,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,608023976607589462,10946611000230214794,524288 --field-trial-handle=2260,i,10134376433878871640,16303632482147066250,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:3528
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2752 -prefsLen 24447 -prefMapHandle 2756 -prefMapSize 268500 -ipcHandle 2820 -initialChannelId {9f6a121f-216d-4c2c-83ae-d38620914f70} -parentPid 2056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1620 -prefsLen 24658 -prefMapHandle 1864 -prefMapSize 268500 -jsInitHandle 1868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1880 -initialChannelId {bf46f120-ec22-44b9-9662-6da3c15089cd} -parentPid 2056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1972
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1712 -prefsLen 25544 -prefMapHandle 1616 -prefMapSize 268500 -ipcHandle 3624 -initialChannelId {78ae4874-dc43-47c5-bb72-f773dc4a6926} -parentPid 2056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4280 -prefsLen 25606 -prefMapHandle 4284 -prefMapSize 268500 -jsInitHandle 4288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4296 -initialChannelId {14a65b5e-5cd0-49ec-84e5-2f3a1871e853} -parentPid 2056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:35716
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c "start "" "C:\Users\Admin\AppData\Local\C-Media\USB Audio Controller\HashidsNet.lnk""
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  PID:34952
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "build.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:34852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Indirect Command Execution

T1202

Process Injection

T1055

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a131f.rbs

Path C:\Config.Msi\e5a131f.rbs
Size 13KB
SHA256 ca27b90a10df84d63878b476ac23a75473cae3f05a00ed46ecc3081a3a17315e
MD5 96838fd86de54b0fbafdfc43eedadd6b
SHA1 e9d2f1488a4bc56561e3d962946132b864ea508f
SHA512 6b14800a25b950cec1d2466fb7427a0e974b071ab0e6baaad814791cf5c0cd8bff7a98d28ebd5a23fff5cbf52f4a554c2e53647b22329cc084bb94f74be6042b
SSDEEP 384:2jNOtWSoLk6Pl4D1rPyBcCPDxyFFHzoqBoqJL2y:2jNOtWSoLk6Pl4D1rPyBcCPDxyFFTo6R
TLSH
T1FA527415B890C3F3D498067AF7D31B1C7776E2ECAF1C33463699A0345A62768EE99482
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

HashidsNet.lnk

Path C:\Users\Admin\AppData\Local\C-Media\USB Audio Controller\HashidsNet.lnk
Size 974B
SHA256 cbc4f76d9c9b695c110e606ac7870836315083093bceacc46ad0df52b4cdbf17
MD5 79cfa2d8fe38031ed21f7aaa6500ada9
SHA1 e38c9f52542ee224a62a922eaed419c624f8a95c
SHA512 a28a31606c46750142cbc586c282f5ee89c799e8750271fbf4233d09d82f3e3bfa979c2a4d8de73b44efe3dc062601a633e7db55d21409a1dda5f68c7168b312
TLSH
T146118C1052DD0708CB301D7BBC7CC20868B5F450BF0792CA8E94D0AD38E1990F823A13
MD5 SHA1 SHA512 TLSH

Submit Download

ebef9263-b04b-4a60-92fd-6825440c8b77.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ebef9263-b04b-4a60-92fd-6825440c8b77.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ee2ad604-5a5f-4b1f-896c-b2f62fa416fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ee2ad604-5a5f-4b1f-896c-b2f62fa416fc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ba2fd4a2-43d8-48b4-802b-64f277bf2a2b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ba2fd4a2-43d8-48b4-802b-64f277bf2a2b.tmp
Size 130KB
SHA256 583bc48de9e6822d3a70a24a108c87c9971ca278f72ff74643b5e09bdea999bf
MD5 7097efea449643ce78e486d08c8ebd55
SHA1 a04c90ab35b55af094563a7ff9500d041b342cbe
SHA512 ba246931c3447629d1b33195f2d8bc992727c28cb31476fb3fd081ccef638ee0534eaed8ac412ec08bfbe659c203b5f4a496ffd5afbefbdf68d66a0452af1cf8
SSDEEP 3072:xGf+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:sf+hFD+7t56OD9ZfSApprE
TLSH
T1F8D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b2bc0b9-2dad-4e14-8a03-931982dce04a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b2bc0b9-2dad-4e14-8a03-931982dce04a.tmp
Size 8KB
SHA256 4267349ee3285e515a55f8439ccd0de60e35a5fc317fd74d7cce36ed8796a002
MD5 f0e5ea4e848ddf073f51b4b9047a2ae8
SHA1 e6f4468ee9371b760055c30c31df7e771a9048fa
SHA512 6d90266ca0bd64ecb7b7ab85fdc61aa606b5bad85413e20f82f103d98fa1a14b0e558993a246c1c0e4707fd3441f6d2480c0f2086c974e10e9a1e48abe2d1864
SSDEEP 192:LONt6JU5QmiUyH6jzo//jjzorB6ywxW5XQ7NxK8qLFU6:LONt6+XSazo//z8ExUXQXQU6
TLSH
T15E120934B879EC675EE7A845F08733639EA4107BEE855F44D6E85F2C01CB25C2B4AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e4b20ef-bb7c-40e1-b032-a9942d5bd3a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e4b20ef-bb7c-40e1-b032-a9942d5bd3a7.tmp
Size 8KB
SHA256 a2cee9aa24ae3f9895e66f8e3b5c5367eb402380facbfedd3cde7807d477283b
MD5 992241350ac0ee8d1cb2ca5543afd6e4
SHA1 441e47e6af583310c5367d31ed55e119c55469ed
SHA512 2b44a7f006d5c92632f744cb3c7a291ca8c576399d0930b5df660e90a7f658d0b3dc11ff0a35662ec5ef99d48ccf637ea448b1edb12d82f3bc57d662ceb63132
SSDEEP 192:BONN6JUm0QmiUysjso//jjzorB6ywxWjBCxaU6:BONN6+mEfso//z8ExHAU6
TLSH
T13402C738B828BC7B9EF3AE45B48737139FA4107BA6951F40DAE81E2D01D725C1346D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

41fbc881-3761-404b-b679-542cd2e1d0aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41fbc881-3761-404b-b679-542cd2e1d0aa.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 70KB
SHA256 94883ad5326c0f89665b98c03d81ea166cacbca091953da02a95b40544de9099
MD5 c69e3ddce133f6383e995b71f228625c
SHA1 70dae4adde64fe6db427e7eeb0e2f3d5109e3cd3
SHA512 9a7de75d9a17f624958e52bec93926f8618e25c4b7a8a44d34d3abab73f4baa55a17dea50849d40753dfd06e94f3ec86146b1a59f58b90af96ed8211cd4272e1
SSDEEP 1536:xkGmzCPAZ9iMznoYvMY5W2ZfPl/Ae0NwqU/1HqwW:iGnPAZtv0EHqjwvtHpW
TLSH
T14363029FA2284B69CF6E5B444842AFB005CD785707417BD5A2F670D25208BAFF039DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 419KB
SHA256 7f4ad807d568efc1b72f059497cc2b257a6e5de7927b11854d8c36336111ea68
MD5 e3088a1cfd270d695fb728665ab6f8f1
SHA1 1a5696db200ff63ac31c6bfd7dcb7eebdbb06857
SHA512 f98e76aaff6f5321c69d9675b6ae83d3b6ac772575478d9ef4ed6d2ab77efc05d75d71c536a15b566c3692e43b316f5cbb56a262c31598ebd91c2f5d4ccb2716
SSDEEP 6144:/L1bZzUlvxlVfdjtEefbfn6+CK1fcmKLX5h0/oQhZ7OCOOCte0pkoPbl:D1ilvdfBnfbP6voUx5ago0VlpkoPx
TLSH
T1DB942318B9A55C442FE1A2D8C83DD4A941B11BF485CAAC3BFD9B40D2F85F8C336D8B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 27KB
SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
MD5 8b2b699d8117447930c6ec35be5ce1bf
SHA1 4755bb0de47453d0c7c9d3554c0817fe43b16faa
SHA512 0ec74a140efea57cfe62e43b184deb3367c941e338a1394a4fc2483ec391e52e9caaf43200c3a970660cdf74a5692a7a083ac79675397fe4cb90b585e3b1964d
SSDEEP 768:tOtXHHGSKIj3A/HUtFb6ofBs0ltoijHHkJtmZx5WOCL:8Br7A/gFb2smijHymn5W
TLSH
T1D8D2D16FBDE86F44943C5960790232E1419E9A70B384AF372175B2B175378AE6783CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 78KB
SHA256 29c4793a96e142e694842e65d4899d20399817fa4386148be7036d003bb54d94
MD5 b75e31dc750413c852c9071f7f974487
SHA1 0ea1e58e0ce2d7cf4fcb0d3897d00e288bc50e43
SHA512 d86c6d106a18881499b4bd309e2a68a8d26f3c1d0b2f215ae16386cce9d38b6967e9475f4f8b00cc8e8c2faf519c8c485f75e8114745c15b7ecb00392480347d
SSDEEP 1536:Dc0GS9gtMwI8KHenjqAfcbiWzOOYltWfB3KmSbXf:Dp9gtMwI8KH4eA0QxltsHSzf
TLSH
T1FA73122A0E6F0CC0BBB5643EFC1C3B91FC24EB9EE752285485567C3AA50353175BB21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 60KB
SHA256 71b10b9fc91d883eb548ebd3d4d2331ff8f8ca965f7e0eb83a032d568af6a4de
MD5 1cb43564ae662faeedee107de26abe35
SHA1 d0c12d788cb22c4dde0ff77cd2843043e129f135
SHA512 99f420021ef6b4c561813fca960839c9d0a7404238798050a6a35497d9905e677e1ae0e5107c447759c85a4ef7f06afd67265babdbe369a50826d92f8955e6cc
SSDEEP 1536:Z3zJPkaf9+6MReUlz15gHdWA7+3XPMJbuD9jBRp6aMnu:fPkQnsem1xPOuzCaMnu
TLSH
T1F15302247B5AC59A81D11F2E8A06974537DC57AAC0FE91DB32C4A6217BE57C0232CA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 72KB
SHA256 fcfaf2e8e1a5d8cff6e2c7736a10a6a3faf27d4696d5d4bf1e2d34cf3512b5e0
MD5 e23f701a0478bb09e5547db5f18b17de
SHA1 cdff049aee29553f0533f7d692d37fae129b7a6f
SHA512 370329619cd303f5ce5bf42692bed1ef7f8c04f4a26181ad42269ac5f6b81fd1ca87034a629b969cffaaa46a626f1eb60fb70e71dabb9f11148b5cd038bb6959
SSDEEP 1536:SVJ0GggPe5RTRIY+6gr24bw02G3LkxUsljvsEQ+:825wY2K4bw03Lhs2y
TLSH
T1CA7312B9871A01B55393D610C935859E3AAD5E1EDF02F85B3FB969A8B08F1B1CCC0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 16KB
SHA256 8463ed535eccb85e24c0d668a6055b3148777528304e8c9f8d510be0628c0467
MD5 70174baa8df618959b52d33daffcf977
SHA1 0231d481756e7ab0f2981cce9188f5264ca52c24
SHA512 6868981093a1a62be90e19d61ea7707a1339e948e8c9bf39f9f32099f30087645cdd373f51538250db85c224f3a9722968828e1efbf1dec9c240cb41f9309f12
SSDEEP 384:wj/7tiSG1hvqvic6UGgrauZoMYVT0BxzEFz5Sdf2/fIGvUP:wN+qvRxrauUVTsESdf2/AGu
TLSH
T12272D07FCD04DC51F328950E8D442896C8409CBEED9B7FA73A6D1B7AC8083D7C28568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 39KB
SHA256 cbf7daf19b2778e1670b023b476a93f320eb777473f71ea9203fb06f44b16e70
MD5 4b4fd1bd5472daccdcf29b59d3d26efa
SHA1 c996c207f74fe4c7d3f5d033476e96f4b78be829
SHA512 e546313064f38557bf111d420b16c65060d6db7f1ff087eac070bf9c551d7bbfa2cb5396c0f3323ff1d158b8c04d59a2cc3a96af8044f063337bfd339bb1d247
SSDEEP 768:Ugq7T0EvIuL89k+1eqY174K+aCCu1TlK6YIQclYb5JeTswJy:k7B78XRY17B+au1Twb3clYb5JbT
TLSH
T1ED0301785037BE85AE1901BB30AABD42974F952B52C3FB91BCDCC7B47DF48991070489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 16KB
SHA256 d237f87d6adc74cdea6630d818ee82137d7fc99d93571df1858d296d42a2cfcb
MD5 13f06c0e7dc2508d27f6c50b9e407014
SHA1 5ebf4bb90311a83ace7bd4ce64f95f2b7004f144
SHA512 67d199bbeb1efc68eba1147970222c555f288ac42202edde1a197492039f8142311faf79713a60c1eacee3a36c1c4a44211f4f4b13d22b3ee19da04b062c6ac3
SSDEEP 384:NSjtBb8riTj//HiT1J4CqDmyljHaRIyfffEn+N4Dm:Eb8riTj//ueCqD1Ljyffs+N4Dm
TLSH
T11D72BFDBFD1B4F280BD24DDABDE152B44177BE994B8990426920C5E0BE023A55F1C3E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 20KB
SHA256 65fd7a46faaad39f3604e01ae2bf672f26cb0e7175056c4e486c06bcf1fd47a8
MD5 8ed38698010e3feb2ee2de270cc74a3c
SHA1 3ae25e0ff6e35c4cce578cb4fa7cf7dfdfa296a4
SHA512 97c3cebdeaaf77141fc5f430837b3df822f101b18178f9a484f3136f305c59882fafece79bb6f7fc19a014fdc79ef756a4c2f56b47eea32b7ac27232c47ac821
SSDEEP 384:GdhlfWFczUPq1uMFhT5ScnGhCX5qQnt3EwRqW9fRvlcyGc8PqDK5zGKrzSF1Aq:Gd/y+1uMFR5ZGhCJqmt3Ej6RayGc8CDz
TLSH
T13AA2D052F31B3E0044DEEFD9700E9D952FEA15E11EA1455844B31C92B9B6F3D62160F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 22KB
SHA256 059510e915ba69c966e28a1d03a837830a76deac44b69973979f9f904c0745f6
MD5 d267abe698f598eda90764bbbf94bbbe
SHA1 d5b66346e0c3764fba33475ab1b317994ebdaf22
SHA512 551e07c5beecb2929de599b6afa9677c09c1fd2815778e0955c6dab74b8fca58a9842673f65a883ad7915c2a7004bcc5346729b95d30ac32f3905db602849111
SSDEEP 384:qPPrPD3tmjIzpenAtmXffJS0YxS+1Q5ege2ZL9Vi1NCeXvv30cf/D37:qnI0zigm305YoQfvZ/Q/Xnkcf/
TLSH
T1C8A2E16EF9003E351393C9C558659C79632D11BFA37AAF412431B41DEDF72989A2C81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc8e5ae2-99d9-46dc-8b89-c99a08052172.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fc8e5ae2-99d9-46dc-8b89-c99a08052172.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 4e14dcfd3331d3c88afaad3b90e2f74325cc776ac06deae71aeae42127091a9b
MD5 807ace849a3b010ff9d308222164665f
SHA1 f9744725276c2048a0a2a2768b588d3da476cd63
SHA512 d2f32e1829968560357a36c1e90a8002a059ccaf82c7b51a04a89d0e3c094d8086c4a70c8045f0ab9801e350f7208dd2c1dd7605461d8ceaf367c817f5bcd452
TLSH
T15BA002100F8A102AE01217F1196322713740CC3011101357409352D5CCB25508E4160C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d11df725-4104-4c82-8f93-3b364bde09f0\index-dir\temp-index
Size 792B
SHA256 3c92aa9315672af6c46e0aa57a2e76a89479550111e0e124a5f114dc187e5ea2
MD5 7c5eba34fee3c682433d97238e9648d5
SHA1 a5b224a0295fec3b3525c9a1ac4bb02a0c96adcf
SHA512 3dd6d53c40f13ab85fe0a79b8a91e9086309c635d55f042f4c8c324d076509723b11702aed91d81f6e1d0aee8d781ee9cc8fbfcac9f953f29ec1e9d6c243ed99
TLSH
T1FC01E1970D134E66EC040E35643DA545977603DC63602A9FA2EEC03EAC96B84BE407A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d11df725-4104-4c82-8f93-3b364bde09f0\index-dir\the-real-index
Size 792B
SHA256 5f8aa5f0a489ba338d4b173f8056cbdb54edc00d2c4e3def64d07affa2b26d18
MD5 6f2eb2004305ff218b8c13a368a14f88
SHA1 1fe36991e4a6c2a8719a7dfee584cf007694e39c
SHA512 202cd704f7d43de46d54c782ebbf9bb06faecb7b9e0095e3310109e724a600f0e377c4a938d9b9cd44d69e1af83465718e9705f9a90e03983d2f8d4b42533d80
TLSH
T1B20126D601138F46FC000370992C9505616641449390778FD3E76066CC53740BE43FB0
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 996057292479fd6fb4087bd227d060135eaf243abd15ee37806278056a925cfe
MD5 49458c56a11aa7945f51f02d832723e7
SHA1 6567e66954ffc3ddb220ebbcb2871737fda600c7
SHA512 60cd44baacda54d46ca1e2da7465c7e8e6769efc402bf2a1b43539bfb540c11cb7ce4c33d7ef9bd5bf2a0fbc4ad1590b43ed03ad25782c00fcfa9fa9124daf29
TLSH
T191410A58AAEA1108B3B76F6A9BF6986D887F78772E0AD45D00110E4E4623B41CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

6221776.tmp

Path C:\Users\Admin\AppData\Local\Temp\6221776.tmp
Size 2.0MB
SHA256 a425c2a4d6814cf9374654335c422dd78d6c78d70c96fd2d370b5da93a0bd704
MD5 8f2ea49b5ea3428936cfbc21ceae8a82
SHA1 7245c24d9ba24456014740f05b7d102f8db7c311
SHA512 815014394ace39634bbeca148d2838da186a4860f72619957ac2a2f22724824cfce1dc4aa0eea766924b61e1310f0a2554e829f504a64ed26b7701fbf5eea30d
SSDEEP 49152:oocRrlAmyFTJ/0Qnve1dpqK/TM6NpwLYH3IUJ6XEA+MJA:ofRpLyP/Vvw3F/4YHFoEAna
TLSH
T19FA533E92B6817BCE8EF2E9BBC1C7C80CD9151156A17555803F505EEBEB3DB2A488F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

720c53b4-1fd6-42fc-af78-8bf40645a5dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\720c53b4-1fd6-42fc-af78-8bf40645a5dc.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de5ddca-c576-4d5e-a646-26b2318b61f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\9de5ddca-c576-4d5e-a646-26b2318b61f8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

A55437A.tmp

Path C:\Users\Admin\AppData\Local\Temp\A55437A.tmp
Size 40B
SHA256 02a9a38ec33dbb2bd8b892f0f0aeb737e75017f3fc5970d008f564fedc4f3637
MD5 d9a1b8b3245e53743a25fdc87b7c8d88
SHA1 acc6f0a128077f1f6f3bd7d0bdc808cf937388e0
SHA512 6acda34f3c542f864d5b959adae5a0a76a13adfdc8a460b6552a0f6d1e3d8c648ebcc9293871c0404ce46ddedb4de8e06341c73807a0b107d18d27c536b09d83
MD5 SHA1 SHA512

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 580KB
SHA256 c1e8a0d7efe1ff0a6f9e1125580561d5891c0933c751f8d112ff37a874f7f9db
MD5 6fdc164df8474ad2be80a80fb4dc1ccc
SHA1 4901cae59207da10744f6c4f08608aaf6ecf1f73
SHA512 fdcbf4d29688481e866533a723759855b509f816c0b2f19284929cd7401dc137b120f2c1df9dee93269a1179190f3cad4bba9fd927b14b4570ac814dcceded98
SSDEEP 12288:4DKU3ZM9JEJlCCbMOlJOWvNbJaiaW4nez5QsdVVscfu6ws11XuSxTt:4eU3m7EJlCkMgNldmjL0fvfujsnu+t
TLSH
T156C4F1FAF7A07CA3ABBD030B9DD66FAE07524526878EE0CC447767C2455732AAF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4488_2064976133\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

59259380-62ba-4634-8586-7b4e7c5b21d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4488_209178667\59259380-62ba-4634-8586-7b4e7c5b21d9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4488_209178667\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClMeta.exe

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\ClMeta.exe
Size 116KB
SHA256 f83c684f7e219b9170a31f0ca3fbdaeaebd8ca9315974a542626a1cb79b20850
MD5 c0ab8c5258a1647fa98dcc6b91b99265
SHA1 552eb0f51fc5c1fb89bbb241332bb9abd155d463
SHA512 40fd1629e3fa265b6ca7fbcae41e5d887da283fc4d00b858a48bb4d6da9800e705a503be8341448d536286e3e4ec9f31a30341768713fdc8af6dbd3bbb3012f1
SSDEEP 1536:4XKm9bgVjjywblLG36/rFObYjzuo1lEtHl+4K+z0AIzx:yPbgVj7Z5jFO5Gn+sF
TLSH
T195C32A8A23E804E2F1B75774C27AE532E775FDA22962D70E0752D65B1F233909D24F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSO20SKYPEWIN32.DLL

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\MSO20SKYPEWIN32.DLL
Size 538KB
SHA256 5730b2293a40bc5b8425ea207ad8cde25784b6f324ae2bd5d0423f1ec8db4aca
MD5 b030b4ca78f2e4f0d4700dc3c782da91
SHA1 4c01234ea1ef35f441264542cf14e8c8b33bf5ab
SHA512 0479218a8ab683aa898edc23e78de6c9778bb46fa2244aa896779e7239856b1ac789520c559e36acf92dd44c4c192703a3eb9a4e06f29d5957967ebbcad28e52
SSDEEP 12288:Tjj8xNjbL/2I6HP/Pv/dbBRbPq6xEAcHgTszaOzICu:TjarMnPndbBRbS6eAcHgTiaRC
TLSH
T1AFC43A45B7E44BB5E1B69678CA738AB6EBB2B8890D30D30F0161D76E1F336605D2E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\MSVCP140.dll
Size 559KB
SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
MD5 c3d497b0afef4bd7e09c7559e1c75b05
SHA1 295998a6455cc230da9517408f59569ea4ed7b02
SHA512 d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
SSDEEP 12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9
TLSH
T1BBC40923B75906A0E195E3B8A1834316D7F0BC4A8322A3C752FBD69D2F673D5673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SfBAppSDK.dll

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\SfBAppSDK.dll
Size 12.2MB
SHA256 db3410ddc4f58647b131fb2666727ce1d8c61c93df47632da4d906029fddf24d
MD5 f23d4bf8d6c250f4b20b58f8073e0f4a
SHA1 907f4f71e1616f447b6fd6e25e9742ae11af6ad5
SHA512 490241170d44c6537205f750072e430a6714f3d38870d8c0112e90bf98d72844e33001328be6867bd1eaf35978c0740fd322f1909ca1d597fcd781be08d70aea
SSDEEP 98304:5QEscqtUdFwjSH8TdXAd+3WpIeMA9bN2COzr9fLMURSi5Hv:qgqtwFwjSHuXWJMAizjr5Hv
TLSH
T160D63A9D6398D0A2D63382B9C75347D7A133B8B1DB378E7B8066786D0D3A3B1572D860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\VCRUNTIME140.dll
Size 116KB
SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
MD5 e9b690fbe5c4b96871214379659dd928
SHA1 c199a4beac341abc218257080b741ada0fadecaf
SHA512 00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
SSDEEP 1536:BqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbHecbWcmpCGtodMzDZ92zfa:BqvQFDUXqWn7CkRG7jecbWb9toaera
TLSH
T1E1C37C4573A402B7D62AC274C1E35A46EB71B5458770ABCF03B689AA0F13BE1AF3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventimpl53.conf

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\eventimpl53.conf
Size 13KB
SHA256 e64ad0238da59869832ba472280b5c7d76fb756e1ce52467b40801e00f6fa471
MD5 d8f29f4e38413df0e9b1e7b1f13aad8b
SHA1 37aa53c8e9aa3f53c8c56da992171001e53dad75
SHA512 fe434ef4aff1535c7010ce9c0e46d28e3d1768fc83734e9967d62e3875569614a6cb8d39e8bba3dffeec395f663c6ed81f4653f63047084e7216046395d50162
SSDEEP 384:mLuWZMBoLNj43HnXQ91ub3jDtmc5Y2UztVEOGi/Z:8uOUSO33/zDAgOGiR
TLSH
T1965229F6D63E1D6324BC34A97D058556C173A61DF8A8501EEBB000F22EB076DE275AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

render-param.dll

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\render-param.dll
Size 1.4MB
SHA256 8cde00918b911587507857d90591439ca6e8e78aea2db844178dbf1f6bb2458f
MD5 cf39dd6c71940bf205cff63fd1d4afcb
SHA1 41a80fb8245951cc4750d1a1adce9bb3f5057763
SHA512 f45b39a3c4f748a1cbdbc0258617e4a9d0ca7a30658ef4387b35dc0e46f2de8e142811d2a28747a053da8352be3939ef5791fc884813632baa46e828fcb2d1bd
SSDEEP 24576:ZnSAeMLH1WY/s9TGL4KhrIX47aDtdZWVGBs2GOILXSdCE0GyK6tT7yAXFdMwiHKO:FZZ/C1K5Wo6DYE/yLt71dMwyuZg
TLSH
T1AC653352B02F56FADEDB863DA285E36149CD74B2A31211B16C4CC57C602EC369AD3BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\u3k0kc6OtHupZO07\vcruntime140_1.dll
Size 48KB
SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 eb49c1d33b41eb49dfed58aafa9b9a8f
SHA1 61786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA512 d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
SSDEEP 768:oPIyGVrxmKqOnA4j3z6S2X7pudLAivD9zigElY7ivD9zG:XBr87uWFLpudBvpziZ1vpzG
TLSH
T176236CD057784082E9AB89B0C5E6EE577D7CF6A20B50968B07A1D1981F637C0FB3D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u3k0kcRrGKfgOnmn.msi

Path C:\Users\Admin\AppData\Local\Temp\u3k0kcL0EODH2RZr\u3k0kcRrGKfgOnmn.msi
Size 15.4MB
SHA256 806f92559a9ae42b0d66af6787804df41feeb2e2807657f0bba48b754d2ebf8c
MD5 00c2bef1e1bfb1bd233a33a2b7124e44
SHA1 a4e08d77a1ce3142fcfe36ee081a7c6da291795f
SHA512 e7105189dff504a77346e882668ba114ef5cfb970dc08225437ceb9c67fd3609b8cb50e9c7a32a1ad358a03850d9c25d78c76c90e39cb5f4e1f101c4b9681856
SSDEEP 393216:M+//oE8202v3ipCe5SRY/F6cR1V4TItiCfJkw:PA2vKCe5SRY/F6GUItdfq
TLSH
T1F7F633D865A68EDAC78F96730626FA646306DF64EB64145231DC700B6637B3633F8C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u3k0kc55AL2DtMw4.msi

Path C:\Users\Admin\AppData\Local\Temp\u3k0kcPt1yEZMwA2\u3k0kc55AL2DtMw4.msi
Size 7.8MB
SHA256 1a122b66116e6b74b0a2170c7664b1589d431ca00566a053faf16cd9fb1a8e68
MD5 db98fd905d308e0a8193c7c9ee23abe9
SHA1 f7fe823c7657a6b14fe8889ad58e91ea4903e44e
SHA512 4c444e2672185b04b9d42a243bcd709e7e2d70839b2bfc5725e8f7352a7f32b9bc4cbe86fbc6f99275a636b7df07ac581d28f44c95944faa8e1a5a3fbbc09a6e
SSDEEP 196608:hnwGe83LFhQDKBi+8yoFxEA+fRmNctcLtyJ+K+vKzf:hwGe83LFhQDAjqxEtRQcot2+VvY
TLSH
T1A38633B49485DEF2C10796B24323A3D1EB76BD77420FE2420A58F615BF71514A2FA3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurboV.exe

Path C:\Users\Admin\AppData\Local\TurboV.exe
Size 476KB
SHA256 324e2f2241604e53b88bd590213385abbb2961d3f17debfb4d40e4fa7bd9c4c0
MD5 f09de920780e801fcdf5eecdf85a68f2
SHA1 9462faac0a1c75664847c2591a10bde7266fde65
SHA512 b2c208f57f4999782d0d4d5ba5ac0143138c6e32b29a2d05ccfd1356ab6a3114b9e6d5fa6e90ca4e80ee1c5d23c4cd59acf01e2ce5c7b8d5bc8858fa5ebc0317
SSDEEP 3072:pCHJw5UiDVQZYKrt33HtE9qmDoOAg0FubrAzs4Lit5Vm:praXZLrtHteAO/MNsV
TLSH
T189A44A1175D2C4B2D5720A3108E4D6B56A7DFC610E218E7B73D97F2F3F742829A31AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persistent

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\persistent
Size 1KB
SHA256 d59fa302bbb6e739e43f438152934bef3abec1ab3414ede9f01e73f1c79e39e1
MD5 4ee27da019842279350d4bbc37c5c7bd
SHA1 289a31783b1a56ae47dee9ac5041eb2943cb67f2
SHA512 f6b7ee6e52b09541ef7dc899d23be825fea11caa41b5aaf16be5331b28797c558e23201321e76f07cdf1251584277b232bef8fc4234b3be5316aa7d8dbe5b61c
TLSH
T1BA312A4C673B7C3B1A7597485FCEE2C0B6230A8616BD1A04897F25D8D878A7D1FBC512
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

8QnS9Smpt.exe

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\8QnS9Smpt.exe
Size 8.1MB
SHA256 2ea9dc28ca2aa500b7feb0c794d6b1749f59d6c94069c26276117f89cd1c78b2
MD5 783a224beb8d671519469fdd1f01e084
SHA1 9abd621457da307c68350dd0562067ebd0c2e6ce
SHA512 a84d07f229b6583f8e7a3593c5c2ba4c1f4b77ab80f1364f3c081adcfbc5e82a67462d1827af86470b832bcee3cc6d90c61aa172ff028823d4c3462df83ffaf7
SSDEEP 98304:ynfkrBqrGLj5C2/wbAEaJijN2g7SHFo7bXGh3aT2fOYvbkK1Cvg:yMr0i5lIbAGroo7bXe3G2dvbkk
TLSH
T1AC866C46F6A001F6DCABD574C9069623DAB1BC451828874B13B0FAA79F33B705E2F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Graph.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\Graph.exe.manifest
Size 842B
SHA256 c7124bf5f44a11eb27e3002760c08a618844fe8488db8e78dc1528396a61896f
MD5 bb8b0008a1f68254d784c9a99ef0fae5
SHA1 d2d24ec9e23d80caf43495b1ac7d8db3d9d0b343
SHA512 d33e184aa3aecea8892247b7614a8c68d3f15d2cba905ff7cc4216d8a6550e29acbb572c161c513478fab02487584743ba137159f4f72f2f966fb50a82445bd8
TLSH
T19E0112C1E11CA6A5974220933D32E104A53FAF2E1AED45ECC4825ABF6602BD9AB82161
MD5 SHA1 SHA512 TLSH

Submit Download

LYNC.EXE.MANIFEST

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\LYNC.EXE.MANIFEST
Size 1KB
SHA256 99245f16ac2f6743da84bf3426a08385c0aa099eda16f722a28783b47e242123
MD5 83de4ede068cf351fe6895ae5d6c246f
SHA1 d809b0dd386ecb970d9b14fd317025e4d3863a7d
SHA512 156ef49f83c94b19b040a514abca0182e4ffb4a0a497aa9e736c2248f75e814fe3a96022d6008dbb77f13cd57434a7ab1a898c11b717b838e8e797d58e806cb9
TLSH
T1102114C1D48444A5937110A23651F304FA6947AF199E44BCB4CC8B3F7F269D6C3431D1
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\MSVCR100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUTLOOK.EXE.MANIFEST

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\OUTLOOK.EXE.MANIFEST
Size 1KB
SHA256 b114277e74126b7954394db205111389fbcae66637eb128109d59128261286bc
MD5 53ccae732eec7d1c64ae2e9494a281fe
SHA1 53e337d965db7f4ca40c0a1db6c1ee3480b2669f
SHA512 186e0ced89d5a8ea468865606cc17ac977e5aa0fc6ab90eb7c6a1b658fb34ef40cc7967de86c781c132bc5856b2db1fabbc80995bad4a596d0ab1ffedac3c2e6
TLSH
T199210381F018A665934310D32E7BF280E47F6B6E19EC41AC80819A7F76016D6D7831A2
MD5 SHA1 SHA512 TLSH

Submit Download

excel.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\excel.exe.manifest
Size 1KB
SHA256 366a98a4974c672348ce5a529008e0f0840e06262f1c9b30910258266574a2f5
MD5 6a2da43a9ce3544d063b0695903508de
SHA1 42413f904c6cff3c62e2af8c1766dafc3ef94136
SHA512 198daff30b1b76344063ef6627157762288490cf055e6317c6413bbcf94b05922f2d8df65f8748d24f8834acbeadbf7b5f22661b3ba86aa5aceadc60cd00bf4f
TLSH
T18111F0C1B00C65A6A34220A32D36F240A47FAF6F1DED41BC80C6997B7601AD9E7831A2
MD5 SHA1 SHA512 TLSH

Submit Download

excelcnv.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\excelcnv.exe.manifest
Size 1KB
SHA256 a702fa4c3b7fff0f7fc9204bf6e23b1d2d423a835bc4f6d5ce485b8592319b32
MD5 5680fb6ff1f8ef8ea586e8f9207b83dc
SHA1 8d3d3798a2cfb5cdf2b3ce1af7485cc9efee09b5
SHA512 f9239311be05347979f9ed04253d88ab21bca30f49f4b1cb74fdd8ed5b334c7e7b4a8459790bda318e1e7f337df915a7a9d358fa48c7fe05dca1089d5f0c2538
TLSH
T1B311F3C1B00C6595A34220632D36F240A57F9F6F1DED41BC8086597F7601AD9E783192
MD5 SHA1 SHA512 TLSH

Submit Download

frame_io.toml

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\frame_io.toml
Size 30KB
SHA256 12e8ff2fa05ddeecc539f1e4f0046d3e543c7dd6875936dcc0c774d7c02399bf
MD5 c9de020b7a18b4f5b5ac7c2115ca045c
SHA1 d15dd2c2c48340382d2ff2b52d2da9aee1654489
SHA512 2af29f127ce666c578e2c9b086e377d6f474de1d1c955b44faffb615d2e14003921480ffc9e5512fb5eb283af82caf20cca0f1c1d683da4c8d00f5875055ca49
SSDEEP 384:4a9LmCAchDODdwuvfZiDafpnMyv5DjDx70QwKrRHa4AUITfQQgtTBUAMJTzOUwin:EzdwmZiopMyvdx70QpHeUIMQ2i5wiEhU
TLSH
T1C0D29F77DB65792399076A6EF61121E2DB80BDB63B0E3090F5CD281B3026C94D236D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msaccess.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msaccess.exe.manifest
Size 1KB
SHA256 32895e090ea77719d78c3fbe140d33b44001d11ba725c537ee1d5d055e745ebf
MD5 27a313a6dee9072acb5de6e1078065e7
SHA1 05174f5db75acddbff0f6e95914190aa80649ace
SHA512 12d98261fa0ecb35753e755023b97bd24efb50c0dd28218f07f9549d1b4a4fded92918b06d97c1f00f3031a1caf2c6f465c46a406854ac08dc211678f3ba5d46
TLSH
T1B131C082D004A565F75310E33ED5B768607D2B6F08CC97B8C890DD7F5206FCAC7460A6
MD5 SHA1 SHA512 TLSH

Submit Download

mspub.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\mspub.exe.manifest
Size 1KB
SHA256 a334086431fd3e5974c5a5239ad7c45bb2ffb128278551c09f70a21d35e27358
MD5 66ae4765e9c554f1c36e4c84b514fa8b
SHA1 a8059d708dcdb8e64971cad6e60cdee93b8888bf
SHA512 b9b32367fecf83130dd9df163ebd61931f502cffa2616cb87452b5232a6614f863afbee73e32ad19a6c7762d9bd11104968695935faeabfbf46fff23aafa6caa
TLSH
T14E11F3C1F01C65A9A34220A32936F244A47FAF6F1DED41BC8486957F7601AD9E7C31D2
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp100.84w

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcp100.84w
Size 593KB
SHA256 5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
MD5 4f096d96285e06cd51aef7d2d3de04da
SHA1 c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA512 80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
SSDEEP 12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2
TLSH
T143D41A23FB2906B0E162D37C65D6C341D3F13C8A4B22A7C752ABD52D2F276D9563B221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.84w:Zone.Identifier

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcp100.84w:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

msvcp_win.dll

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\msvcp_win.dll
Size 626KB
SHA256 d7a3b77b3490745dd4f510ff186a6756e12b4787c2dbf75259136f2fcb2d02b9
MD5 567a7e4cb350bb79a7dc51144d96e624
SHA1 3262a45d62c3f52f9a329a2707c10bdeb992d143
SHA512 f85588611922065f4346755b53493f065451cd21f150ac80bd400432bea18cc735f28cddf1cb65b45e737c83223f5e5e9549e0de13da110f3c50c86dcca4535e
SSDEEP 12288:Q+TTIwt0B5483RXXoTkni5KQEKZm+jWodEEVUsS8pc:Z8wdKnIkVQEKZm+jWodEEmsSL
TLSH
T1F9D41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oart.dll

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\oart.dll
Size 20.0MB
SHA256 eb9a926f41211302a77d493135476ba28b38fd41e7a0f67bc66b9a56e70242f4
MD5 f47d5bc87c7ddfe73963dbf8397b46e9
SHA1 fae38194d91b07a828d2c50823925114504a4829
SHA512 84ccab12a5c966b8f157a0e638ec9839afbba59cac92971112655c60fee0f74db3571d483219918f0cfaca4f0944f2cb6da5ccf840a3c55809b8e17727398e9c
SSDEEP 196608:3B29UvVDA7B5i1rW750UyF8pUhUbzECaGU2+rxbPZ+kMiuEfW9ptTK:g+xUBg14kKp3bYCaGU2+rRPIauEfMF
TLSH
T13D275A8E3A6041F3C59AD174894BD6A3E7B2BC815C74970B02A2E65E0F377B1AD1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpnt.exe.manifest

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\powerpnt.exe.manifest
Size 3KB
SHA256 9c3db334787e031d0d73ceba16151a22565f20653d79c141233805ab1dfe450a
MD5 fbeb2e2d7f074e84d581fed436220daa
SHA1 9c61d3998849ba85fa0ec15c3e8e1ef6055c8550
SHA512 15383897d6bd4af8ee8b0553c5b9e68fdd25eecc9b1a444df644db5d1f0ffe3613d40070e941e4a294214d535fbdf88842e3b5f215c0f7f3f415eaaae0d40fb9
TLSH
T1B571DE40C484A3C89DB544817BA4C62CD48BAAC9C48A4DBC34BEEFAFCF78451D9D76D9
MD5 SHA1 SHA512 TLSH

Submit Download

surfacemod.ini

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\surfacemod.ini
Size 1.3MB
SHA256 48cf4a3e71091b961ec8414f5ec486260f77ef486a82eb4ccbb79acd124d6176
MD5 64091969cb2ec89b867733e473bc0bb6
SHA1 6817c722ba94b7cf1f8f27f546506dd7f6b41cce
SHA512 de8355c8f0e87f68e86cd00df8c1d2cb78b06d541436c0de677ddd0a6c1bb98597023a08b7ae8124892e85011c9e41e4273e3ab4f03d1e9be494d16ccd3f3920
SSDEEP 24576:95au/C0/sV49YiCKJ9fuXLHw3685NB+xb1wE21W552Kms:qu/BiRzKHwLHw36W+xRwrWZms
TLSH
T1465512E07868D896E533B03D41D979A3F0177AF87563B2E944F1991CA60AC93DE33863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\Downloads\tmp-89311-sdynjS04495l\ucrtbase.dll
Size 1.3MB
SHA256 2c08e77f86b0953cffa505bdbe64e87ecb7c088db65d5acb9a2eee65a32565ef
MD5 81a08ea850a35a5efcfe54864a51cf6d
SHA1 8089a77adeb65f6402d2c6fc2cb76d7bbf102e10
SHA512 7cd65985cea38c3e1b8b2308da5ea6d52c657ad259edac47ebcb23d9f54df868ab3571ac25de12b8e9b52abc0711cce68f94b811445226364f998384b72950f3
SSDEEP 24576:W9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszORmxvSZX0ypapJDBHd:W9KpUmTfFqSgdDPq3DjqI08LupJDT
TLSH
T1FE55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrSimulator.exe

Path C:\Users\Admin\GrSimulator.exe
Size 195KB
SHA256 3c575680ef968f84834327a14b0396e67b09d559089fd1063b9237a2555347a3
MD5 ca2564d8d367db4b2ed0ecc1b3282d3b
SHA1 69f808f0146823b8b151b4ee864009e852af52a1
SHA512 716077841a816d3dba0fdf5657111108389188d7f5a8575c8001b5dfe010439aebf91cfa38f64ed263aa4c05862a31efe851d447b2d225ef1eaa1abcdeadf75d
SSDEEP 6144:HdJkuME6pUP5gRRRRV/rcJP5L57zQ0+we6:HkuJ6pU4/WQ0+we6
TLSH
T12E144BF6A6E25CD9CA66937492CAD6727338BDE043728B4B921057302F03ED03FD9695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 2b7c2da827db1672945e82a49362dbb91983e8c0234144c880dc5cd52102a363
MD5 2c4d015269bd7ed3fefec9881fe904d5
SHA1 bfd6f1c5d92d8c23165b9163c200a71f0097fee9
SHA512 7676a623d264cb36a6e1bd6a2afd96d28d7b284bf9849629fb46676b1a0e9ba7bca7a07a789cbe46b37f80b81500c79db353544000b28960f79f21b90b0b28f7
SSDEEP 96:T5yFM6Z0yXKmvgkFxT+mRzl3nyu/XfUBobllz:NUM6aiKwLFAmRB3yu/PUyblF
TLSH
T1D1A1C85BA97849461731E6E61C0B339CB0137007CEF0DE6CB1A9DD6186ACBFE40D7A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 412c917fcd79b8a672a446612c823bd14dbbecb85d5749b9492a098ab0cc6e0b
MD5 cce4d8dadb6005347a905519a7968d04
SHA1 78953db5cf9d82b92070eb44f50616d9ffe7aad8
SHA512 1b56a02ba4fad45f939cc87537d11aa3dc481bbdf16a1ca1627532d477668dc6109a247f6968e5750339e0838bc5f778b842ea838081473ba2eb0663dc0e5e69
TLSH
T1A921F6A8184C1931E5B5781A2A5FF701C6F2F266DA50AF6C9AA91C284CC74F4A36152F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 75KB
SHA256 7e24da77b1901f720ecad62c5d8e550819c7cf5592a19f609e8ea966738df0be
MD5 e5c729f142da029b09029af661b816af
SHA1 809f8a73cb585e8854565f7574ca2bfe3017352e
SHA512 22996fa635cd036d6761a8175078bc6ad2db2a143b52ede0ce4aa459e0b18d4ffd332a25635af6a7f2e19b97be8fe5e2a8d716d91f3af58f46b04accd21f7369
SSDEEP 768:uyfXa8hRckBZe749pAPcMKQC5Hta40mFEQlygwgZlZaoeUl:1fXaQ9qcMKQSa40mVrwgPvl
TLSH
T1B9731AE396A872FF0B9437CB1C4BB95B63E54165E38605C9FDE9CA1C90CD650023A6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Public\.ff_tmp\addonStartup.json.lz4
Size 4KB
SHA256 226e89423f2a4a0bb8b2138091c6598dc4bc82559a1e70a6321ad27af60d6b3c
MD5 ca3ffa3ef4231b916e25777f278b0a95
SHA1 70606e5c5cf0be8e086b56a7abf7e01a5aec5209
SHA512 dedca2b85b29e182d57e381b0d801482a05fd7aa536b7df1cf4db5b21140df2fb87af1d14413ed3fb77013199de38dfd4c89b89e51a74a8dc0cd8be65798f5ec
SSDEEP 96:GOxNnsu2N92xWZbhD4oMgGimHJeyFNO1u+8TXqYjnr:GwhC2x2bhDvrGimXA8Txr
TLSH
T1D2918DB6E549FFD2FB36C08AA4D93F30D2EE5BB820789531F0AA62194C606E15345340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 7a490fa84e621a75201c680a2502684f301044566aa7396bfd8403e6ebd9321e
MD5 750cf7a9c537dcdcf4870d864da60bec
SHA1 f138f5b4881373a420189edc0075b54c230326c6
SHA512 2240d18396ae81a136312ef72a1ac2e7a6580dd2a6eaf8df101e23b84d4c62e85b6cd721e89fbee67ec7bcacef73f931ae086f3bed8fcf13f4d4a59bca47792b
TLSH
T13DC0804F9F4F11F711511516754564A5D5FD0D505C9FB0901D5C4544857F44739DE3C0
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 10KB
SHA256 c471acdfa5c5e902895e300a3e183e88ffef7596b79bce4ad58c65c6b9b94153
MD5 0e45a4b2dfc59565baf8666135c16f66
SHA1 dd3b3c275ea9e53f0ed052640bb631b9129229ec
SHA512 e4be6393f009847e956e329e52d06d4ed3794aaa8dae74da4d092c15191d56a350d9c15f9e80e2dd5544b8f0c0e15a4a63e2c907805fa5c3fe811265b29f84ad
SSDEEP 192:akI4vCUmldvJw8dhEpp943DP96gDC1L4kYwL4DDT:akI4vCUmldvJw8dhWp94zP96ocL4HwLG
TLSH
T1ED32421549049EB8294EA78BBB367D02C37D473B60845C78B4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 f2c3c0029b40e714979a1a0f28fee602770752e80de4cb0f21295c84abc50f32
MD5 5c5e1e7ce50245c9be9fa4754acd2e3d
SHA1 5141baa140305b8787a8d1b3b7bd7f73ebcf79dd
SHA512 40ef0e72b469921d0d17d3eded7665613967782116da5c5515a90def8f3e079993015e5fbc62abaa14114bdd3430e97116a240fa3743c0bd502d2eaa832a2fd9
SSDEEP 96:xHa4qGqIdFdzvWi6ElW9FnpiT1w8h9cnm2:sTRIdl6EKm1w8ha
TLSH
T179912EB865048B6F65B6777CBC658C716EB2027B777F28C610A594C4010CF3886E5ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 105972eca71256d0a8ee41d475b9ae21cdf4163f233fbad2b9cb9400264334c5
MD5 f24591b70525e4a6b989664e66326f91
SHA1 b10d48d59479cd2b376bdc66cfee1f35ad1f30f6
SHA512 3d288a3133640d56d1909175c5aacaf4c6ba73d61c30ccac6fa9a525edb0f4dce1b19125fcc32c814ee659557b1f2bde2fb1fec3c6ab7de63426c7bec2a72c1d
SSDEEP 96:xHY4qGq0dFdzvWi6ElU9Fn9H40VBw8h9cnm2:iTR0dl6E6LVBw8ha
TLSH
T10EB11F785504CB7F65B6777CBC648831AAB2027B77BF28C650A984C4050CF3846E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 1e8291291b532ad51735efe6caa7b8e707836017b000cf70895f7c98b82d2702
MD5 2c64fd7eb08732352ec9ea60bec84707
SHA1 5dcb114851e03d0e0fefac0d7b4beb19e0b23181
SHA512 3b89ea589a6e93fafd5a102174800e8bf68766e13de9d6b20197e2db1196e4ae56e3d6ce46208ea3d0226924759249b768aceedb33ecdba7583777370103b928
SSDEEP 96:xHY9UXqGq6fFdzvWouH6ElvX9j9nmH40VBw8h9cnm2:i3R6flY6EWLVBw8ha
TLSH
T110C10F785508CB7F75B6736CBC648871AAB2027BBBBF28D650A544C4054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 9d98acadc809fe70e6f64db80b733e21010c2b79f5f3a3db0a4815704b7bc8b5
MD5 0dc52dc653fe69cc539b9fb11dbfbed9
SHA1 577d99420fc95d6f0e38477e9526bea9208f22c5
SHA512 e42ece7c8e542b33e72c0f8be1f7393089efaf08a75cd50d441fe1f0c3716639c90c069bdf19a1a220a7d2a288e3b9ff78775bf4e9f968a89829205b28fd65fb
TLSH
T1B131DEA629058F6FE2B537ACFC154560D6B3027BB77F6C8221B890858518F3442F2ADB
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 8eaf80b6896c82f61dd0648971e32e0c0ba288514dcf64eaa86625bb19248445
MD5 958b1de8ce2a075f52c747b0a1a7ce7e
SHA1 58a9cb0cb603f1a4968fef352c579488e067571e
SHA512 bf6b476ff96fc44053faf1f9b39c4b8397b0bdab871cc3f4429bfb13b1c6072885191f02ec57eb3216aa8bf0f733391f5808e745c6f1b77942532cf7c58499a0
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0pZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWoyh44CfiaR/skL0H7
TLSH
T1FA23348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 1ee05adf17e59be443dfbc67e27d87542cc2943bd6d74f293c71fd91c5b392e0
MD5 d6c7c69f6ece2ecd1212beff69ba3232
SHA1 4729307add922f20352281c5075d7885005ccd5b
SHA512 3e8e2ed4f50f9c67e90f9d518c0c8e557a133c8ed12a10b8fb7949a5a35824318a598458316fa85b5d3e43165226b48a7f829a849ad6d1d7982a88b80efa0402
SSDEEP 768:N6S6CrAWFj+f3aY3p6x3I0H7/29fUcHLeHnHf:N6S6ey3aY3p6x3L8UcHLeHn/
TLSH
T12E4396CA3633DD51CB29E47A62A642FB544FA2DD003113886A9E9F4C441B5979E2FFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-1626-0x00007FF872820000-0x00007FF872880000-memory.dmp

Download

memory/1396-1672-0x00007FF872820000-0x00007FF872880000-memory.dmp

Download

memory/1396-1628-0x00007FF872820000-0x00007FF872880000-memory.dmp

Download

memory/1396-1679-0x00007FF7D3150000-0x00007FF7D316D000-memory.dmp

Download

memory/4344-470-0x00007FF865F20000-0x00007FF866092000-memory.dmp

Download

memory/4344-514-0x00007FF865F20000-0x00007FF866092000-memory.dmp

Download

memory/4392-467-0x0000000008260000-0x00000000088C3000-memory.dmp

Download

memory/5028-522-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-551-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-1650-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-1618-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-795-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-516-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/5028-521-0x00007FF882130000-0x00007FF882325000-memory.dmp

Download

memory/5028-1588-0x0000000000FA0000-0x000000000107A000-memory.dmp

Download

memory/34712-1685-0x00007FF882130000-0x00007FF882325000-memory.dmp

Download

memory/34712-1689-0x0000000075C70000-0x0000000075CBF000-memory.dmp

Download

memory/34784-1677-0x00007FF7DA810000-0x00007FF7DA8A9000-memory.dmp

Download

memory/34784-1674-0x00007FF7DA810000-0x00007FF7DA8A9000-memory.dmp

Download

memory/34784-1680-0x000001C518960000-0x000001C5189CC000-memory.dmp

Download

memory/34784-1684-0x000001C533380000-0x000001C533542000-memory.dmp

Download

memory/34784-1686-0x000001C519320000-0x000001C519370000-memory.dmp

Download

memory/34784-1687-0x000001C533230000-0x000001C5332A6000-memory.dmp

Download

memory/34784-1688-0x00007FF7DA810000-0x00007FF7DA8A9000-memory.dmp

Download