8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

max time kernel
299s
max time network
294s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/11/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261114-celj8aby3t
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2772 created 3396	2772	explorer.exe	57
PID 2772 created 3396	2772	explorer.exe	57
PID 2772 created 3396	2772	explorer.exe	57

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3584	powershell.exe
824	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 2772	4412	Setup.exe	89

Loads dropped DLL 1 IoCs

pid	Process
2772	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3324	msedge.exe
1660	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4412	Setup.exe
4412	Setup.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2772	explorer.exe
2772	explorer.exe
2772	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	824	powershell.exe
Token: SeSecurityPrivilege	824	powershell.exe
Token: SeTakeOwnershipPrivilege	824	powershell.exe
Token: SeLoadDriverPrivilege	824	powershell.exe
Token: SeSystemProfilePrivilege	824	powershell.exe
Token: SeSystemtimePrivilege	824	powershell.exe
Token: SeProfSingleProcessPrivilege	824	powershell.exe
Token: SeIncBasePriorityPrivilege	824	powershell.exe
Token: SeCreatePagefilePrivilege	824	powershell.exe
Token: SeBackupPrivilege	824	powershell.exe
Token: SeRestorePrivilege	824	powershell.exe
Token: SeShutdownPrivilege	824	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeSystemEnvironmentPrivilege	824	powershell.exe
Token: SeRemoteShutdownPrivilege	824	powershell.exe
Token: SeUndockPrivilege	824	powershell.exe
Token: SeManageVolumePrivilege	824	powershell.exe
Token: 33	824	powershell.exe
Token: 34	824	powershell.exe
Token: 35	824	powershell.exe
Token: 36	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	824	powershell.exe
Token: SeSecurityPrivilege	824	powershell.exe
Token: SeTakeOwnershipPrivilege	824	powershell.exe
Token: SeLoadDriverPrivilege	824	powershell.exe
Token: SeSystemProfilePrivilege	824	powershell.exe
Token: SeSystemtimePrivilege	824	powershell.exe
Token: SeProfSingleProcessPrivilege	824	powershell.exe
Token: SeIncBasePriorityPrivilege	824	powershell.exe
Token: SeCreatePagefilePrivilege	824	powershell.exe
Token: SeBackupPrivilege	824	powershell.exe
Token: SeRestorePrivilege	824	powershell.exe
Token: SeShutdownPrivilege	824	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeSystemEnvironmentPrivilege	824	powershell.exe
Token: SeRemoteShutdownPrivilege	824	powershell.exe
Token: SeUndockPrivilege	824	powershell.exe
Token: SeManageVolumePrivilege	824	powershell.exe
Token: 33	824	powershell.exe
Token: 34	824	powershell.exe
Token: 35	824	powershell.exe
Token: 36	824	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
4356	msedge.exe
4356	msedge.exe
2052	firefox.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1396	2772	explorer.exe	91
PID 1396 wrote to memory of 2288	1396	chrome.exe	92
PID 1396 wrote to memory of 4732	1396	chrome.exe	93
PID 1396 wrote to memory of 1660	1396	chrome.exe	94
PID 1396 wrote to memory of 4732	1396	chrome.exe	93
PID 1396 wrote to memory of 5016	1396	chrome.exe	95
PID 1396 wrote to memory of 5016	1396	chrome.exe	95
PID 1396 wrote to memory of 2656	1396	chrome.exe	96
PID 1396 wrote to memory of 2656	1396	chrome.exe	96
PID 1396 wrote to memory of 2432	1396	chrome.exe	97
PID 1396 wrote to memory of 2432	1396	chrome.exe	97
PID 1396 wrote to memory of 3528	1396	chrome.exe	98
PID 1396 wrote to memory of 3528	1396	chrome.exe	98
PID 2772 wrote to memory of 4356	2772	explorer.exe	100
PID 4356 wrote to memory of 2900	4356	msedge.exe	101
PID 4356 wrote to memory of 936	4356	msedge.exe	103
PID 4356 wrote to memory of 3324	4356	msedge.exe	102
PID 4356 wrote to memory of 936	4356	msedge.exe	103
PID 4356 wrote to memory of 936	4356	msedge.exe	103
PID 4356 wrote to memory of 3024	4356	msedge.exe	104
PID 4356 wrote to memory of 3024	4356	msedge.exe	104
PID 4356 wrote to memory of 4560	4356	msedge.exe	105
PID 4356 wrote to memory of 4560	4356	msedge.exe	105
PID 4356 wrote to memory of 4560	4356	msedge.exe	105
PID 4356 wrote to memory of 1716	4356	msedge.exe	106
PID 4356 wrote to memory of 1716	4356	msedge.exe	106
PID 4356 wrote to memory of 1716	4356	msedge.exe	106
PID 4356 wrote to memory of 4196	4356	msedge.exe	107
PID 4356 wrote to memory of 4372	4356	msedge.exe	108
PID 4356 wrote to memory of 4196	4356	msedge.exe	107
PID 4356 wrote to memory of 4196	4356	msedge.exe	107
PID 4356 wrote to memory of 4372	4356	msedge.exe	108
PID 4356 wrote to memory of 4372	4356	msedge.exe	108
PID 4356 wrote to memory of 4308	4356	msedge.exe	111
PID 4356 wrote to memory of 4308	4356	msedge.exe	111
PID 4356 wrote to memory of 1308	4356	msedge.exe	113
PID 4356 wrote to memory of 1308	4356	msedge.exe	113
PID 5088 wrote to memory of 2052	5088	firefox.exe	116
PID 5088 wrote to memory of 2052	5088	firefox.exe	116
PID 2052 wrote to memory of 2808	2052	firefox.exe	117
PID 2052 wrote to memory of 2808	2052	firefox.exe	117
PID 2052 wrote to memory of 2808	2052	firefox.exe	117
PID 2052 wrote to memory of 2808	2052	firefox.exe	117
PID 2052 wrote to memory of 1288	2052	firefox.exe	118
PID 2052 wrote to memory of 1288	2052	firefox.exe	118
PID 2052 wrote to memory of 1288	2052	firefox.exe	118
PID 2052 wrote to memory of 1288	2052	firefox.exe	118
PID 2052 wrote to memory of 3508	2052	firefox.exe	119
PID 2052 wrote to memory of 3508	2052	firefox.exe	119
PID 2052 wrote to memory of 3508	2052	firefox.exe	119
PID 2052 wrote to memory of 2488	2052	firefox.exe	120
PID 2052 wrote to memory of 2488	2052	firefox.exe	120
PID 2052 wrote to memory of 2488	2052	firefox.exe	120
PID 2052 wrote to memory of 2488	2052	firefox.exe	120
PID 2772 wrote to memory of 4740	2772	explorer.exe	122
PID 2772 wrote to memory of 3584	2772	explorer.exe	123
PID 2772 wrote to memory of 824	2772	explorer.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3396
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3584
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x84,0x130,0x7ff8b007c728,0x7ff8b007c734,0x7ff8b007c740
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,16692532269444276546,8528341813872571465,262144 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,12283798735664567364,4428076953763285888,524288 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,32953693683852206,8794906891199098406,524288 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,13641155174302977027,2896139595872239283,2097152 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,8020152351942934915,16414107570871386398,2097152 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,3420248365783244246,11737876991059639096,2097152 --field-trial-handle=1996,i,2042741085250346522,3562599980789429162,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff8ac37c188,0x7ff8ac37c194,0x7ff8ac37c1a0
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2214247274571501877,1988119508124635993,524288 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,14653948951115711318,15514588118338666772,262144 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,4717429079156862762,12205609986131770349,524288 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,383162718642257450,4563308629936864044,2097152 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16169382708575178327,3670373144860583238,2097152 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,13015533153929998299,13746054789456189220,2097152 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,6303721934152214320,14529211202248294245,2097152 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7733537026073335323,8291673412503777586,524288 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,874364295913763950,17565560483246565276,524288 --field-trial-handle=2240,i,3110958347720626370,8554983832310665675,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:1308
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2692 -prefsLen 24448 -prefMapHandle 2696 -prefMapSize 268500 -ipcHandle 2772 -initialChannelId {8f6eba13-fa93-4653-a79b-4d705a964579} -parentPid 2052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1952 -prefsLen 24658 -prefMapHandle 1912 -prefMapSize 268500 -jsInitHandle 1916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1776 -initialChannelId {dbe20d9c-ccdb-4418-9e3d-974e5a13a4c5} -parentPid 2052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3684 -prefsLen 25545 -prefMapHandle 3688 -prefMapSize 268500 -ipcHandle 3732 -initialChannelId {b56f1f64-80d6-4c0a-83db-0b63fe91fa28} -parentPid 2052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4060 -prefsLen 25607 -prefMapHandle 4064 -prefMapSize 268500 -jsInitHandle 4068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4076 -initialChannelId {4bcbd948-b26c-4d06-8910-db43d68a58f8} -parentPid 2052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

43f4a128-b85f-47e6-a715-d36ab7f29d87.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\43f4a128-b85f-47e6-a715-d36ab7f29d87.tmp
Size 131KB
SHA256 8b7ab72ac31917734ac96814e1a45723dddc8e645f33fc303e52909759aa8acf
MD5 01bef8aefb5ee921f30c5692fcdc1128
SHA1 f5580df636d25ec97967c6d699110059e9706800
SHA512 d113fb174efdbc0f0e59b7e1eea4f673f40c4c5d808ecce831372dadbd2050e4f9a40461ff481c7f3e07e2b53bae97035ba9a3d998f5dbfba37d7d2c212a5baa
SSDEEP 3072:g3IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:g/Ptbmf1K49XLWbEPi4NTKlLzW
TLSH
T17ED312217D01BCB4E9AEDB21B2902A15EAB8D94B95393FE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20d78ef2-f3cc-4e7c-9865-b2f8238d0792.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\20d78ef2-f3cc-4e7c-9865-b2f8238d0792.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

531a19e9-95d1-46e0-bd1c-c91d7a7009f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\531a19e9-95d1-46e0-bd1c-c91d7a7009f3.tmp
Size 8KB
SHA256 4b0624f8eca484f52d3bf985711183ecb32bfd888add3947a058472f4a03c6ac
MD5 9d0dd28943a90edd9bef3504efbeea64
SHA1 f1e060c49303a7032ab62b3b48e34e5de0b36b83
SHA512 ad5f3e2f5d81ecc266794437fdacae07ab79256c057d590ce22e1b5a75348f86b0fb67ef144128ffcf50fbd3d908b1576656cda237ccf70d64faf731545f5344
SSDEEP 192:2ON368+2QmiUyCftGCaX/QHjzoLVUOXdLkQYMjqvDU6:2ON36BSptGCaXIveVUOXdLSJDU6
TLSH
T1FA12D935A8787C679EE2BE55B48B3B239FD4112BA6845F54DAE81E2C00D764C234AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f584a210a80810dcf70390eb86fe52a56c51ec17c3dc5bdad617c5592045fbf3
MD5 3f81b351aa581c722c62b505045d7be4
SHA1 aee3577cce62b5fc7e839373f1bbc460a57709e4
SHA512 e189804c66664bd7981164d77ac00dcad8e4a021039a525920cfc7e66607550c4e3dab61b8edb330b231c90ec362bf990464188fa10869f34c8d8a72aea189a1
TLSH
T109D02BB887B81E70F0231035B7250244398DC5084A07510BC0B012EB0C823D20200060
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d55f2c99b845161db37b100a47911bb408c97298230373b32b80504c093bdac
MD5 8c772c59cfb695752e285fc03e7d22ef
SHA1 ff46f5b2251e7cc5c8e51640b09a38994028a644
SHA512 be52bbbac241192660826ed6b064f8e1f1b9d15d161649f6af945c26fd833decc6799a8da172d8dc1a18290617adcecb8499c61c274c41423022dd426cb064a6
TLSH
T120D02BB8C7781A70F0231035B7260244398DC5084A07100AC0B012EB0C813920200060
MD5 SHA1 SHA512 TLSH

Submit Download

09062f02-698b-4f34-b18d-a343f2a5beee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09062f02-698b-4f34-b18d-a343f2a5beee.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2c105ae-cefc-4b89-8828-b0d629373f92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2c105ae-cefc-4b89-8828-b0d629373f92.tmp
Size 8KB
SHA256 2c5272a112b383cee4eb649f4fc015fa627c2676c64c644249ef23ac4b9e89c3
MD5 37f2497cd18f498ed621ddfd48a61965
SHA1 a8d5364ab69be90b6cf255605e2850e18c2e67a5
SHA512 023a599bc4e02fa63717b8209989b953a1ff2c1d6d3265f0c0809c98e967caba5d52d0c3c00e73a1b28a6a48a5e9c775d39c208089f9696af6be035c603c0a29
SSDEEP 192:SONc68+7QmiUyHf1GCaX/QHjzoLVP0LmlU6:SONc6Bt+1GCaXIveV6OU6
TLSH
T1F802CB39AC747C778EE3BE45B58A3B239FD4112BA6945F44DAE81B2C01D764C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5v135r4j.pg3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5v135r4j.pg3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 567KB
SHA256 7c49fcc218f681941410387904a9df288d0e31759d53cdc06a641a5eb3415a92
MD5 47b7a01bfacb805bfcaccffa6f3e3f04
SHA1 dd1e569072a8c6f6c1192df8f51413bdc41220c4
SHA512 12ba904748a4dcaac883e466bf79293b105d33346594bc7ff749e6a162489cac56482588d3274998e6fd11d8c0fcfd50ce4989f50eb02a503556064a8a5c638a
SSDEEP 12288:xHcsmIPYQw45/SVwSEKkrcnjVHeUtc11iiR8en/dVVscSDDS+iJaiaW4neJvH:hcshw45szEKk4jVHeqcN8U1fvSnt4mjo
TLSH
T1C4C4F1FAF7603CB3A7BE02079D9A7EED1B625222878FE0CC44675BC24557729AF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 5121f8ed3442b4dca8ad25a6f45497b43fbd8ef90fce62fb654e0dd969a6ebea
MD5 dd9af8d0ed67e9f06d930924a412ffe1
SHA1 4bd028212593f9481a4a81c837f3973caa5408bc
SHA512 5d35c6bd57c0ff179763635feaceca7bf9852f044cf6fc74a75fe775ff3ccbba40092d425f6018ef3725a0dad9cac20f58f353c7bad11415c7edaf739d9798a4
SSDEEP 96:TRzMM102nmWKi03T+mRQ9n4KY/Q/P6DpBlz:lMM102naLqmRQ9FPwpBF
TLSH
T1B391EA1FB57484631B31F5E62D072BA8F103B007DDE2DDB8B12ADDA289683E981D958D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 12010d9ccc18e015a0726c03e77be8f4231f77a878d556d980c7e2e155d77be6
MD5 9aaefd8b6a3c60305e047fe44ddaffaf
SHA1 ace5360d2242e0bc95ef2f9ff11fa7877564cce2
SHA512 64e5e4d4d50d984d48e34b185d25b07214376be48f3b62509bb771acbcf900e7f86c284075a852addd68f00cbb086cc8166e84fa693fcdcaeb2778300c04f48c
TLSH
T18A2137B8184C1931E5B5781A2A5FF701CAF1F256DA40AF6CDAA91C284CC74F4936152F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 75KB
SHA256 49c1c7e25a85d3fbdc43f2108cacf9869f374f84ff2fde0594c35929694be6a5
MD5 f376be39eaedfd5e050a265c6096623b
SHA1 5a5dcd50f442816a4d5762d238c9eb1f2e2e230c
SHA512 7041bf4249b890d2863e23f009ef9ebb19fba9aba4d2ae59fec37f8d4c79c028af5076d90ac05c803b670aee237083e16cdd1568b514e20f9c2caa577c22e997
SSDEEP 768:0y/ToUxjcfw6TkOdy00aeno83m6m/pvxZSlncJ1JbedSv3vLvbm:v/L6TVgfdm5BvDShcJ1Jbf/Djm
TLSH
T1BF73F9B396E872FB0BA577C72C0FB55B66E54186F34501C9ECEEC91C80CC694027A9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 ac66d9cd8e7bdccd5861f0818b4d21b31c085e4c2ba090389e739e1477bfd80c
MD5 9ac5a80e4bae39c305512c9d252bcfea
SHA1 8b57de76b60c23ef492c226b066bbd6f3e778e71
SHA512 b0ca0a6ad3a1ffe4e098ffdfe9290b3e33409d1bd1ddd7b5abb85adf3553476a7cd5b5959d24b7982db9d086acf8b223ea820633f2946e14b817a1e24f4abc77
TLSH
T1BDC080471B9F4C7135D3C791308E44B0C56E15766886F594B0989B49515E92319C6221
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 10KB
SHA256 14f6b2bf194a7090b003420713a8aae05b1fc9dcc8c2dbb0b75f7d4021943314
MD5 dade0074ba963f8d955d6decaa86b561
SHA1 8693a4e0bba5e834c1bc44e1cd2d96c732f2df39
SHA512 7fb73ac72194d8cf0430f1d1b7bf1e143d9903e9482525a4efaed1262977859ae63d8076060225fc4d8cb5c2a2c1d2de0ebc3850f49eb7b7585b5f3d51c0f27a
SSDEEP 192:5kI4vUUmldvr8dhEp9943DU96gDAIL4kYkL4DDT:5kI4vUUmldvr8dhW994zU96oHL4HkL4r
TLSH
T1BD32521549049EB8294FA78BBB367D02C27D473B60845C38B4DD8FC842FA5B906FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 bb87dcd8db5553c517cbfafedaef6d0a7af2ccc1ea6299c402d128ab6a5d569f
MD5 11c618899aa0eda77de9ae187720015f
SHA1 875aa891a0495adb2224bdc599be62dcecebd5d4
SHA512 8a1958ea9eb35664e28302b03204e099b7e9bd1814e3652a1dd438e092acfb58db44540a694a0e8db53ddadda318372ea5136543fdf6cb04fa07bb832a418385
TLSH
T11B411DB915048F6FE4F6336CBC1889729EB2417BB67F688220F48081450CF3856F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 b284b61da4c6233becb08ab12fd76c1ca358c4690ccc571096a10fcc8d87d70f
MD5 778a6b297f378ba8dee3a1e3efe2ab60
SHA1 6c88914ffc713e861645fc39bc98e4ae19a5ffa6
SHA512 b3cab9223bf9666c97a7f432e6afcb93ca2c0a089facefa937fe9d9ddeaa56e12aa56e795fa2b2822bea823198c63e4973da849acc3bf534d99f8b1daf11e0ad
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0SZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWfyh44CfiaR/skL0H7
TLSH
T1E723448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 d5143fb4efc05862daaf356cb9b2bee5b9ffc0ef27d0b6245bb520d7975c7d73
MD5 a3956578d071c8c5eb6c0953334a01b0
SHA1 efb01bef6495f2b42d981f3f7be4a48b3a5b1d2c
SHA512 80432b5eb103fa5cdd0cfe773c52d5a7654223d81eafcb79ef2bb622bd9e17b01e57d0e806b48bd8341c55ed9ec205a56531125209afd580fb0deb4ee21791db
SSDEEP 768:N6S6CrAWYj+f3aY3p6x3I0H7/29fUcHLeHnHf:N6S67y3aY3p6x3L8UcHLeHn/
TLSH
T1864396CA3633DD51CB29E47E62A642FB544FA2DD003113886A9E9F4C441B5979E2FFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 376KB
SHA256 329c514547627ae79cafdb8cc071810cbc8451b025727cd127344f3e02d57208
MD5 2b8310dde048c61e29a6a1584807c37c
SHA1 595c6fccc53a34847e49115010be4119d7f9cfca
SHA512 3ea05f335798f6f11dde5801d15f5b9b3181c9b36b9739caf34677e68c6b64cc827b11db83ec27ce07397b20cb60e588da267aacd99704bca3da0195b16507b6
SSDEEP 6144:maY3p6x3v+eHPcH0e3y3AY4Sq2tb/tPP1Ipvp6ua3q1:nFBq
TLSH
T12C84E8A53064C193C322D837DB4DB3B7243FE29894E7E78893701748396EA1FAAD9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi_b7658965b7f756f7.tmp

Path C:\Windows\Temp\msi_b7658965b7f756f7.tmp
Size 712KB
SHA256 d0bdd462ff336ca577a794c617bc165a53e74d9d349bb3025ff2647215d2a838
MD5 57938a366d51bd22c909bc6a9d1c0ae4
SHA1 e40f55486b55806d9d6475e74ba0e05ad5c4fbc7
SHA512 514c1ee4e93ed0ae5fbbcee0d1ab37e436ff5e7991557de7291e26ef578077a2de41b57792ed4025ac10b08aa2f340822e4556beea7f29f86a2c53baaddf6139
SSDEEP 12288:9Zk2KIdAIBkBy2aKs/epFCpCvA5KlV6pGNMHNKgwjh1TzvCPQBZfCqnnnnnnnTnM:jk+yIC7CeqCvIKlVJMHNqDZfQ
TLSH
T16FF4021157B4604E7A20258986DFFD953EF7AE26F8DF2D4506C83808BCEC745A2D8DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-368-0x0000019D7FBA0000-0x0000019D7FBC4000-memory.dmp

Download

memory/824-366-0x0000019D7FB10000-0x0000019D7FB1A000-memory.dmp

Download

memory/824-367-0x0000019D7FBA0000-0x0000019D7FBCA000-memory.dmp

Download

memory/824-369-0x0000019D7FB70000-0x0000019D7FB82000-memory.dmp

Download

memory/2772-332-0x0000000000C60000-0x0000000000C68000-memory.dmp

Download

memory/2772-11-0x00000000775D3000-0x00000000775D4000-memory.dmp

Download

memory/2772-13-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2772-14-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2772-15-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2772-17-0x00000000775D3000-0x00000000775D4000-memory.dmp

Download

memory/3584-347-0x0000014E77E40000-0x0000014E77E62000-memory.dmp

Download

memory/4412-0-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4412-18-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4412-5-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4412-6-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4412-7-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4412-8-0x0000000003210000-0x00000000032C2000-memory.dmp

Download

memory/4740-333-0x00000000007D0000-0x00000000007D3000-memory.dmp

Download

memory/4740-334-0x0000000002BD0000-0x00000000031A2000-memory.dmp

Download

memory/4740-339-0x0000000002BD0000-0x00000000031A2000-memory.dmp

Download

memory/4740-340-0x0000000002BD0000-0x00000000031A2000-memory.dmp

Download

memory/4740-338-0x0000000002BD0000-0x00000000031A2000-memory.dmp

Download