8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

max time kernel
299s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/11/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261114-celj8aby3t
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2168 created 3244	2168	explorer.exe	54
PID 2168 created 3244	2168	explorer.exe	54
PID 2168 created 3244	2168	explorer.exe	54

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3380	powershell.exe
4076	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 2168	1088	Setup.exe	80

Loads dropped DLL 1 IoCs

pid	Process
2168	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3504	chrome.exe
3384	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1088	Setup.exe
1088	Setup.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2168	explorer.exe
2168	explorer.exe
2168	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeShutdownPrivilege	4836	chrome.exe
Token: SeCreatePagefilePrivilege	4836	chrome.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe
Token: SeIncreaseQuotaPrivilege	4076	powershell.exe
Token: SeSecurityPrivilege	4076	powershell.exe
Token: SeTakeOwnershipPrivilege	4076	powershell.exe
Token: SeLoadDriverPrivilege	4076	powershell.exe
Token: SeSystemProfilePrivilege	4076	powershell.exe
Token: SeSystemtimePrivilege	4076	powershell.exe
Token: SeProfSingleProcessPrivilege	4076	powershell.exe
Token: SeIncBasePriorityPrivilege	4076	powershell.exe
Token: SeCreatePagefilePrivilege	4076	powershell.exe
Token: SeBackupPrivilege	4076	powershell.exe
Token: SeRestorePrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeSystemEnvironmentPrivilege	4076	powershell.exe
Token: SeRemoteShutdownPrivilege	4076	powershell.exe
Token: SeUndockPrivilege	4076	powershell.exe
Token: SeManageVolumePrivilege	4076	powershell.exe
Token: 33	4076	powershell.exe
Token: 34	4076	powershell.exe
Token: 35	4076	powershell.exe
Token: 36	4076	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
4836	chrome.exe
3192	msedge.exe
3192	msedge.exe
4920	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4836	2168	explorer.exe	81
PID 4836 wrote to memory of 4968	4836	chrome.exe	82
PID 4836 wrote to memory of 1760	4836	chrome.exe	83
PID 4836 wrote to memory of 1760	4836	chrome.exe	83
PID 4836 wrote to memory of 3504	4836	chrome.exe	84
PID 4836 wrote to memory of 3264	4836	chrome.exe	85
PID 4836 wrote to memory of 3264	4836	chrome.exe	85
PID 4836 wrote to memory of 2552	4836	chrome.exe	87
PID 4836 wrote to memory of 4320	4836	chrome.exe	88
PID 4836 wrote to memory of 2552	4836	chrome.exe	87
PID 4836 wrote to memory of 4320	4836	chrome.exe	88
PID 4836 wrote to memory of 416	4836	chrome.exe	89
PID 4836 wrote to memory of 416	4836	chrome.exe	89
PID 2168 wrote to memory of 3192	2168	explorer.exe	91
PID 3192 wrote to memory of 2328	3192	msedge.exe	92
PID 3192 wrote to memory of 3384	3192	msedge.exe	93
PID 3192 wrote to memory of 2072	3192	msedge.exe	94
PID 3192 wrote to memory of 2072	3192	msedge.exe	94
PID 3192 wrote to memory of 2072	3192	msedge.exe	94
PID 3192 wrote to memory of 1360	3192	msedge.exe	96
PID 3192 wrote to memory of 1360	3192	msedge.exe	96
PID 3192 wrote to memory of 1700	3192	msedge.exe	98
PID 3192 wrote to memory of 5080	3192	msedge.exe	97
PID 3192 wrote to memory of 1700	3192	msedge.exe	98
PID 3192 wrote to memory of 1700	3192	msedge.exe	98
PID 3192 wrote to memory of 5080	3192	msedge.exe	97
PID 3192 wrote to memory of 5080	3192	msedge.exe	97
PID 3192 wrote to memory of 2748	3192	msedge.exe	99
PID 3192 wrote to memory of 1160	3192	msedge.exe	100
PID 3192 wrote to memory of 4316	3192	msedge.exe	101
PID 3192 wrote to memory of 2748	3192	msedge.exe	99
PID 3192 wrote to memory of 2748	3192	msedge.exe	99
PID 3192 wrote to memory of 244	3192	msedge.exe	102
PID 3192 wrote to memory of 1160	3192	msedge.exe	100
PID 3192 wrote to memory of 1160	3192	msedge.exe	100
PID 3192 wrote to memory of 4316	3192	msedge.exe	101
PID 3192 wrote to memory of 4316	3192	msedge.exe	101
PID 3192 wrote to memory of 244	3192	msedge.exe	102
PID 3192 wrote to memory of 244	3192	msedge.exe	102
PID 3192 wrote to memory of 488	3192	msedge.exe	103
PID 3192 wrote to memory of 488	3192	msedge.exe	103
PID 3192 wrote to memory of 4464	3192	msedge.exe	104
PID 3192 wrote to memory of 4464	3192	msedge.exe	104
PID 880 wrote to memory of 4920	880	firefox.exe	106
PID 880 wrote to memory of 4920	880	firefox.exe	106
PID 4920 wrote to memory of 4416	4920	firefox.exe	107
PID 4920 wrote to memory of 4416	4920	firefox.exe	107
PID 4920 wrote to memory of 4416	4920	firefox.exe	107
PID 4920 wrote to memory of 4416	4920	firefox.exe	107
PID 4920 wrote to memory of 3812	4920	firefox.exe	108
PID 4920 wrote to memory of 3812	4920	firefox.exe	108
PID 4920 wrote to memory of 3812	4920	firefox.exe	108
PID 4920 wrote to memory of 3812	4920	firefox.exe	108
PID 4920 wrote to memory of 4968	4920	firefox.exe	109
PID 4920 wrote to memory of 4968	4920	firefox.exe	109
PID 4920 wrote to memory of 4968	4920	firefox.exe	109
PID 4920 wrote to memory of 2776	4920	firefox.exe	110
PID 4920 wrote to memory of 2776	4920	firefox.exe	110
PID 4920 wrote to memory of 2776	4920	firefox.exe	110
PID 4920 wrote to memory of 2776	4920	firefox.exe	110
PID 2168 wrote to memory of 5088	2168	explorer.exe	111
PID 2168 wrote to memory of 3380	2168	explorer.exe	112
PID 2168 wrote to memory of 4076	2168	explorer.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3380
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffbe8dec728,0x7ffbe8dec734,0x7ffbe8dec740
    3⤵
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,13032008627480335515,5902708923294265469,262144 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1524,i,1164303132028351056,5933020802058444303,524288 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,2244117715765341858,1505953976734769175,524288 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2404 /prefetch:13
    3⤵
    PID:3264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,17863304942484383832,6769486056863838629,2097152 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,4731078113749316023,10174881555794700617,2097152 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,16724201047735665759,10649463771534000491,2097152 --field-trial-handle=1988,i,2703575839845071274,8721590627267026126,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4280 /prefetch:9
    3⤵
    PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbe4e7c188,0x7ffbe4e7c194,0x7ffbe4e7c1a0
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,2486951208995047873,16916530287187141585,524288 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,8296914240740545291,7286311782759440262,262144 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,17419073907745703663,14317107799368444730,524288 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,928036001525208755,4764004387595002427,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17179563491982663470,10673145039004787709,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,2258114519157630290,15955998731928119757,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,6430522090191768763,10157671031284383436,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,4545369697488941740,10822635935191297961,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,6240864056255308491,8342735745823172018,2097152 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,12081401587258500686,17245977415549097588,524288 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,902310059025377260,18072175668585329307,524288 --field-trial-handle=2072,i,14658205057545739998,5617601614230515305,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:4464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2792 -prefsLen 24445 -prefMapHandle 2796 -prefMapSize 268500 -ipcHandle 2852 -initialChannelId {3a4fb5a8-58ad-47a3-b609-714d3178fc65} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2044 -prefsLen 24658 -prefMapHandle 2140 -prefMapSize 268500 -jsInitHandle 1648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1372 -initialChannelId {16217378-4f3e-4b74-bafb-db53922af575} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3660 -prefsLen 25542 -prefMapHandle 3664 -prefMapSize 268500 -ipcHandle 3704 -initialChannelId {90bda043-15cb-40e0-b006-389eabca9022} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4156 -prefsLen 25604 -prefMapHandle 4160 -prefMapSize 268500 -jsInitHandle 4164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4172 -initialChannelId {938a7939-45f8-420f-bf68-104b8f5db924} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

8106483d-9582-4737-8ae4-5bd0462eda9f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8106483d-9582-4737-8ae4-5bd0462eda9f.tmp
Size 131KB
SHA256 3784dba8b82a76b79c33c4c07c20521f057f877a5a0702b5d91ee511eba40bd5
MD5 e1880431da393e5c9c542a7ffe1ffbee
SHA1 335ac685f76832e797612fb9fa19f894e986199e
SHA512 15f55fd72daebb1ea3b41f319915c2be41d0db5ad4f6826ae82f9cf03b4aea7c705754f1b30bf341a3dde0addb590a643bd5a7583acb98e41a0b30e45eddddb7
SSDEEP 3072:sT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:bThDxWhaj5mjie/JYFobV
TLSH
T15BD312239CFE41FB14BCC50840797F0086E989B3D640FFA39ADC6A4FA1D7EA09356556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

818f1069-c903-44c8-bc23-602a4d863752.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\818f1069-c903-44c8-bc23-602a4d863752.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

0ed4b82c-1d6f-431f-8d06-6d5cfa4d63b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ed4b82c-1d6f-431f-8d06-6d5cfa4d63b0.tmp
Size 8KB
SHA256 d9c5fb2eac09877148fa3d871061ab7ca4938c2d1e15bc88b03801e7133d3e0c
MD5 2e1575854fa80f08c9970aa0353b151d
SHA1 ee04199899fd53a7e6f9e0b39b184b438051bff4
SHA512 0a222106d20bbc2db9104f2d5ec0cf75243284d5392c08e16df5ac7152722e31fe7a6fe75554de1da247e99b63840ee52725256b79779aced3cdb87d678c465d
SSDEEP 96:jqGNk5QsjpfPP8kzJe5ih/cIPURHl8h4otop5z1CD5BMP7cvBCdX56ZlOMZWOCPr:mGN16FPhQmiUyBkf2LX56bO+WOCPjJU6
TLSH
T1F602E934A978AC779EE3FE4AB58637139FE5107BE5542F84DAE82F1C009765C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25c7d010-ba24-49d1-b717-02693b901c65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\25c7d010-ba24-49d1-b717-02693b901c65.tmp
Size 8KB
SHA256 fc55ee5c6a9758892729dc738f58da7051271e989098ceaff25046062f7eba69
MD5 882dba5970e2d16429e32789cab21bc0
SHA1 561f4745cded26f4fd2e5429ddd8ae206f94442f
SHA512 c3fdd77c4a277ba3f1d28d062acf2f0d8128920cc357ca788f2ab22f71e1131b77bdfa5a8f906e318eef294a3ff41ca399125e9297787c9c518747cd1cc4ca34
SSDEEP 192:0GN+6FPZQmiUy3fZ2LX56bO+W0cELWUQqZU6:0GN+6lQMLX56bO+W0fbvU6
TLSH
T1BA120975B978BCB35EE2BD46F58776439FE4106BD4482F80DAE82F2C048B25C134A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3441efe89f40c49c2eb2faa60bc806081bb2ed5672b81b3317480a16d9defd0
MD5 48af34be1fd83b68e08abd8324fcc533
SHA1 15f0d4791b9ba48b92ee9290ab043242241b1137
SHA512 9687f23e1f8c4b413fabcf01b867bb71849109f11f20aeb0da3a5e1a25b610ec3fa85aa3ce714ace9479c0c98da93c7301d990baf3c243f6c14cc1010ae46a5a
TLSH
T12ED0243073574401C1C0703743C3C3103CC5C505010D515FD0301C103C57055F40D0C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0653c7dfe0810a5ba2c25399711a69ff5ccfc817819d34f6722ae2f2cd5878f
MD5 7d9ceef5daa4101fd9b28ee948203837
SHA1 ad81e9d42e96e81834610892e0cbe006311016fb
SHA512 5fcae862842c3f4a69612b1563a769c05365d02e6c1981b600f92a8204d1bccef7066e0f30e9f4cd820c979d8be93f5d5f5a0cbcc14e4c67fdb497df535a879a
TLSH
T15DD02230F32B8002C2C0B03B83C3C3203CCACA0A020E20AEE0302C203CAA02AF80E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

6c1d958e-c94e-4f24-831e-d11d61d1b5f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c1d958e-c94e-4f24-831e-d11d61d1b5f1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_20hbwhfq.cky.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20hbwhfq.cky.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 5121f8ed3442b4dca8ad25a6f45497b43fbd8ef90fce62fb654e0dd969a6ebea
MD5 dd9af8d0ed67e9f06d930924a412ffe1
SHA1 4bd028212593f9481a4a81c837f3973caa5408bc
SHA512 5d35c6bd57c0ff179763635feaceca7bf9852f044cf6fc74a75fe775ff3ccbba40092d425f6018ef3725a0dad9cac20f58f353c7bad11415c7edaf739d9798a4
SSDEEP 96:TRzMM102nmWKi03T+mRQ9n4KY/Q/P6DpBlz:lMM102naLqmRQ9FPwpBF
TLSH
T1B391EA1FB57484631B31F5E62D072BA8F103B007DDE2DDB8B12ADDA289683E981D958D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 bedee09560d78b54994bc491fc420a756b70bc96619e447a040d7a8783396a68
MD5 ae0bbe6338cc83afc073d437a45f76fa
SHA1 5a206786e9ea70641e8cf71639e918535b2ab9a4
SHA512 63600483939b74662c0bf625e3da14b31de38ac4a1cc36799fac713a6d86788f1993252f21c879b101a10f0ea447f8cb7c9763b5205d0367350688f1db30dab7
TLSH
T1022137B8184C1931E5B5781A2A5FF701C7F1F256DA40AF6CDAA91C284CC74F4936252F
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 54e6423ee2e4ae5191ae117df916204edabe867f00784b5d3877da2e5683b62e
MD5 aea027c8da8ae4289cd7a35b2f8cb3a1
SHA1 bb89fa7718f815d093e5410f576b10df226c0faf
SHA512 a9769933b513ff2bbfdb7086440200177535b592c3d05bd2a11417e9b62619fb3bd39aaf13a00f6ff8d48638ddf0219583f13c53e7309ba6250ab2d25f281ed4
TLSH
T18BC08003994D84B356E82714714C407C643C0120285DD50B735F8A1DD14D816818D210
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 9992dcced3209c68a103bd72132b37ca40149c1544743cf47f6aa10466148e57
MD5 7195e76542d6ba2f73c33edf9965f1ad
SHA1 4210be503afd5a9d48883f829a1f045327592641
SHA512 6187c37a3f796fda71f33ab50dd09f1d6430ff6c741b19526b599ff9223e397807e81c683fb42945e1e4816c4ef42a5fb6f8b4045376bc41f0612b412fca3d6c
SSDEEP 192:1kI4vBUmldv18dhEpqf943D096gD8CL4kY3:1kI4vBUmldv18dhWy94z096ohL4H3
TLSH
T19412531549048E782E4EA78BBB367D02D27D473B60845C78B4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 43f384f65c280dfe5dcafa6962d8cd5c98654965dffcf469df310619f9682ca8
MD5 fa0224e452eb83ef44122a348001fc81
SHA1 8fcc1029e1ffc122cc4dc478933510843f1f7df0
SHA512 fc4bd0756be92f2e0d22a6a4a33086ef51fd131f41636471ca8ef80db708a6850d6bd5455bd44a83377a1a29091314143fca5a307d3fae32d80b2430b33733b6
TLSH
T15E410DB954448F6FE4FA736CBC184571AEB3417BB6BF188224B48484050CF3456F6AE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 49555ff95c917c354b83c09ee3374bece24f9ef9356517e7c6da51b0f92b2a0d
MD5 06f2e06e05bc872ca854a20c0ef7b4fd
SHA1 de54fd2105b085defe57913e96705f1316bdeaf9
SHA512 4c7602a917b731bdcf43c2a51c0c673a412bcc09ae2266e39b097fd6dbaeca06540fdfc74238b8f622147d8da41a1cc21faa01b8f604e3d070f282dd60c97097
SSDEEP 96:xHaEqGqIdvzvl6ElW9hn3vPllFs1w8hdcnxv:s3RId56EWHl7s1w8hiv
TLSH
T1F9A11F786044CB7FA4B6776CAC658C705EB2017B777F688620F484C4450CF3846E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 138ed504fae13a85cedef34b008553b0e53c2320660120b960882cbc520bb229
MD5 cd18efd7a47fe875327723d173d29438
SHA1 8f72853f1edf612746aa9d60b82970819709aa4e
SHA512 a52a4d496cd0763aece20a09b99184d946c84827a7dbd5080223617a13e707bec40018026d0ee3fef255ad2ba8808e1831b5247dbf82d047f5ba7852da2fe561
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0xZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWEyh44CfiaR/skL0H7
TLSH
T1CC23348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 26d8367275250fe866c4ba438a9f0ef8f5ede3c5ed3ba8f8b33be9fb637cac52
MD5 8db91f318bc8ffb396a90c858aa15511
SHA1 abbb87c219a55e4cc09e93151ac143165a270e14
SHA512 b95dacc53f6bed7b78d7bd967adc8b902631179a70e981c848b4cd5deb4c3c1d8f06bc2bd3bb5b387556e990d735d50972ed9930401f1d3acc240a738f2fb71f
SSDEEP 768:N6S6CrAW9j+f3aY3p6x3I0H7/29fUcHLeHnHf:N6S66y3aY3p6x3L8UcHLeHn/
TLSH
T1734396CA3633DD51CB29E47A62A642FB544FA2DD003113886A9E9F4C441B5979E2FFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi_181b3a1bb1022a12.tmp

Path C:\Windows\Temp\msi_181b3a1bb1022a12.tmp
Size 712KB
SHA256 d0bdd462ff336ca577a794c617bc165a53e74d9d349bb3025ff2647215d2a838
MD5 57938a366d51bd22c909bc6a9d1c0ae4
SHA1 e40f55486b55806d9d6475e74ba0e05ad5c4fbc7
SHA512 514c1ee4e93ed0ae5fbbcee0d1ab37e436ff5e7991557de7291e26ef578077a2de41b57792ed4025ac10b08aa2f340822e4556beea7f29f86a2c53baaddf6139
SSDEEP 12288:9Zk2KIdAIBkBy2aKs/epFCpCvA5KlV6pGNMHNKgwjh1TzvCPQBZfCqnnnnnnnTnM:jk+yIC7CeqCvIKlVJMHNqDZfQ
TLSH
T16FF4021157B4604E7A20258986DFFD953EF7AE26F8DF2D4506C83808BCEC745A2D8DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-16-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/1088-0-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/1088-6-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/1088-7-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/1088-5-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/1088-8-0x0000000002DF0000-0x0000000002EA2000-memory.dmp

Download

memory/2168-17-0x0000000077164000-0x0000000077165000-memory.dmp

Download

memory/2168-13-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2168-14-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2168-12-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/2168-302-0x0000000000870000-0x0000000000878000-memory.dmp

Download

memory/3380-316-0x00000216D4650000-0x00000216D4672000-memory.dmp

Download

memory/4076-337-0x00000178BBFA0000-0x00000178BBFBC000-memory.dmp

Download

memory/4076-338-0x00000178BBF80000-0x00000178BBF8A000-memory.dmp

Download

memory/4076-345-0x00000178BC930000-0x00000178BC942000-memory.dmp

Download

memory/4076-344-0x00000178BBF90000-0x00000178BBFB4000-memory.dmp

Download

memory/4076-343-0x00000178BBF90000-0x00000178BBFBA000-memory.dmp

Download

memory/4076-335-0x00000178BC5E0000-0x00000178BC693000-memory.dmp

Download

memory/4076-334-0x00000178BBF50000-0x00000178BBF6C000-memory.dmp

Download

memory/4076-336-0x00000178BBF70000-0x00000178BBF7A000-memory.dmp

Download

memory/4076-342-0x00000178BC8F0000-0x00000178BC8FA000-memory.dmp

Download

memory/4076-341-0x00000178BBFC0000-0x00000178BBFC6000-memory.dmp

Download

memory/4076-339-0x00000178BC910000-0x00000178BC92A000-memory.dmp

Download

memory/4076-340-0x00000178BBF90000-0x00000178BBF98000-memory.dmp

Download

memory/5088-309-0x00000000039E0000-0x0000000003FB2000-memory.dmp

Download

memory/5088-303-0x00000000015C0000-0x00000000015C3000-memory.dmp

Download

memory/5088-304-0x00000000039E0000-0x0000000003FB2000-memory.dmp

Download

memory/5088-308-0x00000000039E0000-0x0000000003FB2000-memory.dmp

Download

memory/5088-310-0x00000000039E0000-0x0000000003FB2000-memory.dmp

Download