acrstealer | c6806ba8b42baca6027e58dd0b5ac16e0f9497cd463772ab563a41ec94ab7e6b

Analysis

user interaction
yes
max time kernel
154s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rick and morty all seasons.exe
Size 796.0MB
Sample260807-nwzc7avamd
SHA256 c6806ba8b42baca6027e58dd0b5ac16e0f9497cd463772ab563a41ec94ab7e6b
MD5 72975bc704e9cde7549589acb973958f
SHA1 b24d5d6b45c33f92fbbb594ae876ab0070202796
SHA512 be86768d6243b16f6f40e3a5b264d08a29aab51e1acf7e59fc67ced19cf363af5bdd01c874810b8e4ac0b62c61a9780cefab923f23d29c9d2902ea817afa954d
SSDEEP 786432:xovCdopKzs1YT09SLgZ9DDWpc3dfMlytf:xG
TLSH
T1D089CE12B7E84066E4BB4B3098B78656AB36FD111B31C3DF5694B26D2E737C09E31326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery acrstealer animateclipper persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

dist.eventgateway.cc

Decoy

stackpathcdn.com

Attributes

guids
019fdb4b-1059-7562-bb9a-12a05545d5b5

a6cdcc0b-6b38-49d6-9672-20be114d9eba
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes

auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

Content-Type: application/x-www-form-urlencoded

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects ACRStealer V4.x 53 IoCs

resource	yara_rule
behavioral2/memory/1688-0-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-1-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-37-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-42-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-43-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-85-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-84-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-92-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-322-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-323-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-321-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-324-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-326-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-327-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-331-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-370-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-398-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-751-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-752-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-750-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-758-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-762-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-767-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-773-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-779-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-785-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-790-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-796-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-803-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-809-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-817-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-823-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-824-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-830-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-872-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-910-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4407-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4409-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4436-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4444-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4450-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4453-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4462-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4465-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-4467-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5189-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5190-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5191-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5233-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5241-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5242-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3
behavioral2/memory/1688-5243-0x0000000021900000-0x00000000219B2000-memory.dmp	family_acrstealer_v3

Detects AnimateClipper 2 IoCs

resource	yara_rule
behavioral2/memory/2164-4413-0x00007FF7C4B90000-0x00007FF7C4BD0000-memory.dmp	family_animateclipper
behavioral2/memory/2164-4412-0x00007FF7C4B90000-0x00007FF7C4BD1000-memory.dmp	family_animateclipper

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1688 created 1296	1688	rick and morty all seasons.exe	81
PID 1688 created 1296	1688	rick and morty all seasons.exe	81
PID 1688 created 1296	1688	rick and morty all seasons.exe	81

Downloads MZ/PE file 1 IoCs

flow	pid	Process
68	1688	rick and morty all seasons.exe

Executes dropped EXE 1 IoCs

pid	Process
5368	vkhqaiG3F0GgEnIl.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1688	rick and morty all seasons.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rick and morty all seasons.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2512	chrome.exe
5664	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rick and morty all seasons.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rick and morty all seasons.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe
1688	rick and morty all seasons.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
2724	msedge.exe
3380	firefox.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1544	1688	rick and morty all seasons.exe	89
PID 1544 wrote to memory of 1760	1544	chrome.exe	90
PID 1544 wrote to memory of 2512	1544	chrome.exe	91
PID 1544 wrote to memory of 5744	1544	chrome.exe	92
PID 1544 wrote to memory of 5744	1544	chrome.exe	92
PID 1544 wrote to memory of 4756	1544	chrome.exe	93
PID 1544 wrote to memory of 4756	1544	chrome.exe	93
PID 1544 wrote to memory of 1328	1544	chrome.exe	95
PID 1544 wrote to memory of 3388	1544	chrome.exe	96
PID 1544 wrote to memory of 1328	1544	chrome.exe	95
PID 1544 wrote to memory of 3388	1544	chrome.exe	96
PID 1544 wrote to memory of 1968	1544	chrome.exe	97
PID 1544 wrote to memory of 1968	1544	chrome.exe	97
PID 1544 wrote to memory of 2580	1544	chrome.exe	98
PID 1544 wrote to memory of 2580	1544	chrome.exe	98
PID 1688 wrote to memory of 2724	1688	rick and morty all seasons.exe	99
PID 2724 wrote to memory of 5936	2724	msedge.exe	100
PID 2724 wrote to memory of 5884	2724	msedge.exe	102
PID 2724 wrote to memory of 5664	2724	msedge.exe	103
PID 2724 wrote to memory of 5884	2724	msedge.exe	102
PID 2724 wrote to memory of 5884	2724	msedge.exe	102
PID 2724 wrote to memory of 5212	2724	msedge.exe	104
PID 2724 wrote to memory of 5212	2724	msedge.exe	104
PID 2724 wrote to memory of 4100	2724	msedge.exe	105
PID 2724 wrote to memory of 4100	2724	msedge.exe	105
PID 2724 wrote to memory of 4100	2724	msedge.exe	105
PID 2724 wrote to memory of 3300	2724	msedge.exe	106
PID 2724 wrote to memory of 3300	2724	msedge.exe	106
PID 2724 wrote to memory of 3300	2724	msedge.exe	106
PID 2724 wrote to memory of 3240	2724	msedge.exe	107
PID 2724 wrote to memory of 2820	2724	msedge.exe	108
PID 2724 wrote to memory of 3240	2724	msedge.exe	107
PID 2724 wrote to memory of 3240	2724	msedge.exe	107
PID 2724 wrote to memory of 2820	2724	msedge.exe	108
PID 2724 wrote to memory of 2820	2724	msedge.exe	108
PID 2724 wrote to memory of 5224	2724	msedge.exe	109
PID 2724 wrote to memory of 5224	2724	msedge.exe	109
PID 5568 wrote to memory of 3380	5568	firefox.exe	111
PID 5568 wrote to memory of 3380	5568	firefox.exe	111
PID 3380 wrote to memory of 3732	3380	firefox.exe	112
PID 3380 wrote to memory of 3732	3380	firefox.exe	112
PID 3380 wrote to memory of 3732	3380	firefox.exe	112
PID 3380 wrote to memory of 3732	3380	firefox.exe	112
PID 3380 wrote to memory of 1684	3380	firefox.exe	113
PID 3380 wrote to memory of 1684	3380	firefox.exe	113
PID 3380 wrote to memory of 1684	3380	firefox.exe	113
PID 3380 wrote to memory of 1684	3380	firefox.exe	113
PID 3380 wrote to memory of 5968	3380	firefox.exe	114
PID 3380 wrote to memory of 5968	3380	firefox.exe	114
PID 3380 wrote to memory of 5968	3380	firefox.exe	114
PID 3380 wrote to memory of 3016	3380	firefox.exe	115
PID 3380 wrote to memory of 3016	3380	firefox.exe	115
PID 3380 wrote to memory of 3016	3380	firefox.exe	115
PID 3380 wrote to memory of 3016	3380	firefox.exe	115
PID 1688 wrote to memory of 5368	1688	rick and morty all seasons.exe	117
PID 5368 wrote to memory of 2164	5368	vkhqaiG3F0GgEnIl.exe	118
PID 5368 wrote to memory of 2164	5368	vkhqaiG3F0GgEnIl.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\rick and morty all seasons.exe
  "C:\Users\Admin\AppData\Local\Temp\rick and morty all seasons.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Downloads MZ/PE file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\vkhqai2imvjyZ0R7\vkhqaiG3F0GgEnIl.exe
    "C:\Users\Admin\AppData\Local\Temp\vkhqai2imvjyZ0R7\vkhqaiG3F0GgEnIl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc4cd8c728,0x7ffc4cd8c734,0x7ffc4cd8c740
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1412,i,7101101016981308027,15057157933235801695,524288 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,17073640347545268720,11549894525536416523,524288 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:13
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,416547376604484729,6988132270393823937,262144 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6859973989807725442,984274009987166013,2097152 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,13793246252071452777,12304866098907516475,2097152 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3216,i,8756441669172479245,9854416862514986626,2097152 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,464751729094785532,3582665101355984294,524288 --field-trial-handle=1932,i,2306916860636258458,17835886285263973464,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c4,0x7ffc4305c188,0x7ffc4305c194,0x7ffc4305c1a0
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,4381971866068738540,10748559512871871372,262144 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,14401815544744092418,8501051224543505712,524288 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,8029691598647894500,7343006853133745629,524288 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1027824541869066301,5542835973126394163,2097152 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,11250448520224022713,12894086810059661461,2097152 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,17380729325678818361,8933873066610175190,2097152 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,18201233538245461953,12931490511374649187,2097152 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,12275642626470263939,16344098018686880062,524288 --field-trial-handle=2892,i,17863252966173175549,1162189661306800640,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:5224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27098 -prefMapHandle 2284 -prefMapSize 270315 -ipcHandle 2364 -initialChannelId {d3ca8ad8-174a-45bd-903c-c1e6b1a57587} -parentPid 3380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27287 -prefMapHandle 3732 -prefMapSize 270315 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {69482ef5-d0f4-4332-8a29-604c50d6bdfb} -parentPid 3380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27287 -prefMapHandle 3944 -prefMapSize 270315 -ipcHandle 3996 -initialChannelId {93bef1e2-1c0a-4e8d-b36f-d83eaf703bf1} -parentPid 3380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34786 -prefMapHandle 4476 -prefMapSize 270315 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {c0a018bf-45dc-4ff3-a65e-033f6d9673a9} -parentPid 3380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:3016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 28d01c55a54bd8f064121e66704a6be9910798b6a39dd684325cdb522533f265
MD5 a2df6f7a9b00b3dd4cfe11e8f6e55aa4
SHA1 66914fd99494695a51a76e5c5a913770a147b550
SHA512 acb59b8bda556ab37e15dbc6adcdcdbc8027052d70006d32bb23c010f813cad926ff83a31cdf8c75070647522351d6b22897c6cd99e3da913d8e0a78d005d822
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5aHD1B6eGyvkongob1v4a:MC0HJm5FHuPgXDUDYLW8ngobZ
TLSH
T132A13BF1A4B948BB59B7D245F8827A83CEA4A22B6990EF80D9DD1F0C01F30E81342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1a204f293d9f6f128efa38fa54299611309eee3ca80889e7ff8bb9fddde52bdf
MD5 9907fd2d62e20d8e8991a4d5310dbd3c
SHA1 8746d784d713348d9a85750ebfe23e4fc8db3e1e
SHA512 f0b5bc1e482b1dfa728791ef8947264af7b3a723d4017dd65f8c00784d8935ccd5c64788113564b1901937e7f2e1d128a0ed5df43c8a79dc53111469730d6673
SSDEEP 768:Irv+4UNbdD3KheMNp8+p3bd66j+4BRv86aLITc2bwCl1:Ibsbp3AL8+p3Z6n4yt0ww
TLSH
T11B03BE72E86899339CF6C644B18677837FF821A399C10ED4E4D92B4E405A29E370B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f86e074391be35696f4d5737a7352e8f22ccd0dc18343a897d5bcac42c702a28
MD5 cf40f97372b3f3d1d2be9cd0c1a0fd1f
SHA1 9af8f2d9f9f1501d697a45f8542a3e4f4da5616a
SHA512 2288606b2f403c9dee8fb1492808f6c1d1ebab8d3bee28f9725e6b6a894de30e28fdd6bd8c0c4b29c25c702ebd3c0393f61e1afdd6c2b6e68d82e10e07266e89
SSDEEP 768:Irv+4UNbdD3Tc/Np8+p3bd66j+4BRv86aLIiP2bwCl1:Ibsbp32L8+p3Z6n4yx0ww
TLSH
T16203CE73F9A899339CE6C64472467A437FF851A396C10AC4E4DD2B4E419A19E230B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vkhqaiG3F0GgEnIl.exe

Path C:\Users\Admin\AppData\Local\Temp\vkhqai2imvjyZ0R7\vkhqaiG3F0GgEnIl.exe
Size 1.1MB
SHA256 d4cfab5e052df4c049f258e226d11825cb37b0359be454b83241edd59b295f08
MD5 d8fcb7a4ef513ffff9cd2b3448c2b0e0
SHA1 56b6322ec04bb397dcdcab70d50275e689312c4e
SHA512 ab12cc1164a4e0d8f4c94eaa0efc056bae36aebbddbdc86b3c271f52a66901d88f48e01b89d502a771277ca6f5ba388bc150d6094daf09eb1a673212ad3901a3
SSDEEP 24576:F69ePqpqfpP1y2LxKG0+m1gFZ3VttK5O1+MEcCxlnAlQrA:F69ePX110+HFlVts5aCxCM
TLSH
T11145BF15A3A411F8E62BC274CA9A5233EBF174811B64EACB1755D65D3F33AD06F3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a076671ef315e9d38e23e6e82d807caa7b82e2d469ddd45bf5c14d83e9f0a4aa
MD5 be444e71ed78da19d3f2625180932d2d
SHA1 d501246127ba43268e37837a9b2944aeef7bf420
SHA512 c99814980eb19d77dc86ea196244b5e0f0559a58ddfb22eb5eca3c9e66d37089bf8f53465c7cff9c9f3dc9d735ecb629ca3821f5266e46551313a9de3a0b4e9c
SSDEEP 192:oOv5zbo8W4hyjyv911d66JoztdzgCl6mBM2Y:Tbo8W4hyjsd66Joz/zgC1Oj
TLSH
T123D10CA4FA28867BC408027BCDA51B010F7A385ADC4E7F1935DD24482D5B2DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 75297e3d6de0d8e06dfc161792b7b57594d73551ac8526f97f9cce8abf420504
MD5 3a9cd268947b646824b3cdfb1df47920
SHA1 24d64ba8662175e874fa936fef76cb28d9363b7c
SHA512 11310a29face6ad0c22104225b759146528a79a8508afb28c113d7a84dc6b7c26e67949fce213bf03770d833e735584cd063598350f5d11b9ca7533adcd7e9a2
SSDEEP 192:+E1d66JoztdzgCl6mBM2tOv5zbo8W4hyjyvl:/d66Joz/zgC1OHbo8W4hyjI
TLSH
T134D10EA4FA28867FC408023BCDA51B010F76395ADC4E7F1935DD25482D5B2DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c861a78c61066647a93268724b2a32cf0207312cd8be9725ff719bb7f6502d02
MD5 7d61ddaa384484bce5f6458850b41b6d
SHA1 2bc9cc658cabb8fe30b9f8811ae3705ce9db4ba3
SHA512 25e7415b7cbc2a1c27e0094ed3bd3649151da39852d96cd200ae69ffb185533ff4fb053556db6507aec771c0783154645b21fc8ae876f6228ed4022b4bc69f1d
SSDEEP 192:N11d66JoztdzgCl6mBM2jOv5zboIs4hyjyv:Fd66Joz/zgC1OlboIs4hyj
TLSH
T190E1FDA8F628867FC418027BCDA51B400F7A389A9C4E7F1971DD244C2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0f75f7a320a060bb89cc6871a60fad0c251585c359e1ee06d4cb18ed15e0acbd
MD5 6b038927f296e8037df7c3b0ef1f39a5
SHA1 6c9fcb23bdf34b1d21442116655a1b4e362400cf
SHA512 845c6014b96a90263d7866890b68e27a52150d5e300cdc9d2b1f1cfb8f3872449894357e2251033316b30916d38f9d95dd53e832e2bf0e2f99e991500fa9f9d7
TLSH
T12A115B5C79B94E3A9C87F2AD7490028E53564A0B04871D434F12EF8CCF82AE9326A46E
MD5 SHA1 SHA512 TLSH

Submit Download

2d72c761-59a2-4036-bcfe-da1f60e4fd36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\2d72c761-59a2-4036-bcfe-da1f60e4fd36
Size 15KB
SHA256 c86b4ce75c8abf6c4ef7f22975562e699de4940b71955c4be6dde920d0704831
MD5 5d02d16fca66cb5c16d38bab3bcfa8cb
SHA1 1c1824d2d3f358f71c270d8ab62ce653d4b565fa
SHA512 f638d2170101bb64ecbd3e34f1506c57c69daa358a81bd078ed85d14edf8889250752cff69de6215599722271a3096478c7833c201d6afd8ad5e7873e2fe962c
SSDEEP 192:dxFSA9SB+1ER8vb/yPQjzxnxbgEArs5NGOyVPpZz4UZO1zgHAsJ27nE+BjJQ+AVH:t9MhRa/Hjlnxbgdrs3GOyVElZB67H
TLSH
T1CB62D8556430497E8691E368D8E97FC3E2F518CF8C019FC99BE47E0869EE0AE5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f891e15-915d-45c8-970e-4ee3d490d6b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\3f891e15-915d-45c8-970e-4ee3d490d6b6
Size 235B
SHA256 2ac3ed13fc1c84a251327fa07f69fa581016c6e60690fd88eea918d0774d94bc
MD5 dd6d865f64cb9b19ec5e10cfe8ba0590
SHA1 6ab3c133bbab700d7fd3611d1b1e66d13f135191
SHA512 8cbe30fa946f5656d9001c398a4930effca48a6a0b0da3ea05600eb82faae3443fe6470a22e23c3659f2a5c46e9b97aa6254a9f9f880d1b4749e8ba232e2dd3c
TLSH
T1AED097C038E8AB6C0C248F03F0F06ED631484C3314B4B820C9924A349AF9DC802A1C0A
MD5 SHA1 SHA512 TLSH

Submit Download

4d526f20-a88f-45b9-8335-9df081691741

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\4d526f20-a88f-45b9-8335-9df081691741
Size 235B
SHA256 00c739906a19c26b94f9462fab459ebe5d6a71dd49500a2bc15db130f051ee01
MD5 782a492ac3f9dc4e7d91826d45029d04
SHA1 5681750dc2652c2337e1710e9b3d2f93845e9366
SHA512 663d8ee3e4298fe869336a66463f4914599cd5214810ca3dc84cc136875693b443e944b017e49947eafc44f5149da6fac79875d2e58203f8876ba70bc9a949c4
TLSH
T1D0D097C268A8779D48044F02B0E02DC634948C332474A810D5A20578FDB9AC90252C97
MD5 SHA1 SHA512 TLSH

Submit Download

d86fced6-0cb9-4a1e-a438-280ae6f8a087

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\d86fced6-0cb9-4a1e-a438-280ae6f8a087
Size 2KB
SHA256 e9676747233d7b40ed907b29086b8a1fc04d73ef75dbfb0a233880f3b6e10ebe
MD5 7520fe5162828df41c65f16b5c7783f0
SHA1 928ae473d92e9934c94bafe4f0f03a8e32e518c3
SHA512 461a3d7ec96c58026838dc7fb0ab5f63901b926238cdbe98e591e14aa5e10ea6a1a38ef08d97b63c5f3388ed3d1781ed48a858ac62febc64de11733691e6eee8
TLSH
T1ED41535C36B8CD779CEAE54DD491328E93E5991344C22C832E51DF0C8ED2A9E236A02F
MD5 SHA1 SHA512 TLSH

Submit Download

eac0851e-b9e4-410a-ac73-72c593efa746

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\eac0851e-b9e4-410a-ac73-72c593efa746
Size 883B
SHA256 6ef33c66dc60ce8ccd8d9ce903708531cc05acfee09b2d4c90bdc21a58e0da47
MD5 61e624fd87016d3af3c9d2696096bd26
SHA1 c61fd4a6d731bfa164b31fce4e7aa57292bbd499
SHA512 4f96110771e09a0e7ef9f98977c9a530a0a5a4c2c822202191d2ec9dd6527df4617a6003312cd64738f182e9d35ab21cab3f505671682c2c27ed9a91aeea5f33
TLSH
T196110094F530BAF2DC78824BC995370187E8B433C4C655147DA45F184EBB61BE7AE287
MD5 SHA1 SHA512 TLSH

Submit Download

ef283fc2-f37a-48f5-95cd-8aaf16897d33

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\ef283fc2-f37a-48f5-95cd-8aaf16897d33
Size 886B
SHA256 725c459fb694413173dddc0ed18f8c1bd1416b6a721ad179d7e3191fdcbf862c
MD5 7a5359147cb701d3784e5a201a891de9
SHA1 3cc529b0f858c594ccc6c26fad344ea47f55ee3a
SHA512 a675f0ce14eb9ae7180c7c197774e75cb985a407ddaf9753e8a9003c81733c34de58941eb0a8afea400a5c39bd83cafdc67613a5f04b88527041b4415adf94c8
TLSH
T145110054D630BAB3CC78A29BD5E037424AD9B423C0C65904BE981B180EEB11BE76F207
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 ec523254db32fe85a26d32ed3944689b327974580c009fceeeeddf4c7b8b4a51
MD5 9bcb54a3f87c93c1b55ed258e1ee94e7
SHA1 41e52e6ee4d2bbbc8dfc0d801ae39bd13f3a9fec
SHA512 4b791742063e4ad28c2477eaeeabf18883523e5efa5e5b95ee4a5ca10bf7130c2a42a83cb1c227ccbdbf2a910e7900949c4eefb54f24c24f8bdd34b23da077b1
SSDEEP 96:xH+UTUQqGqsfFh5S1zSbESSlvdv9jAnAHdA0ScSqBw88u8L4cnEVgR:ArRsfFh5S6ESSDdA0ScDBw88e+
TLSH
T1C0E13078A508CB7F68B6777CAC6888316AB2413B7BBF68D650B554C4014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 a5a02d878b0f59be1dc5c9ed212bbc2c18ec9cac51f21d1befa8bc3caef16aeb
MD5 84201e4db1cd42c0f364d0f1e145d01c
SHA1 332469a41f1b86a5f50aeee908dc4ca3224f99e5
SHA512 8ca80c59c481a58290f159375d807a8bb6e947c9d769e84eb7b513bc2ffba0d2a79843de75301a73a745bea81bc3244210a44eac7f4f7b39ae10e965b922ef6b
SSDEEP 96:xH+UTUQqGqsfFh5S1zSvgESSlvdv9jAnAHdA0ScSqBw88u8L4cnEVgR:ArRsfFh5SogESSDdA0ScDBw88e+
TLSH
T130E120789508CB7F68B6777CAC6888316AB2413B7BBF68D650B554C4014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-752-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-796-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-370-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-331-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-327-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-326-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-324-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-321-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-323-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-322-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-92-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-84-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-85-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-43-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-751-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-0-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-750-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-42-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-37-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-758-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-762-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-767-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-773-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-779-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-785-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-790-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-398-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-803-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-809-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-817-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-823-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-824-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-830-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-872-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-910-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-1-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4407-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5243-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5242-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4409-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4436-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4444-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4450-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4453-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4462-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4465-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-4467-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5189-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5190-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5191-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5233-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/1688-5241-0x0000000021900000-0x00000000219B2000-memory.dmp

Download

memory/2164-4412-0x00007FF7C4B90000-0x00007FF7C4BD1000-memory.dmp

Download

memory/2164-4413-0x00007FF7C4B90000-0x00007FF7C4BD0000-memory.dmp

Download