acrstealer | 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
141s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample261015-1s2qcsszbw
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer hijackloader loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\nthub_net35_win32
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

acrstealer

xor.hex

Extracted

Family

acrstealer

Version

4.4.7-alpha1

imap.dropstream.cc

Decoy

edgesuite.net

Attributes

ddrs
logs.fetchwave.cc
guids
4d0bf37a-3180-4974-a873-a6ec4d4dc9f9

01a10d60-3b38-753b-9223-e8749716a1c5
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ca51-468.dat	family_hijackloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2616 created 2700	2616	TurboV.exe	82
PID 2616 created 2700	2616	TurboV.exe	82
PID 2616 created 2700	2616	TurboV.exe	82

Executes dropped EXE 2 IoCs

pid	Process
2932	8QnS9Smpt.exe
1928	ClMeta.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1944	forfiles.exe

Loads dropped DLL 10 IoCs

pid	Process
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2616	TurboV.exe
1928	ClMeta.exe
1928	ClMeta.exe
1928	ClMeta.exe
1928	ClMeta.exe
1928	ClMeta.exe
1928	ClMeta.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2616	2932	8QnS9Smpt.exe	100

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF5CF31C06DC1CE7.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b68b9.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1AD703D2-09E7-4EEA-A184-FF8A55E65560}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6D0EC742B2311FD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b68b9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3492	cmd.exe
4440	cmd.exe
1420	cmd.exe
3424	cmd.exe
3068	cmd.exe
5832	cmd.exe
5684	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TurboV.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TurboV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
912	chrome.exe
1040	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Setup.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{CB155E08-DE7B-4D88-9DD0-03E2CBB75A80}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

NTFS ADS 31 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\Graph.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\msvcr100.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\excelcnv.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\surfacemod.ini:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msaccess.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\Graph.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\LYNC.EXE.MANIFEST\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\ucrtbase.iu:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcp_win.mp:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\msvcp_win.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\powerpnt.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\LYNC.EXE.MANIFEST:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\mspub.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\OART.DLL\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\excel.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\excelcnv.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\msaccess.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\surfacemod.ini\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcr100.ktm:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\mspub.exe.manifest\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\msvcp100.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\OUTLOOK.EXE.MANIFEST\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\frame_io.toml:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\OUTLOOK.EXE.MANIFEST:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\OART.rpq:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe:Zone.Identifier	Setup.exe
File created	C:\ProgramData\nthub_net35_win32\frame_io.toml\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\ProgramData\nthub_net35_win32\ucrtbase.dll\:Zone.Identifier:$DATA	8QnS9Smpt.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\excel.exe.manifest:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcp100.ucb:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\powerpnt.exe.manifest:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe

Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2932	8QnS9Smpt.exe
2932	8QnS9Smpt.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe
2616	TurboV.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe
Token: SeShutdownPrivilege	4432	chrome.exe
Token: SeCreatePagefilePrivilege	4432	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4432	chrome.exe
4320	msedge.exe
3296	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4696	Setup.exe
4696	Setup.exe
2944	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3492	4696	Setup.exe	89
PID 4696 wrote to memory of 4440	4696	Setup.exe	91
PID 4696 wrote to memory of 1420	4696	Setup.exe	93
PID 4696 wrote to memory of 1944	4696	Setup.exe	95
PID 1944 wrote to memory of 1784	1944	forfiles.exe	96
PID 1784 wrote to memory of 2932	1784	cmd.exe	98
PID 2932 wrote to memory of 2616	2932	8QnS9Smpt.exe	100
PID 2932 wrote to memory of 2616	2932	8QnS9Smpt.exe	100
PID 2616 wrote to memory of 4432	2616	TurboV.exe	101
PID 4432 wrote to memory of 4944	4432	chrome.exe	102
PID 4432 wrote to memory of 912	4432	chrome.exe	103
PID 4432 wrote to memory of 4552	4432	chrome.exe	104
PID 4432 wrote to memory of 4552	4432	chrome.exe	104
PID 4432 wrote to memory of 5124	4432	chrome.exe	106
PID 4432 wrote to memory of 5124	4432	chrome.exe	106
PID 4432 wrote to memory of 4924	4432	chrome.exe	107
PID 4432 wrote to memory of 6140	4432	chrome.exe	108
PID 4432 wrote to memory of 4924	4432	chrome.exe	107
PID 4432 wrote to memory of 6140	4432	chrome.exe	108
PID 4432 wrote to memory of 572	4432	chrome.exe	109
PID 4432 wrote to memory of 572	4432	chrome.exe	109
PID 4432 wrote to memory of 5672	4432	chrome.exe	110
PID 4432 wrote to memory of 5672	4432	chrome.exe	110
PID 4432 wrote to memory of 1600	4432	chrome.exe	111
PID 4432 wrote to memory of 2648	4432	chrome.exe	112
PID 4432 wrote to memory of 5704	4432	chrome.exe	113
PID 4432 wrote to memory of 2648	4432	chrome.exe	112
PID 4432 wrote to memory of 5704	4432	chrome.exe	113
PID 4432 wrote to memory of 2552	4432	chrome.exe	117
PID 4432 wrote to memory of 4296	4432	chrome.exe	118
PID 4432 wrote to memory of 2552	4432	chrome.exe	117
PID 4432 wrote to memory of 4296	4432	chrome.exe	118
PID 4432 wrote to memory of 4932	4432	chrome.exe	119
PID 4432 wrote to memory of 4932	4432	chrome.exe	119
PID 4432 wrote to memory of 5460	4432	chrome.exe	120
PID 4432 wrote to memory of 4544	4432	chrome.exe	121
PID 4432 wrote to memory of 5460	4432	chrome.exe	120
PID 4432 wrote to memory of 3760	4432	chrome.exe	122
PID 4432 wrote to memory of 4544	4432	chrome.exe	121
PID 4432 wrote to memory of 3760	4432	chrome.exe	122
PID 4432 wrote to memory of 3200	4432	chrome.exe	124
PID 4432 wrote to memory of 5672	4432	chrome.exe	123
PID 4432 wrote to memory of 3200	4432	chrome.exe	124
PID 4432 wrote to memory of 2208	4432	chrome.exe	125
PID 4432 wrote to memory of 5672	4432	chrome.exe	123
PID 4432 wrote to memory of 2208	4432	chrome.exe	125
PID 4432 wrote to memory of 3944	4432	chrome.exe	126
PID 4432 wrote to memory of 3944	4432	chrome.exe	126
PID 4432 wrote to memory of 1164	4432	chrome.exe	127
PID 4432 wrote to memory of 1164	4432	chrome.exe	127
PID 4432 wrote to memory of 1520	4432	chrome.exe	128
PID 4432 wrote to memory of 3448	4432	chrome.exe	129
PID 4432 wrote to memory of 5364	4432	chrome.exe	130
PID 2616 wrote to memory of 4320	2616	TurboV.exe	131
PID 4320 wrote to memory of 4564	4320	msedge.exe	132
PID 4320 wrote to memory of 1928	4320	msedge.exe	134
PID 4320 wrote to memory of 1040	4320	msedge.exe	135
PID 4320 wrote to memory of 1928	4320	msedge.exe	134
PID 4320 wrote to memory of 1928	4320	msedge.exe	134
PID 4320 wrote to memory of 5712	4320	msedge.exe	136
PID 4320 wrote to memory of 5712	4320	msedge.exe	136
PID 4320 wrote to memory of 1268	4320	msedge.exe	145
PID 4320 wrote to memory of 4744	4320	msedge.exe	138
PID 4320 wrote to memory of 1268	4320	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Reads the TCP/IP host and domain name from the registry
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1420
- - C:\Windows\SYSTEM32\forfiles.exe
    forfiles.exe /p C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG /m 8QnS9Smpt.exe /c "cmd /c call @path"
    3⤵
    - Indirect Command Execution
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SYSTEM32\cmd.exe
      /c call "C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe
        
        "C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Users\Admin\AppData\Local\TurboV.exe
        
        C:\Users\Admin\AppData\Local\TurboV.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\9cv9bcyzdNKdrdya\ClMeta.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9cv9bcyzdNKdrdya\ClMeta.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1928
        
        C:\Users\Admin\GrSimulator.exe
        
        C:\Users\Admin\GrSimulator.exe
        8⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\9cv9bc0Qkw2y7Kz8\9cv9bcHUzv896SMv.msi" /qn /norestart
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\9cv9bcqNLptVtjim\9cv9bcnvRYirbX66.msi" /qn /norestart
        7⤵
        
        PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff44f4c728,0x7fff44f4c734,0x7fff44f4c740
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,17282975214543337931,15848415117479719529,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11308898486722732329,1772715501000517972,262144 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,11209292805563842393,3807219173818195808,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,3788506182552883664,5943291738661450860,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,16945448551335450194,2390316078992092722,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,16631068729120255801,14857176342099302231,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,18442794293775907984,12711930684423658659,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,11436845001531050709,8881508508699024266,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5336,i,6071925146683607909,15395742706037442376,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:2648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5348,i,17205384763091740176,18097247568320769460,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5680,i,322423235608940532,5888888347210224256,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,10814520593365752093,4742882298626538974,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,5113735395641066695,5771106301519362136,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6028,i,11866951482330809716,6125834045572267929,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:5460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,18098522654972083598,8466766321052729638,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5696,i,11428814265569264997,8131563971475151009,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,787494879665052328,1660846453154745165,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5368,i,17734587121495173455,742443005844267606,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,8027645010504453003,3052563130013951460,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4684,i,18086006663175845985,5240269739747675834,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4616,i,930992833588356934,9501206651453021168,2097152 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:9
    3⤵
    PID:1164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,13473314652666231368,16865438508372847628,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
    3⤵
    PID:1520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,6252377430318402960,7633763193383112214,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,678363849754639885,17612108146430829446,524288 --field-trial-handle=2028,i,3648487097569688693,4420002506446303606,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x318,0x7fff3cd8c188,0x7fff3cd8c194,0x7fff3cd8c1a0
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1996,i,18212663248870119650,11197840652742662978,262144 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,13314396729723174708,12657381859628009062,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,175969586659770765,4311573770677319269,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,7878914344513794704,7294084121758332828,2097152 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,3310567819210407047,5785698364085734788,2097152 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10390624990161063398,5227911706158716449,2097152 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7194669846218847606,16822250328455555113,2097152 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,2668686792372925921,1865857478019300321,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7448759767167653793,13090702555015893900,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11169204792548106156,17702797809041441656,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12065749720219317442,3760320968767232308,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12065749720219317442,3760320968767232308,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6213423498534734289,659971148235650437,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,9134632447882012244,18128032769930732151,524288 --field-trial-handle=2540,i,7249689213709945237,12279201790151645024,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
    3⤵
    PID:980
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:3296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2800 -prefsLen 24445 -prefMapHandle 2804 -prefMapSize 268500 -ipcHandle 2880 -initialChannelId {ef304b15-81d9-49d5-8967-48a121abcea6} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1772 -prefsLen 24610 -prefMapHandle 1748 -prefMapSize 268500 -jsInitHandle 1820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1904 -initialChannelId {5ddae10c-293e-46f1-8763-755e5d5ce949} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3828 -prefsLen 25493 -prefMapHandle 3832 -prefMapSize 268500 -ipcHandle 1984 -initialChannelId {95e8d1d4-e5a9-4b3e-9169-03365c2b31f8} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 25604 -prefMapHandle 3752 -prefMapSize 268500 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {628d214e-9d38-4f8c-b596-ec21db336383} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3776 -prefsLen 36486 -prefMapHandle 4900 -prefMapSize 268500 -ipcHandle 4912 -initialChannelId {fb8e44af-9f75-4886-83a7-7a9f3b2f8484} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:4780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 34446 -prefMapHandle 5076 -prefMapSize 268500 -jsInitHandle 5080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {cbb643a8-e3dd-47c3-bff3-f807488eeff9} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 34446 -prefMapHandle 5296 -prefMapSize 268500 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {e030ddf1-8b5a-48e6-aaa9-7f6d7100781c} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 34446 -prefMapHandle 5436 -prefMapSize 268500 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {a4b611eb-a443-4cbf-abce-28e5164eb6d9} -parentPid 3296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3600

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2944
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c "start "" "C:\Users\Admin\AppData\Local\C-Media\USB Audio Controller\HashidsNet.lnk""
  2⤵
  - Executes a command shell one-liner
  PID:3424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "build.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:3068
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c "start "" "C:\Users\Admin\AppData\Local\Corsair\Lighting Control Agent\RecruitmentTracker.lnk""
  2⤵
  - Executes a command shell one-liner
  PID:5832
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "build.cmd"
    3⤵
    - Executes a command shell one-liner
    PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Indirect Command Execution

T1202

Process Injection

T1055

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b68bc.rbs

Path C:\Config.Msi\e5b68bc.rbs
Size 13KB
SHA256 1f17afc7a64f5fd789afcf372a616d252382368babe49040d7fca1f56f9c8750
MD5 ca03fadac3c1f53f6116ecc0e2804afe
SHA1 fdce0d0ac25ddcb57c44b93b0db042e961c92ebf
SHA512 f6ce1b50ec5924e61829c7652116a5858b1b7cb2d48f70e2ff3875593e1b824cbf9239c46459127cb39fc19cf3f62c0e3159a9f47daac5d02bfe3a642947a455
SSDEEP 384:/jUOtWSoLk6Pl4D1rPyBcCPDxyFF14oVBoVJDEO:/jUOtWSoLk6Pl4D1rPyBcCPDxyFF6oHi
TLSH
T1CF529614A490C6F3C49C07BAF7531B6C7B62D1DCAF59334A768CD070AA63758ED99482
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b68c1.rbs

Path C:\Config.Msi\e5b68c1.rbs
Size 13KB
SHA256 3f102f10d65f444f859304fcf521d5ebe38c9f3a71bd078d6ffd1b4c79236aa6
MD5 15eaf488611f09e7cfb876a72f976a8f
SHA1 227556ea655dc4a02a83c1390517a97dea97a24f
SHA512 efcb1be113542e014a9e3c16e475c730b52bf087e41b2f4fc5283841828319f2a96027b459dc9e72c2f50ef363ace2075b3e24a36b5d925fcede2f24ff1531a7
SSDEEP 384:NYLDevQJodiTodi80ehGnyoXG35DvkKhOpBL:NazodcodC
TLSH
T14C524640E05182E6EC511F37536FAF88A372F2DD6B51370A2628C024D687BA9D9AD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

HashidsNet.lnk

Path C:\Users\Admin\AppData\Local\C-Media\USB Audio Controller\HashidsNet.lnk
Size 1KB
SHA256 f1cac595b30be7077bafeaf69ba334ee062c253637e94d587b14daf68cdab6ab
MD5 368022c144ec22181f18310ff3ae7535
SHA1 a852061656776f58b71254f44094046a70819814
SHA512 15e2afbcb383dc9b54db3a7f008366dd7e2f36fe0e62d921c747018120254a782e44c9daa2dc30d6a039a76b45c68344275f80a94fbca4828e06d7973713884e
TLSH
T10B318B1C19CD1711C3B2CE3764EEA321C8767C82FE924F5901D0A6C83454621F8B2D2F
MD5 SHA1 SHA512 TLSH

Submit Download

RecruitmentTracker.lnk

Path C:\Users\Admin\AppData\Local\Corsair\Lighting Control Agent\RecruitmentTracker.lnk
Size 1KB
SHA256 1ea0cfda01bd2eb0c97b100d4b8e6d550e6f5ea753b17218702c3b27f5c25f89
MD5 e0ff4ae1ed7eb3644d95667741295fb3
SHA1 1545f591a980908b496a61b54fb8f7dbf5566b9b
SHA512 dee989c7397a78ce63ff3357a00c8ca8dc841cbd6d7f898115885ef97f745aa2e764680e399f6b69692486f3a474dc542fcff48d7b4400e80090f68ddd0a9913
TLSH
T15D318B0C19CD1711C7B2CE3768EEA322C8767C86FD924F5901D0A6C83454621F872D2F
MD5 SHA1 SHA512 TLSH

Submit Download

5c222fe6-b80b-4ad8-a371-1f8ae3058f1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5c222fe6-b80b-4ad8-a371-1f8ae3058f1e.tmp
Size 141KB
SHA256 609d589b5a63ee783bb8ba211a98be6d1842a8d4fceb6e08fab3bb43c660b5c4
MD5 565feb7f752d55350f993aee604902f9
SHA1 41893f00a872469cd43acf37a1dd2024e14a0783
SHA512 c87c609712ee4829247d02bf718fe83a680046c58059b52b0fe19894b62d77bd47356bcb7b46862e2d6376ceceffa338973d7175f7dca403b89440d4ec53bde8
SSDEEP 3072:d0810YQBYVrtdTCCXQabNtJcp9/Nnqquw1j1U07:x1sY9HCCXF78/9qK1j1U07
TLSH
T1C6E312A2D530FE978DD0ED07B0A01D7705D846C88AF5CD496BCE4DA906CF3FC86122AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e22b3bb-6e37-49eb-9ad7-780256a1665a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5e22b3bb-6e37-49eb-9ad7-780256a1665a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7d0e6962-4704-482a-9c9d-1283737ba402.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7d0e6962-4704-482a-9c9d-1283737ba402.tmp
Size 13KB
SHA256 0afc50c6c17832e451a86fd1ca4e8b2abadf1c3ae3f6a57ec2f2d1f24a3dcd9d
MD5 beb965f8e90f34a14f632f6c07e5cb0d
SHA1 9181265fa8f85e7ea939d6e12f09febd3008e778
SHA512 8d20a68c55827e5d80a9239fe161f4168fb0f03a946b767569691ace1071ffda72ca2d48a02749c86c64666108f1158b04eb98e6e1d9e98723f10ca93cd2b16d
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU3kyHGJ7sXSxbdpiFas:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtd
TLSH
T1D5520A67A84C993F0FD8DA8CCC267F8FADF5025662640D6492FB9C1903957CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 32977505342c2754ea3fa64674e969404bd4b46301bedca0fac53d6d56ac3284
MD5 feb29ad2bde70aaae741e9cbee06389b
SHA1 2afdd3b4955cc4e2385a9e231495696e03ba54ba
SHA512 545e0afa47b3086d735af56b94cfc056453d2d534243a731bc43090c47a9cca72ed698fd8bba6d22c546b7050cb426bc17dfb62668cc5ae21e479ed4f6d4b3af
SSDEEP 48:TeW9aw/aHLopFMavU1iBx2HgvtMfVAXDBsgzOvG:nPareMaZ3FMfVBgKO
TLSH
T1B3921E8E1F342210C0B04A77EAD6085B2E7D111C9317AEA9EE5410F2CDD31AFF5051A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f313b4e4-faf2-4217-bc5a-72729c4d5cf4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f313b4e4-faf2-4217-bc5a-72729c4d5cf4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 72231049e0bc7f38243cdf08b19cac631fde47fa93ca150ea3807b5e753494fb
MD5 97a5869900c5f4862a40d18fb9c7100d
SHA1 f79e10303bbf2880924e394690bcb72ef1d0f830
SHA512 631837bdf6a5951ca12e4a38190adae9ab2c6c54ce694019eaff0361cdef24f50e30793f8823e7e3ea9eaaa288e7eeb69c1634d23dee51fe2fbf2cb423559727
TLSH
T130A0025445C19C31CE90567060B2454222D5482565B183475C997C48F86B3C45182111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 dc216a68fad285f299460cc2a8f0956bdf8c6c4445ef788a5d9a5ee015d80479
MD5 620da80887d38853c53454685ec75130
SHA1 2ea68f24cf469255a290d8a727cef1dd32859eef
SHA512 e85c42b91a0c4dd91059d6b53dd3714a72c6d85991a92a76af372e1483831d841b5915e4ddaa599bf1e436dc370101934414e51d221a91d3521186f31632ec8a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\temp-index
Size 48B
SHA256 7afb6aded8256d8df4f944be4d31507f10906fcd5ceebe11a0543dd02901cfd5
MD5 e36f58b65f01e0c6a2c5aaceef6aea3f
SHA1 f03667910069dc907ee4ef8d76616292519ed612
SHA512 b902affdd7551fe11769ff3ebdb52af289ff6ab6487627c222ad0e56eba8fc021a515ab9d0bebd5ae5f3672aaeb02ccfc439c18357db36c863c5658ee46a11a5
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 1e3c2a4a4c53e8bc584d0b45c78d643609ea17a30b00f12bf87e98eca14b20d0
MD5 7c0b88a02ec29313ce124e6588b7a82b
SHA1 70ba5587e3b3e8379bcc5371871294d4816b5f37
SHA512 c0707abf12757bd164b9af26b6748291bde7fd889b24786ee15e145cf7e6e69e3f6c77101b35d3ac2c1fc6b483a6a8a13714d24d3b3b9978ed4daff562f33d30
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OmHpX6ULqgVum8OrkwkRQ:jeuvBnhJsueMEGvIW1DcP2OOFVumAnRQ
TLSH
T12BD3974B3A747002EDE58A721CE091BB4E3CB16D4F55A5D429B620588EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8d2e0ca-a933-462a-82c2-934061e06958.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8d2e0ca-a933-462a-82c2-934061e06958.tmp
Size 11KB
SHA256 3ad5e25c05d21fc14d6dd62dececb02718d4965203a1c6c52c1bfb2cf0341faa
MD5 565a30ae03fd9175fd1ce32713fc7e01
SHA1 3579153bba90976a2eea950770ea828a94b26d7f
SHA512 4532790e4c91664b2f1a3eafbf8f9f7e80e7c48637837354fa47c2963acd0acaf2b935727f79e1a8802fe8dd8b95676d600823f1353c3af842699f9c7791e6bf
SSDEEP 192:xRWVAUXv7sAPRp2P9bHsb+WNnSR0LxeekNDCI+VyIsnAUge:xRWVb/JX4Bwo0d2CI2e
TLSH
T18932B52AEE10753B9CDBD22AFAA57B57D6F6102131902E84E6FC893C15E76CC721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4afac2c-fb19-40ab-bef6-bd206968a5f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b4afac2c-fb19-40ab-bef6-bd206968a5f2.tmp
Size 4KB
SHA256 ef1ecfe74eda09508a8534e5760b15eb2ac3b567bff46f683caffc21ada91537
MD5 5680c319325c868b069133575c9d0697
SHA1 13260e0daa134f4830fe0ec7020b79ce4afe6e4e
SHA512 ade358bf34e89c00f1c6abc9c019d9f66230da129237e999b2f2f0ee8e0cc1f73ba9d3959cffa3fac8e36b2b9d385cae70d68c967c3524f61a5f4858e07257d6
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5U8DbB6vGyvQH4jYm0bblDv4a:qC0xJPz8/CkqDUDnlfr4jYm0bb1
TLSH
T17CA11931B8695EB784B6D585B2832A03CF64B197F621AFC0B9ED1E1C14F71F81752A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef2956ef-6ca1-4bc4-9148-dfd209abc6d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef2956ef-6ca1-4bc4-9148-dfd209abc6d6.tmp
Size 141KB
SHA256 42d59bf0de4ec11c538d4eb9a46558e575171a73903e02ca13f1098389f43b1d
MD5 9d88673e63e589fa514300d608afdd65
SHA1 d42fec23c31ce9d8bc898c2e31ce2b152762c30c
SHA512 9c2172e1fc02a74868ff37f4fc6d2f84550c729b34febfb5942914cd5235b912826d810e074afd6362573fe42e13bfae1afae0c71d46e30efef242a8d8cc5ab8
SSDEEP 3072:y0810YQBYVrtdTCCXQabNtJcp9/Nnqquw1j1U07:u1sY9HCCXF78/9qK1j1U07
TLSH
T122E312A2D530FE978DD0DD07B0A01E7705D846C88AF5CD496BCE5DA906CF3FC86126AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45ed204c-9e2f-4ea5-8ee4-42246796a50b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45ed204c-9e2f-4ea5-8ee4-42246796a50b.tmp
Size 37KB
SHA256 ad3ac5131d7ebd676d3608d7cda3c81d2e4c17bb332df1953f4aa2eacc9e5055
MD5 2e235cf5806b7868a25608171d65f95d
SHA1 bbe783dd52cd27f9186a97c9b88c4203e9397009
SHA512 32bb30404a97d7f9db9d2d3e2c52afeac1de43b9e7bcace6dfec48514c2357f00fd627c138af5d3aa605e0d3a361c3deca9acd997612d23386a1d87e693c029e
SSDEEP 768:z/UxvxjgC+k3xCiybNbIxOeRFZD1fTos7RzY/+Pu:GZj3+k3xbDEY1fT/RsKu
TLSH
T16203CF39F8D85D378CE6E244B24A770BBFF045B399C91A9805ED6F0E158B7AD130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

741d4326-b13d-46f4-aa07-1ad8061ffe0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\741d4326-b13d-46f4-aa07-1ad8061ffe0b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003a
Size 419KB
SHA256 7f4ad807d568efc1b72f059497cc2b257a6e5de7927b11854d8c36336111ea68
MD5 e3088a1cfd270d695fb728665ab6f8f1
SHA1 1a5696db200ff63ac31c6bfd7dcb7eebdbb06857
SHA512 f98e76aaff6f5321c69d9675b6ae83d3b6ac772575478d9ef4ed6d2ab77efc05d75d71c536a15b566c3692e43b316f5cbb56a262c31598ebd91c2f5d4ccb2716
SSDEEP 6144:/L1bZzUlvxlVfdjtEefbfn6+CK1fcmKLX5h0/oQhZ7OCOOCte0pkoPbl:D1ilvdfBnfbP6voUx5ago0VlpkoPx
TLSH
T1DB942318B9A55C442FE1A2D8C83DD4A941B11BF485CAAC3BFD9B40D2F85F8C336D8B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003b
Size 70KB
SHA256 94883ad5326c0f89665b98c03d81ea166cacbca091953da02a95b40544de9099
MD5 c69e3ddce133f6383e995b71f228625c
SHA1 70dae4adde64fe6db427e7eeb0e2f3d5109e3cd3
SHA512 9a7de75d9a17f624958e52bec93926f8618e25c4b7a8a44d34d3abab73f4baa55a17dea50849d40753dfd06e94f3ec86146b1a59f58b90af96ed8211cd4272e1
SSDEEP 1536:xkGmzCPAZ9iMznoYvMY5W2ZfPl/Ae0NwqU/1HqwW:iGnPAZtv0EHqjwvtHpW
TLSH
T14363029FA2284B69CF6E5B444842AFB005CD785707417BD5A2F670D25208BAFF039DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Size 78KB
SHA256 29c4793a96e142e694842e65d4899d20399817fa4386148be7036d003bb54d94
MD5 b75e31dc750413c852c9071f7f974487
SHA1 0ea1e58e0ce2d7cf4fcb0d3897d00e288bc50e43
SHA512 d86c6d106a18881499b4bd309e2a68a8d26f3c1d0b2f215ae16386cce9d38b6967e9475f4f8b00cc8e8c2faf519c8c485f75e8114745c15b7ecb00392480347d
SSDEEP 1536:Dc0GS9gtMwI8KHenjqAfcbiWzOOYltWfB3KmSbXf:Dp9gtMwI8KH4eA0QxltsHSzf
TLSH
T1FA73122A0E6F0CC0BBB5643EFC1C3B91FC24EB9EE752285485567C3AA50353175BB21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 27KB
SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
MD5 8b2b699d8117447930c6ec35be5ce1bf
SHA1 4755bb0de47453d0c7c9d3554c0817fe43b16faa
SHA512 0ec74a140efea57cfe62e43b184deb3367c941e338a1394a4fc2483ec391e52e9caaf43200c3a970660cdf74a5692a7a083ac79675397fe4cb90b585e3b1964d
SSDEEP 768:tOtXHHGSKIj3A/HUtFb6ofBs0ltoijHHkJtmZx5WOCL:8Br7A/gFb2smijHymn5W
TLSH
T1D8D2D16FBDE86F44943C5960790232E1419E9A70B384AF372175B2B175378AE6783CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 60KB
SHA256 71b10b9fc91d883eb548ebd3d4d2331ff8f8ca965f7e0eb83a032d568af6a4de
MD5 1cb43564ae662faeedee107de26abe35
SHA1 d0c12d788cb22c4dde0ff77cd2843043e129f135
SHA512 99f420021ef6b4c561813fca960839c9d0a7404238798050a6a35497d9905e677e1ae0e5107c447759c85a4ef7f06afd67265babdbe369a50826d92f8955e6cc
SSDEEP 1536:Z3zJPkaf9+6MReUlz15gHdWA7+3XPMJbuD9jBRp6aMnu:fPkQnsem1xPOuzCaMnu
TLSH
T1F15302247B5AC59A81D11F2E8A06974537DC57AAC0FE91DB32C4A6217BE57C0232CA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 72KB
SHA256 fcfaf2e8e1a5d8cff6e2c7736a10a6a3faf27d4696d5d4bf1e2d34cf3512b5e0
MD5 e23f701a0478bb09e5547db5f18b17de
SHA1 cdff049aee29553f0533f7d692d37fae129b7a6f
SHA512 370329619cd303f5ce5bf42692bed1ef7f8c04f4a26181ad42269ac5f6b81fd1ca87034a629b969cffaaa46a626f1eb60fb70e71dabb9f11148b5cd038bb6959
SSDEEP 1536:SVJ0GggPe5RTRIY+6gr24bw02G3LkxUsljvsEQ+:825wY2K4bw03Lhs2y
TLSH
T1CA7312B9871A01B55393D610C935859E3AAD5E1EDF02F85B3FB969A8B08F1B1CCC0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 16KB
SHA256 8463ed535eccb85e24c0d668a6055b3148777528304e8c9f8d510be0628c0467
MD5 70174baa8df618959b52d33daffcf977
SHA1 0231d481756e7ab0f2981cce9188f5264ca52c24
SHA512 6868981093a1a62be90e19d61ea7707a1339e948e8c9bf39f9f32099f30087645cdd373f51538250db85c224f3a9722968828e1efbf1dec9c240cb41f9309f12
SSDEEP 384:wj/7tiSG1hvqvic6UGgrauZoMYVT0BxzEFz5Sdf2/fIGvUP:wN+qvRxrauUVTsESdf2/AGu
TLSH
T12272D07FCD04DC51F328950E8D442896C8409CBEED9B7FA73A6D1B7AC8083D7C28568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 39KB
SHA256 cbf7daf19b2778e1670b023b476a93f320eb777473f71ea9203fb06f44b16e70
MD5 4b4fd1bd5472daccdcf29b59d3d26efa
SHA1 c996c207f74fe4c7d3f5d033476e96f4b78be829
SHA512 e546313064f38557bf111d420b16c65060d6db7f1ff087eac070bf9c551d7bbfa2cb5396c0f3323ff1d158b8c04d59a2cc3a96af8044f063337bfd339bb1d247
SSDEEP 768:Ugq7T0EvIuL89k+1eqY174K+aCCu1TlK6YIQclYb5JeTswJy:k7B78XRY17B+au1Twb3clYb5JbT
TLSH
T1ED0301785037BE85AE1901BB30AABD42974F952B52C3FB91BCDCC7B47DF48991070489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 16KB
SHA256 d237f87d6adc74cdea6630d818ee82137d7fc99d93571df1858d296d42a2cfcb
MD5 13f06c0e7dc2508d27f6c50b9e407014
SHA1 5ebf4bb90311a83ace7bd4ce64f95f2b7004f144
SHA512 67d199bbeb1efc68eba1147970222c555f288ac42202edde1a197492039f8142311faf79713a60c1eacee3a36c1c4a44211f4f4b13d22b3ee19da04b062c6ac3
SSDEEP 384:NSjtBb8riTj//HiT1J4CqDmyljHaRIyfffEn+N4Dm:Eb8riTj//ueCqD1Ljyffs+N4Dm
TLSH
T11D72BFDBFD1B4F280BD24DDABDE152B44177BE994B8990426920C5E0BE023A55F1C3E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 22KB
SHA256 059510e915ba69c966e28a1d03a837830a76deac44b69973979f9f904c0745f6
MD5 d267abe698f598eda90764bbbf94bbbe
SHA1 d5b66346e0c3764fba33475ab1b317994ebdaf22
SHA512 551e07c5beecb2929de599b6afa9677c09c1fd2815778e0955c6dab74b8fca58a9842673f65a883ad7915c2a7004bcc5346729b95d30ac32f3905db602849111
SSDEEP 384:qPPrPD3tmjIzpenAtmXffJS0YxS+1Q5ege2ZL9Vi1NCeXvv30cf/D37:qnI0zigm305YoQfvZ/Q/Xnkcf/
TLSH
T1C8A2E16EF9003E351393C9C558659C79632D11BFA37AAF412431B41DEDF72989A2C81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 20KB
SHA256 65fd7a46faaad39f3604e01ae2bf672f26cb0e7175056c4e486c06bcf1fd47a8
MD5 8ed38698010e3feb2ee2de270cc74a3c
SHA1 3ae25e0ff6e35c4cce578cb4fa7cf7dfdfa296a4
SHA512 97c3cebdeaaf77141fc5f430837b3df822f101b18178f9a484f3136f305c59882fafece79bb6f7fc19a014fdc79ef756a4c2f56b47eea32b7ac27232c47ac821
SSDEEP 384:GdhlfWFczUPq1uMFhT5ScnGhCX5qQnt3EwRqW9fRvlcyGc8PqDK5zGKrzSF1Aq:Gd/y+1uMFR5ZGhCJqmt3Ej6RayGc8CDz
TLSH
T13AA2D052F31B3E0044DEEFD9700E9D952FEA15E11EA1455844B31C92B9B6F3D62160F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c632015b-9002-4aec-bd4e-2e92b8f43f02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c632015b-9002-4aec-bd4e-2e92b8f43f02.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ba12d939-1d36-44c3-9749-e539bc4afc9c\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 375B
SHA256 8312f789aa67bb21bc031af46496c41f7d402c184a16e861c3eae07c61b14e51
MD5 4b4cb71d0a39954c0ea8dd6b28d2d431
SHA1 2b9c09e08246b54140db320a63939c7403598f2c
SHA512 0502ea8d9f9b95a8be899d46bed6279151213cb4434846e4758a57ea517193b9f40e5194361df5ddf36c738d4bd6b48387593c2e97d57effaad1b86b40c3c553
TLSH
T1F5E0C6BA2CFB1C10ECAF83EA343100A902167C9CCC46BECE200AF2CB20B13013802C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b349736e27219b6bbd9dcda0939cc4fca9ba3c0541f0929415f49e56766633b2
MD5 f4c29cde6d682c47879d8726ce24fb86
SHA1 88c42867f4e19a23f14c4c05c798c730f8183ac6
SHA512 90881ac51498ad0e7e1660f681314acf98dff97dda2c0d7fa713a2f53de6dd8ba8fe13a1a6ce90a81fdbc53bb519982e2da3763783245fde84ed7b60ff4f3dbc
SSDEEP 96:Ku1Q5VfHH+VX6lP1+KnLPT+Ld1yDFfmFKK28TodC+oSyxfePs1GxKt41IxRQY3Gv:h1Q5VfHHWX6l11LPTqd1yDFfhaodC+o6
TLSH
T12091422031BB422078BD365881B9972B465271B37504E92B7FBC91678E2FF045EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0c04d0a-9809-45c4-8d8e-37886fc78177.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0c04d0a-9809-45c4-8d8e-37886fc78177.tmp
Size 38KB
SHA256 e737a71a393b0649fa90eb2d5182956de53fcdf9cfabd5cd9484f1baa39a0f14
MD5 155be2978fc8c0f6a4691b561c8eaca2
SHA1 1e354911c8c1ecb92361296fa7f789af5fcac6b1
SHA512 248dd4b477bfc9f9fb7792b2ad84ad0189e5fc9e1cac94b37f03dd3eebdac6acf4d1d6c75d3cc1ff96f8b3ae16f9da90512f25dbd38d704c28e42700c29a6307
SSDEEP 768:V/UxvxjgC+k3KVjybNbItztuOeRFZD1fTos7RC3/+Pu:4Zj3+k3KBDVY1fT/RIKu
TLSH
T1AB03B039F8989C338CE6F244B24A774BBFF015B399C95E9855E95F0E0487B9D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17B8EF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\17B8EF8.tmp
Size 2.0MB
SHA256 8c4f6cbd7d8ac6293c6ca9654049b52c9ad70a4e0af9d0dab7baffd4305c14c3
MD5 ba0e411c81c2636427bbc40a34ef705a
SHA1 ee53a258e9c7854370340e0167ec3bb2e705e516
SHA512 8b940f0af33a72449ed5bb9905bffa9a70b64002d8eee123ce402a49cb43b955b5d20a3c95af27ea304709e65fefb0b5de271b312066ac5a47d7b489e4148ec0
SSDEEP 49152:+AT8C3C4082WswDhA6d1BjnLDGweUxq0g5qQ7KRZOlkD5mUi6:+SL2WsGFdvjLDeCf6qQ7KRZOlkVmUi6
TLSH
T142A5338B7723DC763C2AB5F7097486F74822B9311E9A6447D8BAB850E35E070F3B6542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

542B6A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\542B6A6.tmp
Size 40B
SHA256 f6ffa0d5827c8ef859ce88f33cc1ee99a976842d3afab2bc3863fda13dda7f08
MD5 d8083241064e90d9667d1b40203b4b2f
SHA1 cd60a753ab564de8ec8021985f41764fd70992c4
SHA512 f7d8bb110e4267a35e56b2c3d37b80aaf56482ad3e277ac1dd3af709df46fd5be8b0e2ca79d8cd9d879ccdf1df43117e79066286a81a9750cf10d84255b13b92
MD5 SHA1 SHA512

Submit Download

8218bb6a-cde9-471b-81f3-65a6cf438029.tmp

Path C:\Users\Admin\AppData\Local\Temp\8218bb6a-cde9-471b-81f3-65a6cf438029.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClMeta.exe

Path C:\Users\Admin\AppData\Local\Temp\9cv9bcyzdNKdrdya\ClMeta.exe
Size 116KB
SHA256 f83c684f7e219b9170a31f0ca3fbdaeaebd8ca9315974a542626a1cb79b20850
MD5 c0ab8c5258a1647fa98dcc6b91b99265
SHA1 552eb0f51fc5c1fb89bbb241332bb9abd155d463
SHA512 40fd1629e3fa265b6ca7fbcae41e5d887da283fc4d00b858a48bb4d6da9800e705a503be8341448d536286e3e4ec9f31a30341768713fdc8af6dbd3bbb3012f1
SSDEEP 1536:4XKm9bgVjjywblLG36/rFObYjzuo1lEtHl+4K+z0AIzx:yPbgVj7Z5jFO5Gn+sF
TLSH
T195C32A8A23E804E2F1B75774C27AE532E775FDA22962D70E0752D65B1F233909D24F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SfBAppSDK.dll

Path C:\Users\Admin\AppData\Local\Temp\9cv9bcyzdNKdrdya\SfBAppSDK.dll
Size 12.2MB
SHA256 db3410ddc4f58647b131fb2666727ce1d8c61c93df47632da4d906029fddf24d
MD5 f23d4bf8d6c250f4b20b58f8073e0f4a
SHA1 907f4f71e1616f447b6fd6e25e9742ae11af6ad5
SHA512 490241170d44c6537205f750072e430a6714f3d38870d8c0112e90bf98d72844e33001328be6867bd1eaf35978c0740fd322f1909ca1d597fcd781be08d70aea
SSDEEP 98304:5QEscqtUdFwjSH8TdXAd+3WpIeMA9bN2COzr9fLMURSi5Hv:qgqtwFwjSHuXWJMAizjr5Hv
TLSH
T160D63A9D6398D0A2D63382B9C75347D7A133B8B1DB378E7B8066786D0D3A3B1572D860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\9cv9bcyzdNKdrdya\VCRUNTIME140_1.dll
Size 48KB
SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 eb49c1d33b41eb49dfed58aafa9b9a8f
SHA1 61786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA512 d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
SSDEEP 768:oPIyGVrxmKqOnA4j3z6S2X7pudLAivD9zigElY7ivD9zG:XBr87uWFLpudBvpziZ1vpzG
TLSH
T176236CD057784082E9AB89B0C5E6EE577D7CF6A20B50968B07A1D1981F637C0FB3D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a671f84f-141e-4072-8558-895f4b3b2620.tmp

Path C:\Users\Admin\AppData\Local\Temp\a671f84f-141e-4072-8558-895f4b3b2620.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb726e6c-7cd5-447a-87a8-34d90d547903.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb726e6c-7cd5-447a-87a8-34d90d547903.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\data\saves\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 580KB
SHA256 c1e8a0d7efe1ff0a6f9e1125580561d5891c0933c751f8d112ff37a874f7f9db
MD5 6fdc164df8474ad2be80a80fb4dc1ccc
SHA1 4901cae59207da10744f6c4f08608aaf6ecf1f73
SHA512 fdcbf4d29688481e866533a723759855b509f816c0b2f19284929cd7401dc137b120f2c1df9dee93269a1179190f3cad4bba9fd927b14b4570ac814dcceded98
SSDEEP 12288:4DKU3ZM9JEJlCCbMOlJOWvNbJaiaW4nez5QsdVVscfu6ws11XuSxTt:4eU3m7EJlCkMgNldmjL0fvfujsnu+t
TLSH
T156C4F1FAF7A07CA3ABBD030B9DD66FAE07524526878EE0CC447767C2455732AAF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4320_867112027\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4432_164039133\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

TurboV.exe

Path C:\Users\Admin\AppData\Local\TurboV.exe
Size 476KB
SHA256 324e2f2241604e53b88bd590213385abbb2961d3f17debfb4d40e4fa7bd9c4c0
MD5 f09de920780e801fcdf5eecdf85a68f2
SHA1 9462faac0a1c75664847c2591a10bde7266fde65
SHA512 b2c208f57f4999782d0d4d5ba5ac0143138c6e32b29a2d05ccfd1356ab6a3114b9e6d5fa6e90ca4e80ee1c5d23c4cd59acf01e2ce5c7b8d5bc8858fa5ebc0317
SSDEEP 3072:pCHJw5UiDVQZYKrt33HtE9qmDoOAg0FubrAzs4Lit5Vm:praXZLrtHteAO/MNsV
TLSH
T189A44A1175D2C4B2D5720A3108E4D6B56A7DFC610E218E7B73D97F2F3F742829A31AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persistent

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\persistent
Size 1KB
SHA256 e612d93714a00b966bd5dcb3ca121aafaf4ba38fafc8642d6323fe0326b25e4e
MD5 54c2f86ad85161025d4c06908b572cd8
SHA1 42d24822f2076a104bce785e9fe3d458aac8510a
SHA512 f3490a3a1cdc11207815259fe84314a7eafca69dbe8887282bf96c2e716987bd8fe4da5808ce9f0f70cac6174c94594730fbfb09c991a9c6f43685f3ea218efb
TLSH
T17A31E84AF2C613D60A45B4401354B596970D64E92BE27E18EA2270F910BCB4B03DF83E
MD5 SHA1 SHA512 TLSH

Submit Download

8QnS9Smpt.exe

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\8QnS9Smpt.exe
Size 8.1MB
SHA256 2ea9dc28ca2aa500b7feb0c794d6b1749f59d6c94069c26276117f89cd1c78b2
MD5 783a224beb8d671519469fdd1f01e084
SHA1 9abd621457da307c68350dd0562067ebd0c2e6ce
SHA512 a84d07f229b6583f8e7a3593c5c2ba4c1f4b77ab80f1364f3c081adcfbc5e82a67462d1827af86470b832bcee3cc6d90c61aa172ff028823d4c3462df83ffaf7
SSDEEP 98304:ynfkrBqrGLj5C2/wbAEaJijN2g7SHFo7bXGh3aT2fOYvbkK1Cvg:yMr0i5lIbAGroo7bXe3G2dvbkk
TLSH
T1AC866C46F6A001F6DCABD574C9069623DAB1BC451828874B13B0FAA79F33B705E2F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Graph.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\Graph.exe.manifest
Size 842B
SHA256 c7124bf5f44a11eb27e3002760c08a618844fe8488db8e78dc1528396a61896f
MD5 bb8b0008a1f68254d784c9a99ef0fae5
SHA1 d2d24ec9e23d80caf43495b1ac7d8db3d9d0b343
SHA512 d33e184aa3aecea8892247b7614a8c68d3f15d2cba905ff7cc4216d8a6550e29acbb572c161c513478fab02487584743ba137159f4f72f2f966fb50a82445bd8
TLSH
T19E0112C1E11CA6A5974220933D32E104A53FAF2E1AED45ECC4825ABF6602BD9AB82161
MD5 SHA1 SHA512 TLSH

Submit Download

LYNC.EXE.MANIFEST

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\LYNC.EXE.MANIFEST
Size 1KB
SHA256 99245f16ac2f6743da84bf3426a08385c0aa099eda16f722a28783b47e242123
MD5 83de4ede068cf351fe6895ae5d6c246f
SHA1 d809b0dd386ecb970d9b14fd317025e4d3863a7d
SHA512 156ef49f83c94b19b040a514abca0182e4ffb4a0a497aa9e736c2248f75e814fe3a96022d6008dbb77f13cd57434a7ab1a898c11b717b838e8e797d58e806cb9
TLSH
T1102114C1D48444A5937110A23651F304FA6947AF199E44BCB4CC8B3F7F269D6C3431D1
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\MSVCR100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUTLOOK.EXE.MANIFEST

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\OUTLOOK.EXE.MANIFEST
Size 1KB
SHA256 b114277e74126b7954394db205111389fbcae66637eb128109d59128261286bc
MD5 53ccae732eec7d1c64ae2e9494a281fe
SHA1 53e337d965db7f4ca40c0a1db6c1ee3480b2669f
SHA512 186e0ced89d5a8ea468865606cc17ac977e5aa0fc6ab90eb7c6a1b658fb34ef40cc7967de86c781c132bc5856b2db1fabbc80995bad4a596d0ab1ffedac3c2e6
TLSH
T199210381F018A665934310D32E7BF280E47F6B6E19EC41AC80819A7F76016D6D7831A2
MD5 SHA1 SHA512 TLSH

Submit Download

excel.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\excel.exe.manifest
Size 1KB
SHA256 366a98a4974c672348ce5a529008e0f0840e06262f1c9b30910258266574a2f5
MD5 6a2da43a9ce3544d063b0695903508de
SHA1 42413f904c6cff3c62e2af8c1766dafc3ef94136
SHA512 198daff30b1b76344063ef6627157762288490cf055e6317c6413bbcf94b05922f2d8df65f8748d24f8834acbeadbf7b5f22661b3ba86aa5aceadc60cd00bf4f
TLSH
T18111F0C1B00C65A6A34220A32D36F240A47FAF6F1DED41BC80C6997B7601AD9E7831A2
MD5 SHA1 SHA512 TLSH

Submit Download

excelcnv.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\excelcnv.exe.manifest
Size 1KB
SHA256 a702fa4c3b7fff0f7fc9204bf6e23b1d2d423a835bc4f6d5ce485b8592319b32
MD5 5680fb6ff1f8ef8ea586e8f9207b83dc
SHA1 8d3d3798a2cfb5cdf2b3ce1af7485cc9efee09b5
SHA512 f9239311be05347979f9ed04253d88ab21bca30f49f4b1cb74fdd8ed5b334c7e7b4a8459790bda318e1e7f337df915a7a9d358fa48c7fe05dca1089d5f0c2538
TLSH
T1B311F3C1B00C6595A34220632D36F240A57F9F6F1DED41BC8086597F7601AD9E783192
MD5 SHA1 SHA512 TLSH

Submit Download

frame_io.toml

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\frame_io.toml
Size 30KB
SHA256 12e8ff2fa05ddeecc539f1e4f0046d3e543c7dd6875936dcc0c774d7c02399bf
MD5 c9de020b7a18b4f5b5ac7c2115ca045c
SHA1 d15dd2c2c48340382d2ff2b52d2da9aee1654489
SHA512 2af29f127ce666c578e2c9b086e377d6f474de1d1c955b44faffb615d2e14003921480ffc9e5512fb5eb283af82caf20cca0f1c1d683da4c8d00f5875055ca49
SSDEEP 384:4a9LmCAchDODdwuvfZiDafpnMyv5DjDx70QwKrRHa4AUITfQQgtTBUAMJTzOUwin:EzdwmZiopMyvdx70QpHeUIMQ2i5wiEhU
TLSH
T1C0D29F77DB65792399076A6EF61121E2DB80BDB63B0E3090F5CD281B3026C94D236D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msaccess.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msaccess.exe.manifest
Size 1KB
SHA256 32895e090ea77719d78c3fbe140d33b44001d11ba725c537ee1d5d055e745ebf
MD5 27a313a6dee9072acb5de6e1078065e7
SHA1 05174f5db75acddbff0f6e95914190aa80649ace
SHA512 12d98261fa0ecb35753e755023b97bd24efb50c0dd28218f07f9549d1b4a4fded92918b06d97c1f00f3031a1caf2c6f465c46a406854ac08dc211678f3ba5d46
TLSH
T1B131C082D004A565F75310E33ED5B768607D2B6F08CC97B8C890DD7F5206FCAC7460A6
MD5 SHA1 SHA512 TLSH

Submit Download

mspub.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\mspub.exe.manifest
Size 1KB
SHA256 a334086431fd3e5974c5a5239ad7c45bb2ffb128278551c09f70a21d35e27358
MD5 66ae4765e9c554f1c36e4c84b514fa8b
SHA1 a8059d708dcdb8e64971cad6e60cdee93b8888bf
SHA512 b9b32367fecf83130dd9df163ebd61931f502cffa2616cb87452b5232a6614f863afbee73e32ad19a6c7762d9bd11104968695935faeabfbf46fff23aafa6caa
TLSH
T14E11F3C1F01C65A9A34220A32936F244A47FAF6F1DED41BC8486957F7601AD9E7C31D2
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp100.ucb

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcp100.ucb
Size 593KB
SHA256 5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
MD5 4f096d96285e06cd51aef7d2d3de04da
SHA1 c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA512 80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c
SSDEEP 12288:uoBFUsQ1H5FH3YUTd/dfePA7XrNvEKZm+aWodEEGblH6t2:LFUsQ1H5FHdggrNvEKZm+aWodEEIH6t2
TLSH
T143D41A23FB2906B0E162D37C65D6C341D3F13C8A4B22A7C752ABD52D2F276D9563B221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.ucb:Zone.Identifier

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcp100.ucb:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

msvcp_win.dll

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\msvcp_win.dll
Size 626KB
SHA256 d7a3b77b3490745dd4f510ff186a6756e12b4787c2dbf75259136f2fcb2d02b9
MD5 567a7e4cb350bb79a7dc51144d96e624
SHA1 3262a45d62c3f52f9a329a2707c10bdeb992d143
SHA512 f85588611922065f4346755b53493f065451cd21f150ac80bd400432bea18cc735f28cddf1cb65b45e737c83223f5e5e9549e0de13da110f3c50c86dcca4535e
SSDEEP 12288:Q+TTIwt0B5483RXXoTkni5KQEKZm+jWodEEVUsS8pc:Z8wdKnIkVQEKZm+jWodEEmsSL
TLSH
T1F9D41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oart.dll

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\oart.dll
Size 20.0MB
SHA256 eb9a926f41211302a77d493135476ba28b38fd41e7a0f67bc66b9a56e70242f4
MD5 f47d5bc87c7ddfe73963dbf8397b46e9
SHA1 fae38194d91b07a828d2c50823925114504a4829
SHA512 84ccab12a5c966b8f157a0e638ec9839afbba59cac92971112655c60fee0f74db3571d483219918f0cfaca4f0944f2cb6da5ccf840a3c55809b8e17727398e9c
SSDEEP 196608:3B29UvVDA7B5i1rW750UyF8pUhUbzECaGU2+rxbPZ+kMiuEfW9ptTK:g+xUBg14kKp3bYCaGU2+rRPIauEfMF
TLSH
T13D275A8E3A6041F3C59AD174894BD6A3E7B2BC815C74970B02A2E65E0F377B1AD1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpnt.exe.manifest

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\powerpnt.exe.manifest
Size 3KB
SHA256 9c3db334787e031d0d73ceba16151a22565f20653d79c141233805ab1dfe450a
MD5 fbeb2e2d7f074e84d581fed436220daa
SHA1 9c61d3998849ba85fa0ec15c3e8e1ef6055c8550
SHA512 15383897d6bd4af8ee8b0553c5b9e68fdd25eecc9b1a444df644db5d1f0ffe3613d40070e941e4a294214d535fbdf88842e3b5f215c0f7f3f415eaaae0d40fb9
TLSH
T1B571DE40C484A3C89DB544817BA4C62CD48BAAC9C48A4DBC34BEEFAFCF78451D9D76D9
MD5 SHA1 SHA512 TLSH

Submit Download

surfacemod.ini

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\surfacemod.ini
Size 1.3MB
SHA256 48cf4a3e71091b961ec8414f5ec486260f77ef486a82eb4ccbb79acd124d6176
MD5 64091969cb2ec89b867733e473bc0bb6
SHA1 6817c722ba94b7cf1f8f27f546506dd7f6b41cce
SHA512 de8355c8f0e87f68e86cd00df8c1d2cb78b06d541436c0de677ddd0a6c1bb98597023a08b7ae8124892e85011c9e41e4273e3ab4f03d1e9be494d16ccd3f3920
SSDEEP 24576:95au/C0/sV49YiCKJ9fuXLHw3685NB+xb1wE21W552Kms:qu/BiRzKHwLHw36W+xRwrWZms
TLSH
T1465512E07868D896E533B03D41D979A3F0177AF87563B2E944F1991CA60AC93DE33863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\Downloads\tmp-30341-T2f96ClxUOEG\ucrtbase.dll
Size 1.3MB
SHA256 2c08e77f86b0953cffa505bdbe64e87ecb7c088db65d5acb9a2eee65a32565ef
MD5 81a08ea850a35a5efcfe54864a51cf6d
SHA1 8089a77adeb65f6402d2c6fc2cb76d7bbf102e10
SHA512 7cd65985cea38c3e1b8b2308da5ea6d52c657ad259edac47ebcb23d9f54df868ab3571ac25de12b8e9b52abc0711cce68f94b811445226364f998384b72950f3
SSDEEP 24576:W9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszORmxvSZX0ypapJDBHd:W9KpUmTfFqSgdDPq3DjqI08LupJDT
TLSH
T1FE55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 2b7c2da827db1672945e82a49362dbb91983e8c0234144c880dc5cd52102a363
MD5 2c4d015269bd7ed3fefec9881fe904d5
SHA1 bfd6f1c5d92d8c23165b9163c200a71f0097fee9
SHA512 7676a623d264cb36a6e1bd6a2afd96d28d7b284bf9849629fb46676b1a0e9ba7bca7a07a789cbe46b37f80b81500c79db353544000b28960f79f21b90b0b28f7
SSDEEP 96:T5yFM6Z0yXKmvgkFxT+mRzl3nyu/XfUBobllz:NUM6aiKwLFAmRB3yu/PUyblF
TLSH
T1D1A1C85BA97849461731E6E61C0B339CB0137007CEF0DE6CB1A9DD6186ACBFE40D7A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 74KB
SHA256 1f04c722601f5261b05605aa88ba34905181229c100224c5dd17d8a5e49cc4aa
MD5 def1e93f504905858c75044e885708dc
SHA1 734a1eab7cd7533afe02eae91cff1e3e7f5ba029
SHA512 2a1cfe9c80f125716261cca4c311bb0f882e0575f9294341a16070aa9123d6bd635048f31841eacdcd574ff94b380c25ffb10f9e6146c0c55e53f52fc274c453
SSDEEP 768:7yvWHApFYckM70fDlj9OVH40mLV9c1cMCbM3lwgRLAXoa:GvWCox9+40mLV96cMZVwgKN
TLSH
T13E732BE356A9B1FB0B9437CB1C0BBD5B67E64195E38601C9ECE9C51C80CCA94037E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 b5af2c2ee70fcbad32800ad10846ec590faef5e549956815539045145f74e7d0
MD5 f2b6bee899e346ee2d4432965c9974bf
SHA1 ab90979a1c5feaa55e9d0094a8410a2232e3661c
SHA512 b0900c0710eae1d4bc3fc5c69ae9543cb56aa683e35062be8e17b61c0a81c17427defdc5ed76225ffc437ec78814f9e0310eddd5d1ab2253934efd22ce409f00
TLSH
T1382126A8184C1931E5A5781A2A4FF701C7F1F266DA40AF6C9AA91C284CC74F4936152F
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Public\.ff_tmp\addonStartup.json.lz4
Size 4KB
SHA256 226e89423f2a4a0bb8b2138091c6598dc4bc82559a1e70a6321ad27af60d6b3c
MD5 ca3ffa3ef4231b916e25777f278b0a95
SHA1 70606e5c5cf0be8e086b56a7abf7e01a5aec5209
SHA512 dedca2b85b29e182d57e381b0d801482a05fd7aa536b7df1cf4db5b21140df2fb87af1d14413ed3fb77013199de38dfd4c89b89e51a74a8dc0cd8be65798f5ec
SSDEEP 96:GOxNnsu2N92xWZbhD4oMgGimHJeyFNO1u+8TXqYjnr:GwhC2x2bhDvrGimXA8Txr
TLSH
T1D2918DB6E549FFD2FB36C08AA4D93F30D2EE5BB820789531F0AA62194C606E15345340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Public\.ff_tmp\addonStartup.json.lz4
Size 4KB
SHA256 0caa4ceab735f390e18bd0bff41bb13a1756b2fd16a687d654de79253d6cdd43
MD5 5e15fde1cd4a98a622444324522f3311
SHA1 5036c038d08dbce47ef18db4ffaf6900673682b5
SHA512 b726ba85f85f162ab0512895a8c0cf8ba0d42b3f6384bf87f62244d4dfeafd282adf40198defe80f27adef7c4884539786ba2f8592eceb4d275f2dd081850627
SSDEEP 96:dU55sWNNd2xWNhD4fMgGvmHQ0FVO1u+8TXqYjE2IXR1:dW2xohD4rGvmHA8Ti2a1
TLSH
T113918DB5D949FFA5FE37C08698D97F31D2DA5A7420AD9431F06BB2054CA0BE26786300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Public\.ff_tmp\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 a5218c23cbefcad82c4ceee31434e6b861901d2ce2e9f38440215f3b5f6f5f49
MD5 6cf250ac8678bb4219c838ce6613b673
SHA1 596cbced1f9af874449fd87df9c4226e129117a8
SHA512 a87a362ad73e5fe372fd2efdbe2f0abaa80555d7dd6b1db9ffdd31e77921fcaa576c84300d8df38280888cd65929867ba8aecbf696741c4fbe825cd5e5ef248e
SSDEEP 384:HGNQiO024Y7WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA6:mDZY7WTToXJWTTogB7S/AmVAf+hRMH
TLSH
T1C6728D3D8F013CAC275780E9C8B583598D18B6A7DFE5C069169C3D09C98496A71F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

containers.json

Path C:\Users\Public\.ff_tmp\containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
TLSH
T18901D1364507546EB3C503A912426D22675C60B1D71EEEE9E8360A4E4ADC3E6CE31BFF
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 805B
SHA256 c169eeb2507b598acacaea0b586895bd91dc65f9e8ab4433abfebb1fd826e8cb
MD5 a6951b612c78b7f18370b92c8086df20
SHA1 5b1458b9aff6d6b89fc93e34988daa2d9396d109
SHA512 7c2cdedcaedd5a02e87a00d0500b683d3583d459ff2789079b645c4090bdbd3ac0d14c43041de7718595c81127956b210fba093f1c9aca86b189d741b79ca66e
TLSH
T1CE01D188FB24D136E448D33ECC42AF128F306021E88EFF21306C610C9E1961972AE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 4ca2f9ea7e1ce8b8033c0a21b67389ec8b207470371bc066b2b50104c181bdc3
MD5 b06412a89686b570f44159170d22b675
SHA1 879fada0116e8f1894f0bd3a4e0919d0d187d4d3
SHA512 6ea72678ca63183dba71de27c4123a5a7c085464de475d349d8cbdcfb01a6bb8f46a25840244f01d6f1301b61345f1f548d57819188ff4a93e09e62060812b8f
SSDEEP 768:rl51QKSw9NtvBxGcm+u3Lw/8GkbUbaQd5Lk1CLf:uKSw9NtpWBQd5Lk1CLf
TLSH
T13BE2F044EB1A953FD41813BBDC954B002F79F889990A2FA73A4C64786C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 07900cef0d5c252612400daae5e51b9738ea8a207d2928a199fabb0ce8d566e5
MD5 75563d43dc73a692d35e9a74c0217e58
SHA1 89ed407f2d509dfa7698dec9212fa315e556a912
SHA512 717dca8c8e54762e10fcd305d595c639b02b91645e5e9797ba57efcb58fdea1d2405b9c463f7bfb38b6cb81e91cc055850bfd2a6d40900fa1f224dc715ad60ae
TLSH
T141518658E7298A3EE044813ADD56AB009F347415E46E3F2B35ACA14E6D0B3DE368D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 feb746df53414be1164fbc3f33af4318dc3f26e649d1810e1eaf42f277843069
MD5 07197ca30a4a506e1de57604174c6eb5
SHA1 bd6197d5c215873200dad1e6d2c3f3ccf7ed7e67
SHA512 c10f9cd1379c08cf41fa0ee85db47a032c6f7d92877bf8b8829c410020bd2700df91361eb7752b65811a7189bcc3e588efb5ca4c42834242316e308b7e4d0794
TLSH
T1CF518658E7298A3EE044813ADD56AB009F347415E46E3F2B35ACA14E6D0B3DE368D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 a05ff2cd4d148447849504db02945bd39c00c9adcb80049ddba7a11cba734c6a
MD5 eea033d567380fe58966bddf2aece6fd
SHA1 4fb9a28ed57eda8385667e4ceddc3add6ac11e8c
SHA512 8b344248becfc697361e70120dae53b03f0ade1bf7ea81631da308565a8081c52b2d097ce904c7d9acd9fb7a1cafa8095453f1e10c48653d568c325024df8bf1
TLSH
T19861CB58E629863FD445413EDD665B004F34749AE86E2F2A31ECA44D2E4B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 62838787b90df3b39cc74c268eb4344cdec7045822ce8e0ffe95ffb7b184563f
MD5 3a027118f88c302a7b6d6008734b7db6
SHA1 540c00a5c88fc25c32795a770a8555aa398a5129
SHA512 6a47b0fc487e98dcb43995f2866d889099fe09388ad85085f7b22a031bda361260f8494030b8450c8ec79e788716b1b4f8a825629dc816fd76d497f96137d373
SSDEEP 192:ROv5zbo8spEyjmOL1d66JoztdzgCl6mBM2:Obo8spEyjjd66Joz/zgC1O
TLSH
T1D0D10DA4EB28867BC404427BCCB61B454F76389B984E3F19359C75482C472DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 49ddfb6b2e8c3944ae6ee7af2256f0b49686348490d926e558f850503653ea3e
MD5 bfe3be586f5b9d5ed97b349821fc74d8
SHA1 b2437450cc9dbdc7221d32fc68d6a745ec0f67bb
SHA512 9b3fd4c28989916f70f9d5aaa3283bff5e9c7707487fe42ea1336022f98c745b306bf4c0b226ff274961b07eee32f1fd348eb03a84c40f238e1d3c3950177841
TLSH
T16B819768F629863FD445423ECC665B004E75384AE85E3F2A31EC744D2D572DE768D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 6eb00ac9bf554139a29b4e14bc17ffd594343a4616f14539df4116a08f90072e
MD5 7044f10a66248f25a7f8a363cf1f2235
SHA1 5d2f1d3705a977c4a552492f913706020aadfb75
SHA512 e8d23ce1ca243b68b065c49fb7ecf77a2bf2387000c6d62b6ed82f650c5fae6355bddb0c62eeb72c7794458b80a8a4299247cff56df94c5b1549eb6bd29391d1
SSDEEP 96:ESdF95/7bkW6ArlyUR6WxvW7y7W/dd66JoztdzgClKtmBM2/O/:EOv5zbo8lyjAOl1d66JoztdzgCl6mBMl
TLSH
T18DB10DA8E628863FC444433ECC611B044E3A385AD84D7F1A35EC74583D572DE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b1b7b5ef87b405505b6477dd4a6231da4703208101d1d1161cc4ff33c08eba29
MD5 0f1ced091ac3cfaf10f6514c69a067e5
SHA1 1dc40a87ee80308b3d4ba14db3cd0765fe51211d
SHA512 e4f9c26c1dd7ede2f1a05de90885011f4397cc3c74ecb466d782b2530574b35b7e5867688545d39ea725a8e2f6e4676ffeb8129329886d5feb5c3dae9a19581a
SSDEEP 96:MWSdF95/7bkW6ArlyUR6WxvWKy7W/dd66JoztdzgClKtmBM2/:POv5zbo8lyjAOw1d66JoztdzgCl6mBM2
TLSH
T1C7B1FBA8E628863FC444433ACCA15B054E3A395AD84D3F1A35EC74583D572EE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a937869901beb40d98c2e4a189c33ea11de151d5f7d96344253446218d44f60d
MD5 55a85dcf859158e74789929239f129c0
SHA1 6da86ff43db38b177b51a317a8b186f4a9f55e60
SHA512 b40b5a9b993f4efa76b0ae7ed461243a7ed2509b1083e487869870032b000f9f6b958385495272fc05e4a3ca53374044e52b524e4c3bb151d695845d88d51916
SSDEEP 96:iy7W/dd66JoztdzgClKtmBM2/UThKSdF95/7bkW6ArW0wEyUR6pCxvW+:o1d66JoztdzgCl6mBM2pOv5zbo8WpEyo
TLSH
T1C2C10CA4EB38867BC444427BCCB65B054F76385BD84D3F19369C65483C0B2AE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d8dadbe534ba7ce6ed1a17f85975bfe5448084cbad993b849066b9ddffdd7909
MD5 d428d407ac821c5ec79643c1cc398f79
SHA1 de6b84541c1e9d7be05397854cc7f2aa1ddbef5b
SHA512 37d138d05539e500f0e25d9df9276a1e03034231708854fdb954c9095d2831ea5441b15470823087d736b690aaa2eca7902a4c681bf071bc9dc7bfea205f6edb
SSDEEP 192:/1d66JoztdzgCl6mBM2pOv5zbo8WpEyjmO:Nd66Joz/zgC1OTbo8WpEyj
TLSH
T1E9D10DA4EB38867BC444427BCCB64B454F76385B984D3F19359C75483C0B2AE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 f7bdddaa873d8d1a734eba11f9b60b865bce4e822dc395c340143c120b904138
MD5 d4a059e5ea11fe7ab1518cbae46561c1
SHA1 d37b4df33aab0727ff826b87342640fe12939d4e
SHA512 e2f0de508f6b05af575097fd53ca42fa0780273d77707b8d34433d19bfb4318b9b5419ebe6a7a1f068c8db451aab9191c2368c99d87a9bbefba0a1548224721b
TLSH
T1DD41995C3FE1CD69EDCBF2DC5880434BD3750A6B91122A436D21EBC9C880ED532699BC
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 f0177ce30a25c01f20fd182afb40dc08f8714e31e263946863814261460ac73c
MD5 60b3c7b821e11213e814d73b1550f9f5
SHA1 701a614e13a9e67ac9c7890300634715425d81da
SHA512 e4010938b1879eb63b9728c0c8297309966c122c062322bebedf51688fde6788cea6c20dc4ab28b7eff2768af5fd7648c3042d94d20581769190622c26eb5de1
TLSH
T1F551AB5C3FB58D69EDCBF2DCA840034B93714A5B85532E835C62EB89CC84AD5325A97C
MD5 SHA1 SHA512 TLSH

Submit Download

3bb4c3cd-1587-42a4-a49d-33378addbb1f

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\3bb4c3cd-1587-42a4-a49d-33378addbb1f
Size 796B
SHA256 d3556a4d58f5c6df9dbd1531fd1938cdf82770bf51018381b76b22e10f271039
MD5 9b1b561f67a48ad92901c44809fa830c
SHA1 82c9e6364650cd01784b34612fbe3b5a6259ad27
SHA512 dc8f303ab0811b7905c51a795934355ebe077a4dda32019b1980d6e47cf10c713922dc4d4912e539edbfd091143c41622e2b7389c06b8451d8f605999f7b4da1
TLSH
T1D00186518735F5F3C87893474AA57F4787F45433C0C554147D64AB04496F619635670B
MD5 SHA1 SHA512 TLSH

Submit Download

41b760d7-8072-41b6-b458-e433b903f347

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\41b760d7-8072-41b6-b458-e433b903f347
Size 235B
SHA256 742dc5b3549901a268675c29c3e0b5a6f9db1210c0098e35846fc1bbe6831ee2
MD5 81856b520639ca3fa24438f5fa711f65
SHA1 15a7c4203e0f1088ab380d3a45e192350aa9d0ce
SHA512 9dc4945522a314db659cd98de3e8625b270739b21752ee31b2ab9ab80c729458ce02d835054e7cf8191c5be6696dac5a7876c7809513da366599c8ec7a471e01
TLSH
T137D097C028C8A31C08182F07B0F02AC232448C339861982086718E74EABDAC5415282B
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 7f717d3498702bdd418b6c7ea571849140063b08e2b031ecf29dc388c8d4dba6
MD5 585e5b74c2cf55abfc2981b510592500
SHA1 55f219ee11175d54fa8a16d46568311236d3f118
SHA512 17e889a83b03b5ca01cae90b3f13e5632b9c9e1a960cdf3b3526dcb7e129fc9c0c4374027ab864dc2bf7cf18d9a1ed21a48a77c47919589c8849eb705e013eda
TLSH
T132C0C046472E5CB3893416C010EE207D43FA0412484882C49C6C5687F00740336D7008
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 23f987716af9ae256a2ac1bd4fd0feeb03f2ab9becf62ce85a9925aece9191ec
MD5 905633110dbef4ed3ec256c25976ac99
SHA1 cf4ee0771d027facadc93b7efe363c993cce74bb
SHA512 6b925832d6f6f36a6461e3ff8c5d7593ae0e3abf9c72fb7e2adc03fc7c2332a04f5cdbe9dcf41fc32775ac0ed8a86d05407333ff8a0d2d3136673d952774b2d5
TLSH
T149C080C18E5E63B785101E5110DE40F767795C335D4191E45F5D6544D17FC0311C6545
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Public\.ff_tmp\extension-preferences.json
Size 799B
SHA256 8961a82960c13dfdca794fe3fd6f448ff49a93a8c59782b47f5004b11d3da145
MD5 12c305f5f06290b5f4f4a55d6b4b4389
SHA1 815edc293ed9e3ca3866898438e762b4d10e803a
SHA512 d7aa4af5550695f93724c3159c29d81518c33575459669f1c4b35751df54799cd9eef584119e0c8230b4a0b1f545fadd207e7497619bffa4164ec7b291339801
TLSH
T1C601E53B640B6EB01E8E5621FE384A92E791111B50B7F6E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 14KB
SHA256 2bd8f5519cc8f8cda9d9e38cba847001f3e8bca256c43ea0863d04f4d8f70c30
MD5 5f0aac4bd940532ab0fdea19729e7329
SHA1 7508a459fc787e026e13faa233585f56c6ed8c47
SHA512 4fa14fb4ceba16cc7b43347d42b2245518fc8de333bcb5f114709bde84955aca5f3cf09bc8a651cd401df8fa84a25487dab7f77e26894550f19f995cd5d427b2
SSDEEP 384:UkI4v3Umldvs8dhWp94z696oeL4H9AL4PCL4HHL4HCL4HC:7I4fRfVXw46634di444L4Q4i
TLSH
T14362521945149EB8298EA78BEA367D01C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 20c6ebb86c6f59b261686873cf31efbc52caf225d2b044f1c8d46bce35c162d3
MD5 c0e81a5d21aea9557e1210a2f02bd001
SHA1 196607ed11fa03a1b6efe0d65fec68917048ba7f
SHA512 d599bcb3ae6f5df666bc0598bc127b4024d9051343e1f579c37f3b97bf388dc5955044628d5c8f6e8eeeb380230765f68e9beccc96c726bd86ad8879d1167483
SSDEEP 192:UkI4v3UmldvS8dhEpp943D696gDwlL4kY3:UkI4v3UmldvS8dhWp94z696oeL4H3
TLSH
T12F12541545048E78298EA78BBB367D01C27D473B60845C38F5DD8FC842FA6B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handlers.json

Path C:\Users\Public\.ff_tmp\handlers.json
Size 380B
SHA256 a0e0f7d600383de873dcb01474154fbbf513bdbe55638481ffce6d198399352c
MD5 a2e4be6328337b95ac3bdad5bd4c0983
SHA1 0badbb13d20ca84b342d077cbc00fdd7b342fc28
SHA512 138be3384a3c874c967f0bdd56a6c1bca334deea67d21ade2ff281cfd1f10047561590520bda496b2e4d0130a42295c5ced08cd9d07f10a64ef27226f4daa149
TLSH
T19DE061D26C1DAFE1073DE56CFE077D06C1B6051B3CF8EAED58D08B04076195D9007215
MD5 SHA1 SHA512 TLSH

Submit Download

key4.db

Path C:\Users\Public\.ff_tmp\key4.db
Size 288KB
SHA256 0f123d9ccedb546ec07a6e5faff6d1792418e30d4a3cdadb1466352f634631ed
MD5 ede49098cb6db79b8be4d8d552c7b156
SHA1 c1e74bd6de95f5001b152fa81b077c3094757b9d
SHA512 3180aed0f4fc370bfca7edd07225f71108c8bd8b4c93a04ab9391b0283e47e1429f33c458880aa7f3f00b7e1b1aa42ae21151744caa86264c109a4f0ae487018
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vTh9+C5GY:f1zkVmvQhyn+Zoz67U9T5GY
TLSH
T11554B907EDC5B40AD70A2830C6455DF37951AB0487865E2BDAFC1E3E0EB264DBAAC5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 13a8b8b7d9b7c5eab1e33501c8476317cb6f95ba4c90318e0adec307be1421be
MD5 83afb734a53285413795887ca9ed671a
SHA1 be599b094e1096e969f43aaf6f8d430b4bc6d727
SHA512 cecfa1ca48ac840bd9ec18da80b8c480065a1ad822aa22a05bdfc8bf6029c276f008483c97717b0a627cb442ad15bc8fa149f3a8e938ef1eeb7127ce73f3f830
TLSH
T1D931DEA62946CF7FF0B4766CFC1549A0D6734137BA7F5C8220B880868418F3442F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 8ce33e305fef47176420341b3ca7f2e3b3b232d680020563de0b7dc6da870642
MD5 80bb8dad9e54ef109053d5ad3f961f60
SHA1 46b79819742ad896fe113f0829cb62c5ae2709a7
SHA512 a018229285525b51e43f4402b1afa7c06fe37a9136dc5871ca90581e21189e59dcb69075fc68cdbc43232ad1d7103a906fb7de50d146f37f0377e0f951a45548
SSDEEP 96:xHY9UOqGqatXdFwzvWSXf6ElvX9j9nsHMhi3Bw8hGcnav:iURyXd0P6EwPBw8hMv
TLSH
T1A6C1FF785448CF7F64B6776CAC688C315AB2413BBBBF68C620B54485050CF3881E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 0135e8fc83fe6f3598d3f9c984e92da5c77130d8fd7e62c112da4d2b3c5f1e36
MD5 7dbc04e15526f471068ccc94faba42e1
SHA1 cffed3aaf15527900f9c3c10b61f300812fb894d
SHA512 55d9dadc16d39f8ebf4cacdf8bfcb5a13a77891fccf83923541a405c5a8c4b05ad9977af9958f90e1942e4b629a8a965538c6f40c01258548b43a2a9a397f20b
SSDEEP 96:xHEw2tTUOqGqatXfFwzvWSXfSHlvDdv9jcndHMhi3Bw8hGcnaf48:uw2MRyXf0PSHmPBw8hM1
TLSH
T14ED11E7854488F7F74B6776CAC688C316AB2013BBBBF28D610B54485054CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 893e2331e1bdcb00a8244e95f6ee39437c215584cc67d4068d9bfecaf1313451
MD5 e582178481d4f8163cecf56702370d55
SHA1 1c9e97452308087b3056f3c21a802fa5d37fe377
SHA512 3514d402681639a407c2b4609ee70cb277d52e8018625f9bf42bbf172f9169b4beb43cb4486d406d1ad646b69aeda47a54ea390873167eb2d6052c01b5ceb550
SSDEEP 96:xHEw2tTUOqGqatXfFC1zvWSXfSHlvDdv9jcndHMhi3Bw8hGcnaf48:uw2MRyXfsFPSHmPBw8hM1
TLSH
T1F4D11E7854488F7F74B6777CAC6888316AB2013BBBBF28D610B54485054CF3442EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Public\.ff_tmp\search.json.mozlz4
Size 327B
SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
MD5 240589068f063f8f706378168230e975
SHA1 9531374a22dea374d032f7484567fb1b201af87d
SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
TLSH
T169E07D3E9C15A0B6C2AC0AC35F0F494A0F58583A9324AC8C90B49D91557FF9B5248E2B
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shield-preference-experiments.json

Path C:\Users\Public\.ff_tmp\shield-preference-experiments.json
Size 18B
SHA256 704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05
MD5 285cdefb3f582c224291f7a2530f3c4e
SHA1 f816c3e87aa007b6e6d31eb6a4618695a7d83439
SHA512 8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Public\.ff_tmp\startupCache\webext.sc.lz4
Size 104KB
SHA256 0c14f0f7629c02b52d4d3e544fcc2351f03f890df044b67d37d48d1ffea8ebfc
MD5 ce4bac6e49b8c8ef3a741dbe89d9ec68
SHA1 53a6fe025846ede98ad478b41ba8a96c0e496833
SHA512 38256c6dc7f21bc5e4b2312a3b6364caa182c76e560d95212cf02b77635e66baaf877516f9e80c7db8d0fb1cf9f2a4f40d95fa9b2b2fc4f145a94c09867d268a
SSDEEP 3072:B3lYeDM8Af8VZz/boPNgd7aNJljt/4FKp:zPQ90HbbKgd7EJlF44p
TLSH
T120B3BFF6DF628D3C65FFD42DAB82843EFD123414B3A72419C8632754A1C6FA8667924C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 f75c2cb08af5ef4da5a3370cf8140dbafbb6b9ff98c6d396ddf3f5cb384d30f0
MD5 4627c85eed0c6b4b4f0a269fab9fed36
SHA1 434f3a9768bf71f6e4ef2a808d505e4b6bd27bc1
SHA512 158b3eefe8b479526c883ed0627b0447ad0f44c1ea7a900623d13dcd6d8f5e21077da2fe965484492f9f0b51dc4559ebed4fb78643fdee6e260d314e65676243
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0B123Cfi2f6E2A/2g42cRCH2QS7mh9:Oa16S6CdFAWo14CfiaR/skQ7
TLSH
T13123318D3A33AD50CB29F0BC639105AA944F72CD0130278865D6CF9C841A1ABEE5FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 90aa95be08263105e1f805c2c4f5988f7d9eb78d45ec71c8b46f4490ef6d7b2e
MD5 c08b94fc90e6f730477d3a359b122943
SHA1 a857e43672f13b4d82be2607fd8f8067283971eb
SHA512 3bc51dc2ff8b2e104e68ece9db0edddb8fd48aed7d04f528206800c90de84e529e89245c16ae24729390d65a3009941667995047048141661281eef5b8ea5dd5
SSDEEP 192:wa16S6CdFAW+sfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWBHjhcfZ6k0H79H2h4f+Tf
TLSH
T14743848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C441F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 376KB
SHA256 3ce67fdb4632b708ba24dcfa0f3bca6a42792db6e1415d248d4a7dd793dd6ec4
MD5 26a65996220220ed3204aea67273bb27
SHA1 589193f412ee06093c987521ba4ea89c62227ebc
SHA512 dc1d1f9f6b33e4291bcbd2ac970e492f190b0ed07c7cf8566725f32e893c66b6c627d8ba87b8b86faafa0e8927b094aff5342cd7b9845f8405bf7b47f0594d46
SSDEEP 6144:/aY3p6x3v+eHPcH0e3y3AY4Sq2tb/tPP1Ipvp6ua3q1:SFBq
TLSH
T1D484E8A53064C193C322D837DB4DB3B7243FE29894E7E78893701748396EA1FAAD9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Public\.ff_tmp\targeting.snapshot.json
Size 3KB
SHA256 c85c5e47c07cac711e84878fd263f971bd4056c816fc0e7b657fb2e21a2482df
MD5 44cf5008f4c9386e5e97fb8f6e2ec5c1
SHA1 100ac9a4d463b634af8e42248c212a38fa52b660
SHA512 8a77337d4e369a9e46a967e40069eadbc82e24d9801de0982d01b0c7fbbb17186f90cbe59c8bf93de52df2cad632a8b808d4cb6bc24c2649bf721c011a4c4c32
TLSH
T1BC71500C961CA4BEA66BC3C0E644BF978FBD053370446468DAFE460C85FB5FB162615B
MD5 SHA1 SHA512 TLSH

Submit Download

e5b68b9.msi

Path C:\Windows\Installer\e5b68b9.msi
Size 15.4MB
SHA256 806f92559a9ae42b0d66af6787804df41feeb2e2807657f0bba48b754d2ebf8c
MD5 00c2bef1e1bfb1bd233a33a2b7124e44
SHA1 a4e08d77a1ce3142fcfe36ee081a7c6da291795f
SHA512 e7105189dff504a77346e882668ba114ef5cfb970dc08225437ceb9c67fd3609b8cb50e9c7a32a1ad358a03850d9c25d78c76c90e39cb5f4e1f101c4b9681856
SSDEEP 393216:M+//oE8202v3ipCe5SRY/F6cR1V4TItiCfJkw:PA2vKCe5SRY/F6GUItdfq
TLSH
T1F7F633D865A68EDAC78F96730626FA646306DF64EB64145231DC700B6637B3633F8C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b68be.msi

Path C:\Windows\Installer\e5b68be.msi
Size 7.8MB
SHA256 1a122b66116e6b74b0a2170c7664b1589d431ca00566a053faf16cd9fb1a8e68
MD5 db98fd905d308e0a8193c7c9ee23abe9
SHA1 f7fe823c7657a6b14fe8889ad58e91ea4903e44e
SHA512 4c444e2672185b04b9d42a243bcd709e7e2d70839b2bfc5725e8f7352a7f32b9bc4cbe86fbc6f99275a636b7df07ac581d28f44c95944faa8e1a5a3fbbc09a6e
SSDEEP 196608:hnwGe83LFhQDKBi+8yoFxEA+fRmNctcLtyJ+K+vKzf:hwGe83LFhQDAjqxEtRQcot2+VvY
TLSH
T1A38633B49485DEF2C10796B24323A3D1EB76BD77420FE2420A58F615BF71514A2FA3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-2301-0x00007FF643600000-0x00007FF643699000-memory.dmp

Download

memory/1928-2206-0x00007FFF5BE20000-0x00007FFF5BE83000-memory.dmp

Download

memory/1928-2208-0x00007FFF5BE20000-0x00007FFF5BE83000-memory.dmp

Download

memory/1928-2299-0x00007FFF5BE20000-0x00007FFF5BE83000-memory.dmp

Download

memory/2616-1501-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-2205-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-492-0x00007FFF63EC0000-0x00007FFF64123000-memory.dmp

Download

memory/2616-1064-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-493-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-2149-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-506-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-987-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-2298-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-487-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2616-485-0x0000000000900000-0x00000000009DA000-memory.dmp

Download

memory/2932-483-0x00007FFF44DC0000-0x00007FFF44F4E000-memory.dmp

Download

memory/2932-469-0x00007FFF44DC0000-0x00007FFF44F4E000-memory.dmp

Download