acrstealer | hxxps://mega[.]nz/file/8cEmlKRT#obJCP4-qpa3Lbg2KR2nDfV4zUFs5WnqTKgMUXOPnl_M

Analysis

user interaction
yes
max time kernel
73s
max time network
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/8cEmlKRT#obJCP4-qpa3Lbg2KR2nDfV4zUFs5WnqTKgMUXOPnl_M
Sample261024-1yfebast4k

Score

10^/10

discovery acrstealer persistence ransomware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.5.3-alpha1

object.eggbeateroxidant.cc

Decoy

cdnjs.cloudflare.com

Attributes

guids
f1575b64-8492-4e8b-b102-4d26e8c70371

01a034f4-51c1-7e0e-a650-137d7032a680
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Extracted

Family

acrstealer

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4020	msedge.exe
4360	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{CF4B9CF1-2730-45A5-B444-C832762931D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4952	mspaint.exe
4952	mspaint.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	taskmgr.exe
Token: SeSystemProfilePrivilege	2364	taskmgr.exe
Token: SeCreateGlobalPrivilege	2364	taskmgr.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe
4952	mspaint.exe
2364	taskmgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5080	4796	msedge.exe	88
PID 4796 wrote to memory of 4020	4796	msedge.exe	89
PID 4796 wrote to memory of 3632	4796	msedge.exe	90
PID 4796 wrote to memory of 3632	4796	msedge.exe	90
PID 4796 wrote to memory of 3632	4796	msedge.exe	90
PID 4796 wrote to memory of 256	4796	msedge.exe	91
PID 4796 wrote to memory of 256	4796	msedge.exe	91
PID 4796 wrote to memory of 2328	4796	msedge.exe	93
PID 4796 wrote to memory of 4224	4796	msedge.exe	94
PID 4796 wrote to memory of 2328	4796	msedge.exe	93
PID 4796 wrote to memory of 2328	4796	msedge.exe	93
PID 4796 wrote to memory of 4224	4796	msedge.exe	94
PID 4796 wrote to memory of 4224	4796	msedge.exe	94
PID 4796 wrote to memory of 1216	4796	msedge.exe	95
PID 4796 wrote to memory of 1216	4796	msedge.exe	95
PID 4796 wrote to memory of 1216	4796	msedge.exe	95
PID 4796 wrote to memory of 1636	4796	msedge.exe	96
PID 4796 wrote to memory of 1636	4796	msedge.exe	96
PID 4796 wrote to memory of 1636	4796	msedge.exe	96
PID 4796 wrote to memory of 1580	4796	msedge.exe	98
PID 4796 wrote to memory of 1580	4796	msedge.exe	98
PID 4796 wrote to memory of 4032	4796	msedge.exe	100
PID 4796 wrote to memory of 5724	4796	msedge.exe	99
PID 4796 wrote to memory of 4032	4796	msedge.exe	100
PID 4796 wrote to memory of 5724	4796	msedge.exe	99
PID 4796 wrote to memory of 4508	4796	msedge.exe	102
PID 4796 wrote to memory of 1544	4796	msedge.exe	105
PID 4796 wrote to memory of 1544	4796	msedge.exe	105
PID 4796 wrote to memory of 2528	4796	msedge.exe	106
PID 4796 wrote to memory of 1176	4796	msedge.exe	107
PID 4796 wrote to memory of 2528	4796	msedge.exe	106
PID 4796 wrote to memory of 5272	4796	msedge.exe	108
PID 4796 wrote to memory of 1176	4796	msedge.exe	107
PID 4796 wrote to memory of 1176	4796	msedge.exe	107
PID 4796 wrote to memory of 4580	4796	msedge.exe	117
PID 4796 wrote to memory of 5376	4796	msedge.exe	118
PID 4796 wrote to memory of 2464	4796	msedge.exe	119
PID 4796 wrote to memory of 1976	4796	msedge.exe	122
PID 4796 wrote to memory of 1976	4796	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/8cEmlKRT#obJCP4-qpa3Lbg2KR2nDfV4zUFs5WnqTKgMUXOPnl_M
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffce7ddc188,0x7ffce7ddc194,0x7ffce7ddc1a0
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,4274921994442890115,7663668829729561898,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,18127605310401451094,11646400345660963585,262144 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,11974254200389531222,9835556483544768866,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3660,i,7987393307868488765,1914010653793443972,2097152 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,17748922527624800065,13023070547862975788,2097152 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1088084086298270122,15370409395250195394,2097152 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,6133688833276587198,7279365877323434990,2097152 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,17323543544457536387,2858135964351099094,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13258221899354796702,7409456794328708994,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,17060715590011165376,4323400006085608972,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8716915736518170156,9967510089240141269,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8716915736518170156,9967510089240141269,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11099495790931811560,17073954260930585120,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:12
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1673683502561530776,4466703603575503201,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6404,i,4283007002617867250,1854579476993853208,2097152 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,4178496461273224606,11183099099023237750,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,5573992676873445575,12038395833579485113,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,4802746298970304888,17436590751122789527,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,13081783923902382597,16928766204113913263,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,16165930915156923625,5850445220569380091,524288 --field-trial-handle=2620,i,5492301671177869388,5328237734153834110,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:14
  2⤵
  PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5136

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\SETUP_PACKAGE_(KEY=1256)\PASS KEY.png"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4472

C:\Users\Admin\Documents\SETUP\Setup.exe
"C:\Users\Admin\Documents\SETUP\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Users\Admin\Documents\SETUP\Setup.exe
"C:\Users\Admin\Documents\SETUP\Setup.exe"
1⤵
PID:2236
- C:\Windows\SysWOW64\explorer.exe
  \??\C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:6260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
1⤵
PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffce133c728,0x7ffce133c734,0x7ffce133c740
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,1253106912731280955,13145903560299559540,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11842283821131658620,17197239588391908921,262144 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,14964176085864156248,7665729089145535917,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,3470246180018105798,16316053115802133393,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2968,i,4642216147201455589,13384542890378973567,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,9538213499279402567,12365997545769467736,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,14915064733182482036,6210874811670604799,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:6932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5176,i,2872167499395307544,12742212650895854445,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5188,i,17091905192165284480,1375484441137634664,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5168,i,16013271459493580288,439590056981893817,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5360,i,12669501652725810348,14830395287108632425,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,13555981616696945979,9316816369101583074,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5940,i,2352652993217181564,14229786106533103576,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5948,i,15485916532725630088,1094001013437495612,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5540,i,11213774327054678826,9612577930148553940,2097152 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,7906519648080590389,2034436738221479839,524288 --field-trial-handle=2032,i,4211918737825499520,13335577832874405141,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:4676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
1⤵
PID:6568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
  2⤵
  PID:6596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2828 -prefsLen 24445 -prefMapHandle 2832 -prefMapSize 268548 -ipcHandle 2892 -initialChannelId {1d359617-454c-4aa7-8112-54902ac137a9} -parentPid 6596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
    3⤵
    PID:7156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2144 -prefsLen 24610 -prefMapHandle 1668 -prefMapSize 268548 -jsInitHandle 1844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1880 -initialChannelId {4c5c8f7b-4067-4698-ad5f-3f753ebcaf7b} -parentPid 6596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
    3⤵
    PID:6688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3760 -prefsLen 25493 -prefMapHandle 3764 -prefMapSize 268548 -ipcHandle 3808 -initialChannelId {873ef7cd-79ad-494a-9349-58a7fbd017af} -parentPid 6596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6596" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
    3⤵
    PID:6712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4288 -prefsLen 25604 -prefMapHandle 4292 -prefMapSize 268548 -jsInitHandle 4296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4304 -initialChannelId {8dda47b8-610e-48e5-969d-969dbcbbabdb} -parentPid 6596 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6596" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
    3⤵
    PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32b85ece-e2d2-474e-9248-8c6d10b1f96a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\32b85ece-e2d2-474e-9248-8c6d10b1f96a.tmp
Size 4KB
SHA256 738f9177518b97dfb5ac80908de7e0c4698192f0831d3a02bafa36551273bf30
MD5 5817cc9b4926247f090e67e2eec851ea
SHA1 3d1b224cb6b6cee355f9bcb04a4f2fb5778f32b5
SHA512 5ad18179ce8cc9e437caaa6f21d566c1647c10520cea35cbd3d9707825cace64b57abb6b3b34e7ecc7823cf0562311e6d4fb56fdf28b79436a043ea9c67cc728
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok5B8DnB6vGyvQH4jY40bblDv4a:qC0xJPz8/CkqDUDcBfr4jY40bb1
TLSH
T161A10931B8695DB794B6D585B2422A03CF64B197FA21BFC0B9ED1E2C14F70F81752A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6709d7a7-8302-48e6-8f25-290105822637.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6709d7a7-8302-48e6-8f25-290105822637.tmp
Size 143KB
SHA256 7d0d33dd76b41a98318e45b07a64adb7758addffb618ec250a6c91e2efc9278d
MD5 d7e64668cf53b18c5ebd5a4a8ac7c55b
SHA1 f08f78766eb1dc0a50a2375dd5eff6524745256d
SHA512 441887d28aa9f43841d7cb65948c458ea393da71a1545cd936f1aa3ecc25039b2a5777c443da585f1c02a673aa545b99de181f32a10fd119b96cb94a63996dc9
SSDEEP 3072:pHCkDPU7b9mOs5u7eCyYbpuLUXNCzvfQ7Q/Mz1:pHCsUfw5u7eC94LUX4rY7Q/C1
TLSH
T134E312F19B3F285A3EF8CA1B7227230E0F7DD5A2AD0815C5C0DA3917219D7E6865B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9050fac2-76be-4f34-8c9a-d1faafa30e56.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9050fac2-76be-4f34-8c9a-d1faafa30e56.tmp
Size 11KB
SHA256 abbcb9e81b889daf5a87585bb16028ee977a0ea003b6e84cb7d66d478040cef7
MD5 2d9b912199902777da142a6c5cfeb36f
SHA1 ade8c39a93aa9095329eb34c802ce714c81a8116
SHA512 fadd322956027417a92b02ae556b2d0ed43aacd89b95c4a863464d925e4153bbed32f24295e02848873ca1ebc48e9212a499565e9fc9c7473b8c73016afe9957
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN9oWvSNmMsq:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeB
TLSH
T1B432DA27948D5D3F4FD8D948CC166F8F6DF5029672680D2496FB9C1803A97CE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb19d7de-1ec5-4f49-8aa4-4a70ebceef20.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb19d7de-1ec5-4f49-8aa4-4a70ebceef20.tmp
Size 11KB
SHA256 f886aa009c3cdbfa22cdbe9e209ec0b1425be4a921a5c40079d06df78a20518f
MD5 bc0d25f78544e844fce6ad09dda8b4b5
SHA1 9c9737467831005c587889b3b0b472e938330670
SHA512 c56b368e104ab767032a89cb8eace28df8fd721218a3f21d66b953c1c9a022c137729612c755ab43199cecf52e122efc752efae1b46c467f286d0e0098c0d30e
SSDEEP 192:vR7TAPev7DvAPRp2P9bHsb+WNnttPay2Z9A2UC0VyIsnAUgR:vR7Tca/6X4BwfPl2Z9kCwR
TLSH
T1A532A42AAE10793B9DDBC22AF9217787E7F5102174902E84E6FC893C24E75CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10f46433-0dd1-4c00-acd3-7f40556d89fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10f46433-0dd1-4c00-acd3-7f40556d89fe.tmp
Size 38KB
SHA256 e3313fe8e176a8288e70368111e93e9f222ab86cfa156e329665cc200cb6c8ae
MD5 33bfa669d6453486f8570c482832723e
SHA1 90b3ab9c796a73375374bf85f19f11bb775d11a0
SHA512 4ed10eb9f4bfb7d652f1e41f4bad71e69a70663c5039b7dfebd074b462edb4a9a378678e8a741262e0a71f5f4dcbbf25f9c85c87703cdc2d7858c5376c889ef3
SSDEEP 768:4/UxvxjgC+k3fXqybNbK1DztXOeRFZD1fTos7RCv/+Pu:FZj3+k3f6SY1fT/REKu
TLSH
T10703B03AB8945C334CF2E244B24A764BFFF455B385C95AD809DD2E0E059BB9D130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

117d6c9b-78eb-4328-82ea-ba62bc2b8c50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\117d6c9b-78eb-4328-82ea-ba62bc2b8c50.tmp
Size 38KB
SHA256 dbaf21397e69e11077669a83d795d947bc9cf51ff8169de8f61ee40a4488bbe5
MD5 75a1b3b046c95a533f887ac3118eaccd
SHA1 9cafefc874fb73654365ad5cc9a015f3941e970e
SHA512 4d1fcd1ffe4af9306986f68484db99e13dd2328098b12fd56b17703956c9316d97bdb02fbeb768de4a2e9b0551f855f927957c434217b69761425d398db01680
SSDEEP 768:V/UxvxjgC+R3HGTkybNbK1DztjOeRFZD1fTos7RjvopU:4Zj3+R3HGY+Y1fT/RbopU
TLSH
T1E503BF3ABCA45C334CF2E245B24A7647FFF455A385C9599809DD6E1E09CBBAD030B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7075e0f6-094d-4c3d-8539-5bcd8f839abb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7075e0f6-094d-4c3d-8539-5bcd8f839abb.tmp
Size 33KB
SHA256 be255654de28dde187d9352dc890383dd9d73a030f1e6366b9cede8dd2372745
MD5 497e11f370a025f1332c46bec75120e7
SHA1 ec863dde7af7a6b4d39426104a3c95cf2cb1d22a
SHA512 10d76b2115445ca9875d98bff37413a6899f90702d2bae394c6157cca5401d2e061e7fad2bff919819a8782e2a3792152c7b2e1c929ca22d619c209dd8b49598
SSDEEP 768:/2T3nG9NkybNbK1DztjOeRFZD1fTos7Rjv6TUGLh:/2T3nG9C+Y1fT/RboUGd
TLSH
T172F2AF3AB8D45D338DF6E241E2497647BFF45253CAC80A8895CD6E1E04CBAAD134B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84334921-f576-4a7b-a879-f6b7bfed4f3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84334921-f576-4a7b-a879-f6b7bfed4f3b.tmp
Size 41KB
SHA256 2d94efad93745bcac191cd30144f836839dfa5847095a31210a866658f7bc249
MD5 d06603db6b30d5115fe07b40e6cf5b6c
SHA1 62b5e6d08ca83cf91a99a3bb469050d5c1158df0
SHA512 7f06c618638f641274fe549465ebd5eece6a048417b916dafac46d7aa5162897a2577a665b2b498e8ee0db48470a988ec28f3909231ee810a50a1f0de1c0ef5c
SSDEEP 768:qF22X3+wgLG90kybNbK1DztHOeRFZD1fTos7Rjv6TUGLh:X2X3SG9vaY1fT/RboUGd
TLSH
T18E134AF6A8D78937C9AD9743A33D2D02AEBCC193B98449447388691DCC875BFD34B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95638084-fb13-4675-a6ce-a83bd28f4dd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95638084-fb13-4675-a6ce-a83bd28f4dd6.tmp
Size 37KB
SHA256 2c85c43f1df6e10941c71fedc448c565869f006d833779146e4c73d91ce24dba
MD5 61885b082ff4c432e49eaa947cd0ea03
SHA1 7ac977b6d066cc49f167e215bf4695f5e141d4f7
SHA512 0ae4db28684b4346ea6c330b96909baf577d4d007d264adfd1ef03b2c548b5c5f7dd6d2307fa4ff07a1eded21d186af76327ae6389e609236762259edc397377
SSDEEP 768:z/UxvxjgC+k3rw+ybNbKDOeRFZD1fTos7RzvL/+Pu:GZj3+k3rxOY1fT/RHKu
TLSH
T1F003BF3AF8D45C378CF3E244724A764BBFF455A396C91A9809DD2F0E159B7AC130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9896bbf2-802d-4d57-b112-e7b268d41463.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9896bbf2-802d-4d57-b112-e7b268d41463.tmp
Size 105KB
SHA256 090c00cb528aa93236ea2b6d860140219e66b4d454a38b9803900cb75cbc25e2
MD5 d94748b3e8ecf4294130857cef2c8fa3
SHA1 623e047527c82e1e583ed2e861e2fd423927f434
SHA512 da61ae746257e21a680da707341f33615031af79ae411737f03cf5607e431bdf65e4f08d88613eba8a3958a5f7ea28a0b2e16c6d79bd68f638363a3298dcc50e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T139B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

1447267d-47e8-4d9c-af2a-859d9cdbfe43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1447267d-47e8-4d9c-af2a-859d9cdbfe43.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

432b92dc-17b2-4d90-9777-a4bf70ee1345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\432b92dc-17b2-4d90-9777-a4bf70ee1345.tmp
Size 23KB
SHA256 80e8c859eb92cdcc4ec2a1b28ee3617848628117bfc4c35882ad89f82c540af6
MD5 901586cd42c8c916c3fb6b668fcd08ea
SHA1 ae1be2ee9f80d7e576b275c3516191670aacdbea
SHA512 4274f9c52b279e3aeed69c5eb1e3ae26a43b5947b92627972c3998b17a1e5091412a1a3beeee8a774cb580da63dc3030c19d71f49af348eda9cd9824ac0c3fec
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9UroTye:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0V2
TLSH
T151B2DA2B640CC77E4F804AADAC1A6F977D9802C796988D4047FE994C03C77EBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4985f2af-a2d8-45f3-8d9a-7dea6f310566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4985f2af-a2d8-45f3-8d9a-7dea6f310566.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

90c112e3-cddf-48c8-b816-eb6035752d6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90c112e3-cddf-48c8-b816-eb6035752d6e.tmp
Size 11KB
SHA256 900c588b1a7767ac80f897579a6c7d74188fd8efacb47621b2ee712760f67035
MD5 a880313c6f5c22e63def8eae528e66bb
SHA1 163f13f4ac5c178c8403c95f0057687aa725a6e6
SHA512 f8112c5013fc72c0b384c9b933348f55f1f0c5bd45cb417f2396f35c3622671baf8a0e0125708783f0c2f9f867d0dc7dcf10088cffbcae1465bee9a54cafc057
SSDEEP 192:sxR4Rzb//fzsvK7xJfzoA8pS5/g6+WNyU7/YDcn6GPIgIJ:sxR4h//fzsv6SC/5F/Ts
TLSH
T19F42C916AD28A93B8CC7D209BB19BF13D2FD1173A5945E58A6FC862C04E67DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 581dbfa8642288f1b2bc1d74959f3e8e39e72f77411c3b6575708bedc412825a
MD5 846cdb3b56c96143784259c78c345a26
SHA1 8690abf62953140093130339122b41f8127b9910
SHA512 eeaa6769226feb49311a0339531b18c0be3046ea23535263676439383ac28a0f95dd2a134963e4e615e9b7b73491ea23cbf87fcce9ab0850a32b03332ce29759
TLSH
T1C751B9735597C093FFF7D13280C52A9737305D8AD9A79E828D68E4BC9D0EF20A688190
MD5 SHA1 SHA512 TLSH

Submit Download

08494b5e-fe8c-4c9d-9fbc-856a35f19f61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\08494b5e-fe8c-4c9d-9fbc-856a35f19f61.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 337B
SHA256 139ecfeea0f3f38c14659c3baf6062ca06d3effb1b62156d77c34702afc447d2
MD5 c95b812dc4c0f47ab81b065538afac7b
SHA1 3f33c85d0b51e10da5913af5b07a9b2c54dc58fe
SHA512 d74019d5e364c39260f09366742a929a977bb3aa3dc5eedba54e34cbd97f7e356405b2e30ac42360e7464aee9f869f11c3bc018d7a195a74101a7894c94c4c03
TLSH
T13AE0D81984D9C21B621A90E30728BBC99F97255AD785BD461F40C914B98A448E46E1D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

38fd4437-3c92-4c8d-aa2c-0ea6769323ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38fd4437-3c92-4c8d-aa2c-0ea6769323ef.tmp
Size 2KB
SHA256 f045404d0b61a1d273609fd60e362af89960e6c46195ec5669581ca6b5d22f48
MD5 2897e16f2b6f55a765f4cfa37869d478
SHA1 a6901bcbc827af450b7e01f2e9408ead30f1287e
SHA512 b2f75ed7318fb121b2bdf8fcc30560bfc375875b3d04209405829e2eaabefe32fac9712c544e85a2691493a2116ab54bc08a8fd283cbf8326667a49717586a76
TLSH
T1B051BEF743B0857EDB1196F0EA046E2FCF5C0116436C78AA85E4AE2793F3472E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

558aa5c5-86d9-4ad1-bda4-dc38d5303563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\558aa5c5-86d9-4ad1-bda4-dc38d5303563.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 92392eb63e10e4c51081280188c61fc0005d61ede611b1f18a411002f3f67124
MD5 d8361163d353ffaf3d85d4c08a7ac7d6
SHA1 324f61c6e044b02bfbf46820fa9a1accaf66d8d0
SHA512 5373c72c3e0164fee9c15bd71e85bcf548555aaf87ddb9c450c3272e88b4b5c1c4b085de9ea05a244784bb881bccff035135d281d595948fcda127a565f9927d
SSDEEP 48:Txk/LopFMaty423w/a9NUuTAwev2mT+oywq39m:qDeMatha9uhdCX9m
TLSH
T160B2EF0D2F306121D1F09B77EAD144572F7C212EE3633699DD5920B3CDA36ABF5160AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9dc6466-9d9f-4733-bc82-e8cafe4373dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9dc6466-9d9f-4733-bc82-e8cafe4373dd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ad56a8da44b91f800e0bc0f0ad9467e51c688b98d3ae2c046dbdd59538b89a1e
MD5 b246ca904cda05b042382e5da89ee3e4
SHA1 13a3eb555ede6cb492ddf9edb32855305dd731f7
SHA512 04a268d91bb9ee227f5bd1c4cb6b928461542a016375fb633aeaef9dae5b9b6aed9f90feaf064a85347e0e472b7c8f10f2ae10131c78332ad800aa62fbb9e158
SSDEEP 192:sxRPRzO//fzsAK7xJfzoA8pS5/g6+WNyU7/YDcn6GPIgDoJ:sxRPU//fzsA6SC/5F/Tg
TLSH
T1FE42D916AD28A93B8CC7D209BB55BF13D2FD1073A5945E58B6FC862C04E67DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 ad07e9d1e2f5a308dad2e85f97e7492638f7cfa68b99b3ee02a98a858ef44f87
MD5 0e22e47287a161bcee9b14ef03a57833
SHA1 c9e8dc606d25a9d5b12542f62c624c035cf399f7
SHA512 9e5336f60d30e27e90960db2b226e1cad30cf7d9a3f4b9fe06689720d86ca72143757a6571d18e22ee1a4f35c6cd4b9a8328caeb776801e5d348c9fe0e8d0b2a
TLSH
T1D2A002501A4D9863E9040EB56667515033624A51160523424498D0AC9CE1155574112D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 ba85307d942031c3a63ef538f733cf5e62e63193800ba611c556b6b906598d24
MD5 4f0e8ebbd61e7a11b1ccde4b985778da
SHA1 87608b6a87d09e61d4f4c4ca86c5063da9f28557
SHA512 80749a0c0c5f757c017f9b77dcdb8de8ef7b36c0687b642bcd93fb89664308438d2a0b2a1f7594a93289e6a383d7bf5b810bf235b8b903d05c73f63941300bef
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cabadb7ddb289a357e6505211fb500e88d0401696fc424a8b8cd6e4ce8e94cde
MD5 161bb3292c8b4f7af26d336f02a7576c
SHA1 75cab7aa0cf52b03facd1f8b7b96563372bc39e8
SHA512 d8b9845e9e5beb2bfb7897a18102995e745ca6533ffaf05526719879edc71fac8995976a90cfae9956982220120eb36db3b972a198f6d5282e35e0636535ffc4
SSDEEP 48:K0nKzHJp5Sbx8hISXSK9X19SxXCY0lHbyLp2Np2sp2hp29p2Pp27p2/p2gbp2TpP:Kc0AKtyeehqKKoxpWKykSt
TLSH
T12A91FE5531BB421038BE698842F8A62B474271B23118E53F7FBC41F28B6EE141CFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bd5f0249-69b6-4930-9d94-80bda948d262.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd5f0249-69b6-4930-9d94-80bda948d262.tmp
Size 12KB
SHA256 94528a4eed91acaf8e3d6081f709dc6ad67dd9c6f0caad50826b1de8da5ff6fb
MD5 fcd416ddc596942531743aa0ca556423
SHA1 dc32f2b2865dad164aa464d55c16d3d3a64bf11b
SHA512 d785498605a5d00bef625fdc7c2402f965af08391769303990265f8e788163be6d8edb6f32b18026890929d6a16199f2d5b0fc7701f0f5ccbc6b36ce48b2985b
SSDEEP 192:sxRPRzO//fzsfK7xJfzoA8pS5/g6+WNyU7/YDyb6GPIgD6J:sxRPU//fzsf6SC/5F//q
TLSH
T17242D916AD28693B8CC7E209BB55BF13E2FD507364945E58A6FC862C04E77DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b92f9c5-bbcb-4422-9e89-346e8b3f3954.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1b92f9c5-bbcb-4422-9e89-346e8b3f3954.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4c607ac-d99a-41e3-88ad-a5c595493dd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a4c607ac-d99a-41e3-88ad-a5c595493dd3.tmp
Size 33KB
SHA256 4d2348df9824a7a2d8524544dd845f12f707974f8d1862e0caa1390ad9dff340
MD5 47b23b334abe23303549eafa5b7035a5
SHA1 a0499101e9370cb0bdf457e0b0356c3eb7fe680b
SHA512 5b892dbb333c090f79b9abffd7228a051aa1bf293f167c968817e922c9360c6736bd03bea13eee225dd7360ff11287680ef6fa2f3587d74275c1a748dafc8571
SSDEEP 768:Cl3HG8kybNbK1DztjOeRFZD1fTos7Rjv6TUGLh:Cl3HG3+Y1fT/RboUGd
TLSH
T116F2AF36B8D45D338DF6E241E2497647BFE45253CAC80A8895CD7E1E04CBAAD134B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a95ad829-0367-40dc-aefd-2e14e428d425.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a95ad829-0367-40dc-aefd-2e14e428d425.tmp
Size 33KB
SHA256 bf2a97fc3a6e0b0cc76dbff5e27f97c0772d2bae167528c4fabe10df121cc6ab
MD5 89c96f6567919948460baaf4a4b428d9
SHA1 f76698526d15318063d2c716f04e65206ed58ad4
SHA512 3305b8c28df615aa2fc3e178ef4b7456d2c0476f2e3935c51bc7c511254917711ebbdfdf998d0dadf325cf68b02c8f631a43e16e83fafe14ff9bd12870756750
SSDEEP 768:L2T3QG9NkybNbK1DztjOeRFZD1fTos7Rjv6TUGLh:L2T3QG9C+Y1fT/RboUGd
TLSH
T1D4F2AF36B8D45D338DF6E241E2497647BFF45153CAC80A8895CD7E1E04CBA9D134B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca488035-4b46-4b1b-8df7-9b5b7aa8f794.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca488035-4b46-4b1b-8df7-9b5b7aa8f794.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

dd9dac59-1714-46ab-9fa1-d97991907e27.tmp

Path C:\Users\Admin\AppData\Local\Temp\dd9dac59-1714-46ab-9fa1-d97991907e27.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5620_1172271743\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 4KB
SHA256 c5ce34d387a6819a728b81d9d57c6fdfed093c77ca1eb4360436970f494d5b5d
MD5 ac57d3c29adeeacd6913a22181e8ffd7
SHA1 5df75a34e5581d022d0930a7e3d2ae9dc41fe2b0
SHA512 184cf64e522209ad651ad90c5eab4e8c00b867d9c1708f5bdc265d16b22cd85fa6a6185a532c71dcb97b22371a0fad1e2b278d13e2b6594e3dca8a0827976647
SSDEEP 96:6zkBgNpSv67JRY3gNprdv6I/dgNpTh3Up67:WkI4vyJemldvX8dhEpu
TLSH
T1CAA134194544CDB82D4EA78ABB267C01C2AD423B60845C38E59C4FC943FB6F802FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 dad0f67c59cffc8eb1583669613544d2b1ac96155cb3dc53fa51276b77cfb6a5
MD5 a3ee1edabbbe30e2475d4fa8cf99f122
SHA1 fd6741886dd52ae0cc7ecbe40286fefa293dfc0c
SHA512 ed7140807990aa75bd273cd15e7996b7f826a72f964dc20e060076f07f1ffed06dd6e749497809914a746fe6eee117b13ec95e15f0a3f2aaba544acb587715ee
SSDEEP 192:skI4vyJUmldvN8dhEpA943DD96gDTZL4kY3:skI4vyJUmldvN8dhWA94zD96oVL4H3
TLSH
T1A312651549048E782A4EA79BBB367D01C27D473B60845C78B4DD8FC842FA6B903FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 f09b44826060a81127891b0f15a840a21d329101e34fca4a2f78b7931b5d7343
MD5 6beaa3390f609c843ad802a03a04e809
SHA1 2beabdf71f1af0e8154632fb87105930d75693e2
SHA512 87ccaa8df4e1e1f9c582e1aa9d6bf5729890c64b333492bada6582cd00075ccdd28200b8442184740c18324f9e7e3e3bad7052625037d2f8d7cbdfd3b706fa0a
TLSH
T12431DDAA2905CF7FA0B576B8FC1449A0D7B34136B63F5C8220B890868118F3442F29E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 12b576f53135594f88e71650a0cbbab718a6672d22878f8256903d192844006a
MD5 a14642ebca55cb61e05abcfeea12e99b
SHA1 96ee9a471910631a86a2e1c476467e54a0ae2e7e
SHA512 ab63efa4a3147a49b789b9536a4f2111448afbc7ec709763292fdcc77c9abbd709576aedccb22a1384d62358f846529ee1bf62042c1690e46cf2172ae1b60dd9
TLSH
T19C711DB96514CF7F74B6776CBC658861AAB2017BB77F689210F890C4400CF3846E5AEB
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 d79a59d743020ea7bf6242bb0b52a9db3eed81eee8e38c23ef0eee9c1bb1497c
MD5 bf5e04f6d90a793b13b369804fb59907
SHA1 06acd2a6bbd456df70ca19b5d1714c6250310769
SHA512 5518b21547058081446cb772d3083bcca5f8b0b53edf6ce324bb231ee305867cc7468463a0ea868e51dd81b9da4a5e61f00c906b1b60f8f5a19353ad7724689d
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T1B923708E3F07E911C53AF0B178A08D51BC5E321D07222AD579D0DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbs_31ccfecc286de56d.tmp

Path C:\Windows\Temp\cbs_31ccfecc286de56d.tmp
Size 688KB
SHA256 35fe02b8c3c6b3744a591f47bd4f179d83affb193b8d653df92742068e73fe2a
MD5 7ba8c2d5eaf76e880a52e10a3f71ced6
SHA1 6cf3a43060b77d927b1f2c65f956d9be8d58888b
SHA512 5a3fd95b2382c0e96c034271e739909cca5da155bc231426814898757268de425591eaf62789ee6cbe6f9f28fe4767fceeec2718bdd0978af4760857a8e3b74f
SSDEEP 12288:NyVcLS3YdXhVj0kftNzJi9+I7CTW31wiPqmzGsfDoMbVtnnnPnnnnnnn/nnne:wVWkuRVPJGVJFPqFsfa
TLSH
T132E412527AB7A8D9F1B1D8E0A3A177F0B3E93D111D785B2263E71B71BC78089581312E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-463-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/2124-462-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/2124-464-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/2124-591-0x0000000000470000-0x0000000000478000-memory.dmp

Download

memory/2124-592-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/2236-466-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2236-455-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2236-451-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2236-456-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2236-457-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2236-458-0x0000000003880000-0x0000000003925000-memory.dmp

Download

memory/2364-413-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-467-0x0000021D54900000-0x0000021D54AA4000-memory.dmp

Download

memory/2364-407-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-409-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-527-0x0000021D54900000-0x0000021D54AA4000-memory.dmp

Download

memory/2364-418-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-416-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-417-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-415-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-414-0x0000021D5DC50000-0x0000021D5DC51000-memory.dmp

Download

memory/2364-440-0x0000021D54900000-0x0000021D54AA4000-memory.dmp

Download

memory/5968-510-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/5968-495-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/5968-502-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/5968-501-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/5968-500-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/5968-499-0x0000000002FA0000-0x0000000003045000-memory.dmp

Download

memory/6260-508-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/6260-506-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download

memory/6260-507-0x000000006B000000-0x000000006B0D5000-memory.dmp

Download