sectoprat | 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/11/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261105-gyadhsff89
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sectoprat persistence privilege_escalation rat spyware trojan

Malware Config

Signatures

Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral17/memory/2488-313-0x000002AF509F0000-0x000002AF50A5C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5088 created 3288	5088	explorer.exe	56
PID 5088 created 3288	5088	explorer.exe	56
PID 5088 created 3288	5088	explorer.exe	56
PID 3844 created 780	3844	AutoIt3.exe	8

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
84	920	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\28c0b219d954\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\28c0b219d954\\app.asar\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
920	powershell.exe
1564	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 5088	2644	Setup.exe	94
PID 3844 set thread context of 2488	3844	AutoIt3.exe	139

Executes dropped EXE 2 IoCs

pid	Process
2356	AutoIt3.exe
3844	AutoIt3.exe

Loads dropped DLL 1 IoCs

pid	Process
5088	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3160	chrome.exe
908	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2644	Setup.exe
2644	Setup.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeIncreaseQuotaPrivilege	920	powershell.exe
Token: SeSecurityPrivilege	920	powershell.exe
Token: SeTakeOwnershipPrivilege	920	powershell.exe
Token: SeLoadDriverPrivilege	920	powershell.exe
Token: SeSystemProfilePrivilege	920	powershell.exe
Token: SeSystemtimePrivilege	920	powershell.exe
Token: SeProfSingleProcessPrivilege	920	powershell.exe
Token: SeIncBasePriorityPrivilege	920	powershell.exe
Token: SeCreatePagefilePrivilege	920	powershell.exe
Token: SeBackupPrivilege	920	powershell.exe
Token: SeRestorePrivilege	920	powershell.exe
Token: SeShutdownPrivilege	920	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeSystemEnvironmentPrivilege	920	powershell.exe
Token: SeRemoteShutdownPrivilege	920	powershell.exe
Token: SeUndockPrivilege	920	powershell.exe
Token: SeManageVolumePrivilege	920	powershell.exe
Token: 33	920	powershell.exe
Token: 34	920	powershell.exe
Token: 35	920	powershell.exe
Token: 36	920	powershell.exe
Token: SeIncreaseQuotaPrivilege	920	powershell.exe
Token: SeSecurityPrivilege	920	powershell.exe
Token: SeTakeOwnershipPrivilege	920	powershell.exe
Token: SeLoadDriverPrivilege	920	powershell.exe
Token: SeSystemProfilePrivilege	920	powershell.exe
Token: SeSystemtimePrivilege	920	powershell.exe
Token: SeProfSingleProcessPrivilege	920	powershell.exe
Token: SeIncBasePriorityPrivilege	920	powershell.exe
Token: SeCreatePagefilePrivilege	920	powershell.exe
Token: SeBackupPrivilege	920	powershell.exe
Token: SeRestorePrivilege	920	powershell.exe
Token: SeShutdownPrivilege	920	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeSystemEnvironmentPrivilege	920	powershell.exe
Token: SeRemoteShutdownPrivilege	920	powershell.exe
Token: SeUndockPrivilege	920	powershell.exe
Token: SeManageVolumePrivilege	920	powershell.exe
Token: 33	920	powershell.exe
Token: 34	920	powershell.exe
Token: 35	920	powershell.exe
Token: 36	920	powershell.exe
Token: SeDebugPrivilege	2488	MSBuild.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
1776	msedge.exe
1776	msedge.exe
3676	firefox.exe
2356	AutoIt3.exe
2356	AutoIt3.exe
2356	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2356	AutoIt3.exe
2356	AutoIt3.exe
2356	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 5088	2644	Setup.exe	94
PID 5088 wrote to memory of 3328	5088	explorer.exe	95
PID 3328 wrote to memory of 412	3328	chrome.exe	96
PID 3328 wrote to memory of 1028	3328	chrome.exe	97
PID 3328 wrote to memory of 1028	3328	chrome.exe	97
PID 3328 wrote to memory of 3160	3328	chrome.exe	98
PID 3328 wrote to memory of 3804	3328	chrome.exe	99
PID 3328 wrote to memory of 3804	3328	chrome.exe	99
PID 3328 wrote to memory of 1836	3328	chrome.exe	101
PID 3328 wrote to memory of 1836	3328	chrome.exe	101
PID 3328 wrote to memory of 4552	3328	chrome.exe	102
PID 3328 wrote to memory of 4552	3328	chrome.exe	102
PID 5088 wrote to memory of 1776	5088	explorer.exe	104
PID 1776 wrote to memory of 2736	1776	msedge.exe	105
PID 1776 wrote to memory of 908	1776	msedge.exe	107
PID 1776 wrote to memory of 3188	1776	msedge.exe	108
PID 1776 wrote to memory of 3188	1776	msedge.exe	108
PID 1776 wrote to memory of 3188	1776	msedge.exe	108
PID 1776 wrote to memory of 4876	1776	msedge.exe	109
PID 1776 wrote to memory of 4876	1776	msedge.exe	109
PID 1776 wrote to memory of 3212	1776	msedge.exe	110
PID 1776 wrote to memory of 3212	1776	msedge.exe	110
PID 1776 wrote to memory of 3212	1776	msedge.exe	110
PID 1776 wrote to memory of 4896	1776	msedge.exe	111
PID 1776 wrote to memory of 4896	1776	msedge.exe	111
PID 1776 wrote to memory of 4896	1776	msedge.exe	111
PID 1776 wrote to memory of 1604	1776	msedge.exe	112
PID 1776 wrote to memory of 1604	1776	msedge.exe	112
PID 1776 wrote to memory of 1604	1776	msedge.exe	112
PID 1776 wrote to memory of 892	1776	msedge.exe	113
PID 1776 wrote to memory of 892	1776	msedge.exe	113
PID 1776 wrote to memory of 892	1776	msedge.exe	113
PID 1776 wrote to memory of 1444	1776	msedge.exe	117
PID 1776 wrote to memory of 1444	1776	msedge.exe	117
PID 1776 wrote to memory of 436	1776	msedge.exe	118
PID 1776 wrote to memory of 436	1776	msedge.exe	118
PID 3496 wrote to memory of 3676	3496	firefox.exe	120
PID 3496 wrote to memory of 3676	3496	firefox.exe	120
PID 3676 wrote to memory of 624	3676	firefox.exe	121
PID 3676 wrote to memory of 624	3676	firefox.exe	121
PID 3676 wrote to memory of 624	3676	firefox.exe	121
PID 3676 wrote to memory of 624	3676	firefox.exe	121
PID 3676 wrote to memory of 2736	3676	firefox.exe	134
PID 3676 wrote to memory of 2736	3676	firefox.exe	134
PID 3676 wrote to memory of 2736	3676	firefox.exe	134
PID 3676 wrote to memory of 2736	3676	firefox.exe	134
PID 3676 wrote to memory of 2516	3676	firefox.exe	126
PID 3676 wrote to memory of 2516	3676	firefox.exe	126
PID 3676 wrote to memory of 2516	3676	firefox.exe	126
PID 3676 wrote to memory of 556	3676	firefox.exe	127
PID 3676 wrote to memory of 556	3676	firefox.exe	127
PID 3676 wrote to memory of 556	3676	firefox.exe	127
PID 3676 wrote to memory of 556	3676	firefox.exe	127
PID 5088 wrote to memory of 4668	5088	explorer.exe	129
PID 5088 wrote to memory of 920	5088	explorer.exe	131
PID 5088 wrote to memory of 1564	5088	explorer.exe	133
PID 920 wrote to memory of 2356	920	powershell.exe	136
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138
PID 2356 wrote to memory of 3844	2356	AutoIt3.exe	138

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  \??\C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3288
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Badlisted process makes network request
      Registers new Windows logon scripts automatically executed at logon.
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:920
    - - C:\Users\Admin\AppData\Roaming\28c0b219d954\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Roaming\28c0b219d954\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\28c0b219d954\app.asar"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2356
      - C:\Users\Admin\AppData\Roaming\28c0b219d954\AutoIt3.exe
        
        C:\Users\Admin\AppData\Roaming\28c0b219d954\AutoIt3.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:3844
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff6cd5c728,0x7fff6cd5c734,0x7fff6cd5c740
    3⤵
    PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,14420467733582853809,3937257043535299874,262144 --field-trial-handle=1956,i,12148588008480643448,17336222527307456941,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:1028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,8444429722917710169,15086786979902818316,524288 --field-trial-handle=1956,i,12148588008480643448,17336222527307456941,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,16469392158136439213,6095666969234788746,524288 --field-trial-handle=1956,i,12148588008480643448,17336222527307456941,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,16185319633055259592,17956443047292715124,2097152 --field-trial-handle=1956,i,12148588008480643448,17336222527307456941,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,8277587409807256309,10580796458147406981,2097152 --field-trial-handle=1956,i,12148588008480643448,17336222527307456941,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff68bec188,0x7fff68bec194,0x7fff68bec1a0
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,8987641479773966316,9339608731080031391,524288 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,4272748551415440030,16552200573137440640,262144 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,15671081382928516698,4384298568947930302,524288 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4149149699178314806,6573480884704368492,2097152 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,5406101370198406139,9254299184658273455,2097152 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,14250214836033093456,8243492265119538986,2097152 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,17089957001267479087,11535235442810902291,2097152 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5495620473002906416,17224847800795227873,524288 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,15807531609941483709,16162734859164689015,524288 --field-trial-handle=2272,i,11839698621886889419,10726536137081747700,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    PID:436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2836 -prefsLen 24447 -prefMapHandle 2840 -prefMapSize 268500 -ipcHandle 2904 -initialChannelId {543eba58-6413-4369-b457-b7274133bb92} -parentPid 3676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2040 -prefsLen 24657 -prefMapHandle 2044 -prefMapSize 268500 -jsInitHandle 1828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1656 -initialChannelId {077b6676-f142-411e-a503-770a74103012} -parentPid 3676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3700 -prefsLen 25543 -prefMapHandle 3704 -prefMapSize 268500 -ipcHandle 3760 -initialChannelId {ace175a6-473c-462e-a627-bdcc80a0558a} -parentPid 3676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4076 -prefsLen 25690 -prefMapHandle 4080 -prefMapSize 268500 -jsInitHandle 4084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2040 -initialChannelId {2d30725d-0ba0-4d8f-82c1-b4ffe1764f53} -parentPid 3676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6caf4086-716f-4db2-9b92-fb1ba50996a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6caf4086-716f-4db2-9b92-fb1ba50996a8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e989c2a8-2525-46f1-9e0c-702424407239.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e989c2a8-2525-46f1-9e0c-702424407239.tmp
Size 130KB
SHA256 51bb1c88cdc5972a0a4c0cda2d9edc524f0c32f421b3d43088132ab617413426
MD5 27d9d573972cdc8fdaee9905e92f87cd
SHA1 22b970728714abe8b18ac35f9a934d2f29d99b83
SHA512 dd2f20d628fa736cae4db8ba83590a863e10a4e97ef01bf941616bb4222f81cef24f902530499d2ce9a1d4037defd3b31ec59acf46a471ccdf1afc9377c24bce
SSDEEP 3072:Y+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:Y+hFD+7t56OD9ZfSApprZ
TLSH
T114D31232AA91C8BBC9FC6541B197A300DE626CED45DE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6daff6d1-4b2c-4a3b-9cfc-7460245b9a91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6daff6d1-4b2c-4a3b-9cfc-7460245b9a91.tmp
Size 8KB
SHA256 59d6a71727a8fcb6672fe81512609174b853a4f747415e68214fbd943aa1ad68
MD5 29d07147337e531237a88f7b8c70dd9d
SHA1 a60fe81725aeee97d2ce4912442c6488487ecaf9
SHA512 b5d67f059278b2936d48f58ce8d54c0725a01b83d2691371e680123143fafb35560449b779e12389614196aeabd0a4fc793acf336e0cfc21b803527e5d6ff4ff
SSDEEP 192:6ON36yVQmiUyTZKcOCTVg5WOiR0ewjE+2K3UusqEU6:6ON36E6KcOCTV+WOiGewjE+2juqU6
TLSH
T13D12E935B8382CB79EE3AE05F48762579FE8216BD9866FD4D5D81E1C00C766C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

56a14fa8-5b59-4477-bc86-c95b6dc30e38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56a14fa8-5b59-4477-bc86-c95b6dc30e38.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c934dd92-4865-4011-82d0-07338c8b3d5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c934dd92-4865-4011-82d0-07338c8b3d5a.tmp
Size 8KB
SHA256 bfc466a22bcb3efe7443f7b8b7a945d4001dc1c179402e99fae1b7d446522902
MD5 a41ef283923590fceac06b3ffa2a4193
SHA1 d5a24483597491762ed9456d79e1ba27a950a776
SHA512 4bec6f5b607de32466f7d4ecc5f619e72a55e5aae551593cbebada1c7fdb2b9a018f882ea9430af384a7c23e809c2eff652d1f5cafd69c1e4d7eb122d79cd940
SSDEEP 192:SONu6ygpQmiUy+ZtOCTVg5WOiR0KzPugAU6:SONu6lHltOCTV+WOiGUutU6
TLSH
T1B602C734BC682CB79DB3AE06F48B37179FA8116BDA552F84DAD81E1C01D766C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bhc0xqg3.yyr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bhc0xqg3.yyr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 569KB
SHA256 62b263892008f5281a0c9be97e6e3929af6221a1626226adf58b4c25cedce945
MD5 b808663fce0c985ddef8caeb49b21b74
SHA1 784450044dde4c00629b0e5f17c36dfef5b2b0c5
SHA512 de20abe3a95a9f48ad2c7d17cd95dfc24262b04321feb0568728764b5954473ab57c01062e451bf7d1807b25eb89123ce4e3f9e7da374371b9b2dd7f12519219
SSDEEP 12288:iGyRrVe1TieklEZB1BzcUyIAseVVscfThjls11iiRoSTC2EJ4OaW4nemWnv:iGyRJe12ZEZB1BzJyFFfvfTh5sNoG1mH
TLSH
T14CC4F1F9F3613CA3ABBE030B9E866EED1B625226874FE0CC447757C2455772EAE64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\28c0b219d954\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\28c0b219d954\app.asar
Size 1.2MB
SHA256 b0c91b93ddee4b0601c2cdc47db6a3f1ff66387973a543dff4a1bf15703b043c
MD5 ff8ece1e6ec95d93c5fed1afd7d1d549
SHA1 192c3e1a8597835971da71eb5ca6c38ffa2093c8
SHA512 c566a16af574f74906da2738ceaa40469ed181d8f4d1731b1ac640f7bbf3e1d307be81779e4aee305bbf44115a6b1c526747f37da58f2ff8c6e112d2c0ade0ed
SSDEEP 24576:mzu/+T3ocjq4oj/cgWRfQRI5RabJ/XKXIc+6rHT0arRULSAnpjg498YtqdxxURf:Gvjq4oz2L0d/KXImrQarRkn5pvtqdxxm
TLSH
T1874533FAD9D08563778D3E4B3C8BD9B6DA364E6609DA4504F702585326E9C3B30CA393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 a6da8dfcf437cd54fb9f3c9ec9a340dd091d48dfd676b59400ef4f1c4789e560
MD5 66edbe3ae8ec86817451c3728e0e8497
SHA1 b967e808b0b0df1c0f1f5137a8745b069e575f9e
SHA512 59ef3c84e9b39fa83e17bfb573d316a68de6d571df9e7aa1d1c44a12b6e6075abec097dc0979f982174e1d512f64cf7d21db3249be89af29e5abf933e7b934ab
SSDEEP 192:bkI4v3Umldvt8dhEpm943DL96gDsyL4kY3:bkI4v3Umldvt8dhWm94zL96oFL4H3
TLSH
T17C12641549048EB82A4EA79BBB367D01C27D473B60845C38B4DD8FC942FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 4826efc0b4ec67f257d2838fc76ce03637e6611a1424d6c8f649c64eeb5cce71
MD5 aa6a603b55642a65261aed70d392d86a
SHA1 da9253f14042c90f07ab94623cb5e46ea4eb8bc2
SHA512 ea8defc8922513df79962d20c39aad397dc0a79dd91f9cf9ceb50d72ab83f1fa5775aab170a1bbe0c385fcf59a12b7fb85fd36ffa0092e21a72869924a289bf0
TLSH
T1A07120B96514CF6F74BA776CBC648871AA72013BB7BF688210E890C4400CF3846E5AD7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 73ae2d59f8784767c64d9c35327a63cff3ca0e51021011916bf8bcd381dfb47f
MD5 503aebb839296d09b59fde0f506d0638
SHA1 018bf9458a36d929970a786c0611f3aa00a38c6a
SHA512 72924e1c1fad38a01e26e81acd504afc3d3ae620ba776730a25f53e90d59e99fe9b641d0efda4829248985019babced08b454097217b55ac69189aa433e6426e
TLSH
T16131DCA66909CF6FA0B5767CFC144960D6730136B6BF9C8221B890858018F3447F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 a83ee7ca8f6e9d4a7e14457649630271c183a6b453754dbdf181297311234566
MD5 c2d9875107778aa36f09089f090b3ae3
SHA1 3c9e205675366f8bfe870e0951596d61cf1cdd6a
SHA512 cbcf0890d133c283bd5e84b88e3089e74eaec54c160f22850cef6240bd7abe219a0bffa6f31a9ca85020edd589b20fbbe2a5ed6601ac421f322431efab0b84bd
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0JZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW4yh44CfiaR/skL0H7
TLSH
T12123448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 856078548ace421a0bc0c57c36c67028aaddd32a6c77e37a1cc3aa416ea0765d
MD5 9557a54a2866e45ed2c9e8903394f59f
SHA1 64fb10b2faddd078342f30a0da2d9616a39f23b9
SHA512 62f96d04582adad511babc1c7663cd77e913801d6e75b1accae14ab495769f9f197d96e3a4cfd7f89e1e28483e6292834536ebbd39135a67b8e20bd5ec5a27f7
SSDEEP 192:wa16S6CdFAWKsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAW1HjhcfZ6k0H79H2h4f+Tf
TLSH
T12143848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C841F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cor_a9b24bb2a01b0c1b.tmp

Path C:\Windows\Temp\cor_a9b24bb2a01b0c1b.tmp
Size 701KB
SHA256 ec3922d13e3e2b2e31a79699e495c61f2a4724447b378f330979997bee929af6
MD5 1cf01d7d701e680a671938c4cf80f8fb
SHA1 bc998d8e17d83a75b10e9f8c88d07f02d21f7d02
SHA512 8be77290e3bac4ec0f48e4e31dc5ac45142d566f9c632e332179d573b4c9eb61fdfeb68a175e77ad8f839781f1e29dc8a8df0dc3c0ea3accf2f7fc4c45d40b38
SSDEEP 12288:sXQD0KohjePYepXV7OA7Rw7rS/FQMLaDeCGdL1gjlDB/23hnnnnnnn7nnnnnnnn1:VYNh6l7OAVaG/FQ9eCGdL1gjlDY3hnnx
TLSH
T113E4022BE60167FF4141D56FC241A2EAF73E3056E24AC0E7CB2935915EC9B97418DCE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-270-0x000001BFCA2E0000-0x000001BFCA302000-memory.dmp

Download

memory/920-281-0x000001BFCA770000-0x000001BFCA79A000-memory.dmp

Download

memory/920-282-0x000001BFCA770000-0x000001BFCA794000-memory.dmp

Download

memory/2356-298-0x000002832B8A0000-0x000002832B8A1000-memory.dmp

Download

memory/2356-297-0x00007FFF89C90000-0x00007FFF89E85000-memory.dmp

Download

memory/2488-313-0x000002AF509F0000-0x000002AF50A5C000-memory.dmp

Download

memory/2488-314-0x000002AF50D40000-0x000002AF50F02000-memory.dmp

Download

memory/2488-315-0x000002AF384C0000-0x000002AF38510000-memory.dmp

Download

memory/2488-316-0x000002AF50B70000-0x000002AF50BE6000-memory.dmp

Download

memory/2488-318-0x000000006B000000-0x000000006B007000-memory.dmp

Download

memory/2488-317-0x0000000060000000-0x000000006000F000-memory.dmp

Download

memory/2644-7-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/2644-17-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/2644-0-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/2644-6-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/2644-5-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/2644-8-0x0000000002C50000-0x0000000002CFF000-memory.dmp

Download

memory/3844-309-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/3844-307-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/3844-312-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/3844-310-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/3844-300-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/3844-308-0x00000210BF1E0000-0x00000210BF27D000-memory.dmp

Download

memory/4668-256-0x0000000002FC0000-0x0000000003592000-memory.dmp

Download

memory/4668-262-0x0000000002FC0000-0x0000000003592000-memory.dmp

Download

memory/4668-255-0x0000000000AD0000-0x0000000000AD3000-memory.dmp

Download

memory/4668-260-0x0000000002FC0000-0x0000000003592000-memory.dmp

Download

memory/4668-261-0x0000000002FC0000-0x0000000003592000-memory.dmp

Download

memory/5088-123-0x0000000000280000-0x0000000000288000-memory.dmp

Download

memory/5088-16-0x0000000077CC2000-0x0000000077CC3000-memory.dmp

Download

memory/5088-13-0x000000006B000000-0x000000006B0D9000-memory.dmp

Download

memory/5088-14-0x000000006B000000-0x000000006B0D9000-memory.dmp

Download

memory/5088-12-0x000000006B000000-0x000000006B0D9000-memory.dmp

Download