acrstealer | ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
Size 3.9MB
Sample260808-rwgd6adh87
SHA256 ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94
MD5 68ccd17f80bcc61bec8759b77cb80b24
SHA1 2bc8a0dc10a195172f9ab72e38c4ef38c2aa1d97
SHA512 e6aa0c675ee9c61b815705bb8d58346dccaee28949bc6300e8ec34ff00e753ec29fd977aa4f385fdc17758f010821fd81b2ceeeb50c73250f8018a44e9af14ef
SSDEEP 49152:5eCZUR9nHrIiDPQf00yEi3o95Jg1rLbQpW:coUR1HrIiDSi5Y95Jg1rYpW
TLSH
T153165B02FECB84FAE4032E3160E762AF2739BD050F318B57EE543A79EA772515C22655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery acrstealer animateclipper persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

dl.connectivityplatform.cc

Decoy

stackpathcdn.com

Attributes

guids
a6cdcc0b-6b38-49d6-9672-20be114d9eba

019fd9e0-e083-73aa-b5db-18325c05ddac
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes

auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

Content-Type: application/x-www-form-urlencoded

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects ACRStealer V4.x 56 IoCs

resource	yara_rule
behavioral2/memory/4624-0-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-1-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-37-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-42-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-43-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-84-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-85-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-91-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-329-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-330-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-331-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-348-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-351-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-355-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-358-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-356-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-375-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-396-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-778-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-783-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-784-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-785-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-790-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-793-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-799-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-805-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-811-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-817-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-823-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-829-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-835-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-841-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-849-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-855-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-856-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-862-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-904-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-943-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4440-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4441-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4475-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4482-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4485-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4495-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4497-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-4500-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5147-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5353-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5354-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5355-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5398-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5402-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5406-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5403-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3
behavioral2/memory/4624-5407-0x0000000021A80000-0x0000000021B3B000-memory.dmp	family_acrstealer_v3

Detects AnimateClipper 2 IoCs

resource	yara_rule
behavioral2/memory/6004-4452-0x00007FF70D540000-0x00007FF70D581000-memory.dmp	family_animateclipper
behavioral2/memory/6004-4454-0x00007FF70D540000-0x00007FF70D580000-memory.dmp	family_animateclipper

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4624 created 2872	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe	80
PID 4624 created 2872	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe	80
PID 4624 created 2872	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe	80

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

Executes dropped EXE 1 IoCs

pid	Process
5376	mpdlztii8q7J7iLu.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1076	chrome.exe
1640	msedge.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
2148	msedge.exe
3548	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4604	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe	89
PID 4604 wrote to memory of 5688	4604	chrome.exe	90
PID 4604 wrote to memory of 3188	4604	chrome.exe	91
PID 4604 wrote to memory of 3188	4604	chrome.exe	91
PID 4604 wrote to memory of 1076	4604	chrome.exe	92
PID 4604 wrote to memory of 1340	4604	chrome.exe	93
PID 4604 wrote to memory of 1340	4604	chrome.exe	93
PID 4604 wrote to memory of 3556	4604	chrome.exe	94
PID 4604 wrote to memory of 5848	4604	chrome.exe	95
PID 4604 wrote to memory of 3556	4604	chrome.exe	94
PID 4604 wrote to memory of 5848	4604	chrome.exe	95
PID 4604 wrote to memory of 4640	4604	chrome.exe	97
PID 4604 wrote to memory of 4640	4604	chrome.exe	97
PID 4604 wrote to memory of 5252	4604	chrome.exe	98
PID 4604 wrote to memory of 5252	4604	chrome.exe	98
PID 4624 wrote to memory of 2148	4624	2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe	99
PID 2148 wrote to memory of 5376	2148	msedge.exe	100
PID 2148 wrote to memory of 2908	2148	msedge.exe	101
PID 2148 wrote to memory of 1640	2148	msedge.exe	102
PID 2148 wrote to memory of 2908	2148	msedge.exe	101
PID 2148 wrote to memory of 2908	2148	msedge.exe	101
PID 2148 wrote to memory of 5028	2148	msedge.exe	103
PID 2148 wrote to memory of 5028	2148	msedge.exe	103
PID 2148 wrote to memory of 5176	2148	msedge.exe	105
PID 2148 wrote to memory of 5176	2148	msedge.exe	105
PID 2148 wrote to memory of 5176	2148	msedge.exe	105
PID 2148 wrote to memory of 6024	2148	msedge.exe	106
PID 2148 wrote to memory of 6024	2148	msedge.exe	106
PID 2148 wrote to memory of 6024	2148	msedge.exe	106
PID 2148 wrote to memory of 5104	2148	msedge.exe	107
PID 2148 wrote to memory of 5104	2148	msedge.exe	107
PID 2148 wrote to memory of 5104	2148	msedge.exe	107
PID 2148 wrote to memory of 2012	2148	msedge.exe	108
PID 2148 wrote to memory of 2012	2148	msedge.exe	108
PID 2148 wrote to memory of 2012	2148	msedge.exe	108
PID 4960 wrote to memory of 3548	4960	firefox.exe	110
PID 4960 wrote to memory of 3548	4960	firefox.exe	110
PID 3548 wrote to memory of 3612	3548	firefox.exe	111
PID 3548 wrote to memory of 3612	3548	firefox.exe	111
PID 3548 wrote to memory of 3612	3548	firefox.exe	111
PID 3548 wrote to memory of 3612	3548	firefox.exe	111
PID 3548 wrote to memory of 4712	3548	firefox.exe	112
PID 3548 wrote to memory of 4712	3548	firefox.exe	112
PID 3548 wrote to memory of 4712	3548	firefox.exe	112
PID 3548 wrote to memory of 4712	3548	firefox.exe	112
PID 3548 wrote to memory of 5140	3548	firefox.exe	113
PID 3548 wrote to memory of 5140	3548	firefox.exe	113
PID 3548 wrote to memory of 5140	3548	firefox.exe	113
PID 3548 wrote to memory of 760	3548	firefox.exe	114
PID 3548 wrote to memory of 760	3548	firefox.exe	114
PID 3548 wrote to memory of 760	3548	firefox.exe	114
PID 3548 wrote to memory of 760	3548	firefox.exe	114
PID 3548 wrote to memory of 2636	3548	firefox.exe	115
PID 3548 wrote to memory of 2636	3548	firefox.exe	115
PID 3548 wrote to memory of 2636	3548	firefox.exe	115
PID 3548 wrote to memory of 2636	3548	firefox.exe	115
PID 3548 wrote to memory of 4280	3548	firefox.exe	116
PID 3548 wrote to memory of 4280	3548	firefox.exe	116
PID 3548 wrote to memory of 4280	3548	firefox.exe	116
PID 3548 wrote to memory of 4280	3548	firefox.exe	116
PID 3548 wrote to memory of 4724	3548	firefox.exe	117
PID 3548 wrote to memory of 4724	3548	firefox.exe	117
PID 3548 wrote to memory of 4724	3548	firefox.exe	117
PID 3548 wrote to memory of 4724	3548	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2872
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_68ccd17f80bcc61bec8759b77cb80b24_coinminer_elex_frostygoop_hive_salatstealer_sliver.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Downloads MZ/PE file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\mpdlztbIDu8KhZxQ\mpdlztii8q7J7iLu.exe
    "C:\Users\Admin\AppData\Local\Temp\mpdlztbIDu8KhZxQ\mpdlztii8q7J7iLu.exe"
    3⤵
    - Executes dropped EXE
    PID:5376
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffdb77c728,0x7fffdb77c734,0x7fffdb77c740
    3⤵
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,6022798207066199513,17088855594279380468,262144 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,15289475779469382502,14887840307838465485,524288 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,4800551552814105258,13979932340681953685,524288 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
    3⤵
    PID:1340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,16225663320271970108,1367361636759196557,2097152 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,14866166860734867947,15995649201338015099,2097152 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,14149940644801761761,7506350103018886859,524288 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3052,i,4928846436433408261,5186361189928698369,2097152 --field-trial-handle=1940,i,3135684472076095837,11814926743430617328,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x34c,0x7fffcd2cc188,0x7fffcd2cc194,0x7fffcd2cc1a0
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15550358295320470475,15277153058798662572,262144 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,1293889444273348367,13294816812171603642,524288 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,1961970025438588369,16970101253680773709,524288 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,5543318200795255272,7433396383448885990,2097152 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,4941016984718683251,11072420695325652478,2097152 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,5664499876130367208,18156227872638642876,2097152 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,12485849376940316047,10720158225096001080,2097152 --field-trial-handle=2292,i,11988955670513571080,9230093031260188170,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
    3⤵
    PID:2012
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2296 -prefsLen 27097 -prefMapHandle 2300 -prefMapSize 270315 -ipcHandle 2380 -initialChannelId {820c1f4d-6128-4d27-959e-edb148a89a4c} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27238 -prefMapHandle 3788 -prefMapSize 270315 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {78691736-375a-4ff5-931e-1472cf8cd3fa} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27238 -prefMapHandle 3956 -prefMapSize 270315 -ipcHandle 4024 -initialChannelId {c9aaa9a8-771f-405c-8f19-b7ee06bbe485} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34786 -prefMapHandle 4472 -prefMapSize 270315 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4484 -initialChannelId {27a7face-1de9-4ba0-a32e-aff57f46ba51} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 34974 -prefMapHandle 2688 -prefMapSize 270315 -ipcHandle 2760 -initialChannelId {fbfc8d06-47b5-45c5-910c-c389863e86dc} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:2636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32916 -prefMapHandle 5236 -prefMapSize 270315 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {67b31f2f-a061-4a7f-87b7-0d3b497a9d22} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:4280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32916 -prefMapHandle 5268 -prefMapSize 270315 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {079a4743-58df-4670-a7dd-4e56a0ec9404} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:4724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4880 -prefsLen 32916 -prefMapHandle 5040 -prefMapSize 270315 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {c98f990a-fce7-41d8-811b-102ce8124198} -parentPid 3548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:5020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 52b4a578c7a52003bae0b93e3dbac6f7d4a995e7940e86962dd2325238abff08
MD5 bd083c6224a7cda3f327d07d1336833e
SHA1 06838c732382ec49db89e1b906d9ad022a0e58de
SHA512 185e99024103941c9ed6336b6b88b6ef3df30b23e5972ecdd50a52cb78430151fee8cf971b891b679ea332741260014962c9ae2d37ae0724b666902a4f8a116e
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5NmDnB6nGyvn0b4T8kybJv4a:xC0ITo+TQ0InDUDWBPPb4T8kybl
TLSH
T1F0A10835A0285D774476D44AB1623A43CEB9706BE972AFE0EAD90E0D25F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\220ea591-7d9f-493e-a695-a7fcfa460ca7\index-dir\the-real-index
Size 360B
SHA256 499d7bb6dbb189429e3bc08435f2991d9f862754c473e1063942bd004f9b4684
MD5 c1baa8d8cafa3e17ea613692067b780f
SHA1 c52a53a27f83dfd47888e1b02320535edd375246
SHA512 d00f5c4cf941ffd0fa742b1840f733ea897bb717a93e8f7bb73fbeceb9504e1ef80e279a3987bb4d718a602feb3dd8cf59c78f1059c6da42608b750f9587e5f1
TLSH
T18CE02B8A8C735E03DB26787A0677642E333B06FD1605EE9A50ED145DBA55A7C8342605
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59adda.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\220ea591-7d9f-493e-a695-a7fcfa460ca7\index-dir\the-real-index~RFe59adda.TMP
Size 360B
SHA256 ce9fa0ae0199f44f79ba32af8bceeb7757a6fae0676c743aedf53fd4480e23c5
MD5 f77c5f25c055ad3f4d517210e0283a6f
SHA1 74f3334891bc6646b67bdda7290409710940f8be
SHA512 b1b7b7f374a6211957778abaf71b0dda96ae0a68b507cb7355323d9944cd19f03f6ce5ff6cd58461f4e5327dcc97855d3d093908f1bd101230c244e5e138200a
TLSH
T110E095DF40F16D53DD2619751547742E333F08383905D61650DE145F5931BBCC545606
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0e1eba059a6b991ff2505af9201723fbdcffd4d38ad1b8438d72f347c8d1d7a8
MD5 4e69acb08382531174d53d7530852fcc
SHA1 b83f16bbcaba5a491f5cd89c372197181ab400f9
SHA512 2200ce551c3f4349522e530f83373f280506c7875703acd6600d017c41f2c8869a442902292355ffa19ce4c26b2370bca802bcf4d0b84b2e789b4a328f1f53ca
SSDEEP 768:hrv+4UNbdz31u/TBOWGa9ONXyer1IRCzniBEeVH1SK7:hbsbV30NSIqnnEH1l
TLSH
T10C03BF36A4A89E338DE2A3C6B14776037FF86057D6840B90EDDE2F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3cee68f4ee6e5b70175541ec9c71127108b3fb12bfe5ea55bda20c71acc9ec9c
MD5 7e4ac83e28d855111a92529d0acb2021
SHA1 44ca416c53ccc0c92b343237d625a1f888f31ee1
SHA512 eff9285eed2f4231b7476014f81659b4e24fe2194a88945269a36f22f49d3e6ce2e834199707faa58b8321047d9b3a2cf8c78c54590d3438a097dc6584fc4f6b
SSDEEP 768:/rv+4UNbdz3Y5/TBOWGatDt2ONXyer1IRCzniwReVH1SK7:/bsbV3GySIqnFEH1l
TLSH
T11503AF31A468DE334DE2A396B14773537FF8206789840B90EDDA2F4E099759E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpdlztii8q7J7iLu.exe

Path C:\Users\Admin\AppData\Local\Temp\mpdlztbIDu8KhZxQ\mpdlztii8q7J7iLu.exe
Size 1.1MB
SHA256 d4cfab5e052df4c049f258e226d11825cb37b0359be454b83241edd59b295f08
MD5 d8fcb7a4ef513ffff9cd2b3448c2b0e0
SHA1 56b6322ec04bb397dcdcab70d50275e689312c4e
SHA512 ab12cc1164a4e0d8f4c94eaa0efc056bae36aebbddbdc86b3c271f52a66901d88f48e01b89d502a771277ca6f5ba388bc150d6094daf09eb1a673212ad3901a3
SSDEEP 24576:F69ePqpqfpP1y2LxKG0+m1gFZ3VttK5O1+MEcCxlnAlQrA:F69ePX110+HFlVts5aCxCM
TLSH
T11145BF15A3A411F8E62BC274CA9A5233EBF174811B64EACB1755D65D3F33AD06F3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8b10fd1feebf3637b4e98237e129aa62e9eb6886d4c99bb06debbecce88e07c9
MD5 8498499944f170192c0e9d77d4065b39
SHA1 5bf53a7fddf67df3590ca0c4c2ecb7ca2e0c5df8
SHA512 a50e5da9592ff56c6c0a60b5432a71be52cda98aa9e7fe1a868e0962748da16cdca310e4d28f36060e7bd30598a817895e0d943b0100b880b4b32e6c89c77291
SSDEEP 96:J7SdF95/7bkW6ArWu4nyUR6iWZ3nPFRc2F8F8sFNE/dd66JoztdzgClKtmBM2/UK:lOv5zbo8WJnyj11HR1d66JoztdzgCl68
TLSH
T10EC1BC64F739863BC408423BCCAA1B500F76394B985E7F1632DC640D2D5A2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 41c6770e1305d69b870d30609692a13cf466cbca758a3b2e8d754b572b51bcb9
MD5 f4b4d6268d1ad6924da7a8e43d0bd6f1
SHA1 bd8e84fdf8ba6c4fc943885dd9493341af8f8875
SHA512 efc3ae82ad81c5f2c38a1e6cfdff4f4342c0f1badd9a7b6a28e2bd9f3060b79e64b4718861a6bc03ccb350c3a9697f11ecb1d7b7a27f63c8ccdbff96cfc756f7
SSDEEP 192:3HR1d66JoztdzgCl6mBM2LOv5zbo7RsJnyjLMN:/d66Joz/zgC1O/boNsJnyj6
TLSH
T12BE100A4E629863FC408427BCCA61B410F39398BD84E3F1575DC651C2D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 58a972954327a3b4c4128dc462442ef41d2f64037b3e2ed6db1ef3c45dc44b25
MD5 59e7682bcd43904cad7956e49f72bc2f
SHA1 9bd11e0f017b5116e65eedb33419b30f051f6c11
SHA512 bb74594d594de6757912424d6b5280fea3d0c1224faa87cddf67dcb1583ed2021de60685e008d7e8773cb73ca2b4130a12566db96eb0fa444e7d1a509e17306b
SSDEEP 96:mnPFRc2F9F8sFNE/dd66JoztdzgClKtmBM2/UU7SdF95/7bkW6ArWu4nyUR6iWI:mHg1d66JoztdzgCl6mBM2ZOv5zbo8WJ/
TLSH
T177C1BB64F739863BC408423BCCAA5B500F76394B985E3F1632DC640D2D5A2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 19cddeba14951f015b25e483bd02179e010c0ace1a0ca0fe8aed63795680c2c3
MD5 5a555829b4bd79b7a9b238551dac118c
SHA1 a82b222d0f948a494ba01e481ab45f817b40ad4d
SHA512 05cf3e669f8f4f56749688acf531a67779780ca485dee0905a00c912c7f89e515ef7398d799556543b5114fe88b38f0e007c843af90b8ec42cb6319551adba9c
TLSH
T1D8217D5C36B84D3B78C7E25C7440038E57A08D07058B5C835E12DE8CDFD2AE93269439
MD5 SHA1 SHA512 TLSH

Submit Download

006a45f6-87f7-4d69-801b-3a0108b3e4c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\006a45f6-87f7-4d69-801b-3a0108b3e4c8
Size 16KB
SHA256 b7e20055069f95426101dc891c460cf643bef3799ecd1fd72281aa908fc4322d
MD5 2fd83e87eed740b4b7af12a9bddacf3d
SHA1 0db6474821cc1d755ea1fa1e8d9f6bd031b01140
SHA512 05db63c12625c3531042517692d958dd414c1b3490325c898cc46c25921b4533e937c39960897ed933c4943786a28abeb4f9b86072a22dbdd7c68f9c8760d3e2
SSDEEP 192:cEYnLYYSz47RQ1Ab1sB/A0gLgC2RzquIJopmgByq1pxtBzQ55qeEJDUO:KnLPSk7RQQQFg0yMbBQrqrDUO
TLSH
T16472EB56686055BE8551E3A9C8FC7FC3E2F528CF4C01DFCA9BE4BD0859EA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b452944-7973-43fe-8a83-cc5cef0510f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\5b452944-7973-43fe-8a83-cc5cef0510f5
Size 883B
SHA256 76430871cd6f94fa4a413fb37d851bf54bc33adf914765bbd72b219702f8104b
MD5 ce031f1a09c0235368640edb1eee307f
SHA1 9f0cd49a34d8911be6512bcfe0ef474bfcc5e796
SHA512 48b0e7cc82925b3ab2193fb1d29dfaa5ec6c943b9c1665f6beaf0d062c9d0361e1959e5a70615f5d35269062bce825ac218e64a40ec2b086153dd877292fd70d
TLSH
T171112380D63275B2DC28934FCDA977428FE8BA13C0C645003DA54A084E7E66FA7AB647
MD5 SHA1 SHA512 TLSH

Submit Download

870423aa-a43c-4925-9db5-d4f0605c4edc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\870423aa-a43c-4925-9db5-d4f0605c4edc
Size 235B
SHA256 994ce90053a4659eaebf20774fb3f27b147a9226e069a0afba11fc45e54e308a
MD5 859a05b9f2a1ba180a4c3c3fedfbf935
SHA1 766b45749c2ab7ae1fe4d4413f5acebd12c5a988
SHA512 95dbc778dd907740b35118e9b58c9e7cd6c86761e3511f6cc381578868262f1e11427bd7bd32103f418faab3d093dc9505d6cc4dde17c312edfcbb3a3846f4ec
TLSH
T192D0978228C8271C08044F06B0E029D630984C332AB0681086A20438CEFAEC442A281A
MD5 SHA1 SHA512 TLSH

Submit Download

9a7251b8-7010-4622-9656-62604b828bc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9a7251b8-7010-4622-9656-62604b828bc4
Size 2KB
SHA256 584c0e13c2614a0054420f98c819e8106f7dfa16954b4f1309885b905ab6dc72
MD5 6cc615ad17f77afb80f5b0efa53969e3
SHA1 1a16ba7bc1bc54126d8ded00055ea6523771aaae
SHA512 98f0ff90b8f5d485ca7cbdf2baac766a0354c21071d2a1cc410ea829c5fc66462b2c30f45c33cab7648170983c2aa6a084fac3d6035431857c95beb98b8e0199
TLSH
T19641335835F85D768CCAF29D9891338E97A19A0314821C836D51DF0CCE96F9E33AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

e1fd896a-b547-4f39-bf0f-1c24cadebb8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e1fd896a-b547-4f39-bf0f-1c24cadebb8a
Size 886B
SHA256 a3d61e002b4669c830ddbf599d7ab51ae599138876c052df281a1955ec15c240
MD5 c1eef81338d0307bd8eb44c0e877e701
SHA1 0aba82f1534b4b1e1e950fab90dbb91fa1819e7c
SHA512 dadaf802cfeccb36955f7ad23cac4f8733e4c995defcad89a149d389608d1d2baa22a12edbf5dd12a7da9f075906afbf8985277158d56fe74c9085637d29fad7
TLSH
T1A5112340CA7579B1CC78838F88E9B7528FE4B513C0C65900BD944B084DBE25FA7A7207
MD5 SHA1 SHA512 TLSH

Submit Download

ebf35c1b-dfbb-4aeb-a68f-cec15a2b4936

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\ebf35c1b-dfbb-4aeb-a68f-cec15a2b4936
Size 235B
SHA256 dd45da2e593d4714b1ac812c9a1849282a355c6251006fc16692aeabbcd56d15
MD5 5ec0f31db8a7c121fd2ee816eca2411f
SHA1 da1de735f3cb5093d68470e490f4034528d7422f
SHA512 90d98db7d3b88860c12c6dd5feb319696f34961d19a38e241d7d52598d96734e8218d43ce48f2d3934096bde89b248dac16a61db21519e6ce6b9025d588c2390
TLSH
T1D7D0A7C1249C6B5D49140F07F0A069C770958C3729B4A85096A255789EB9AC99266927
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 cf5d8518ffbd968ff5b2ca77c0a788b0ab970d3df48cb8f1c31fbf0cd1930664
MD5 fad06f8cf89703e3b5ea60cc33faf7d0
SHA1 3cb575caa76186362ce7c52745f493d515dc5a67
SHA512 2a3cf093b7c50a174eeaeb2e08f0d018f7836ba34b6f33366b054dce4f9984301d3218f88a4376e0e97c15cbb0c66ef0f8b3caed7fa86dfdbf9007068a631db8
SSDEEP 96:xHpUTUWqGqPf2Bve1zSpSSlvdv9jJn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BvegSStj7/Bw88qU
TLSH
T1DCE1217890488F7F64B6777CAC688831AAB2023B7BBF68C350B95485055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 1a90a9ea1c5fee21669dc68aba188eaf49951c8ad24f4e9e52e26fced2385da4
MD5 0480030e06b0529bbffac75ee24ae94e
SHA1 05a9e85f7e8d17f14781f0c76a674b485c327853
SHA512 079347aa0e04d6eff05e84208fb02b363fc5cda1a9881d622f5a2963df53ac1672a3abcfdcebfbf21ed84568bcccdf53a0a978e58b06d1a6b5ae1106acbb64c6
SSDEEP 96:xHpUTUWqGqPf2B4l1zS1lSSlvdv9jIn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B4l+lSSgj7/Bw88qU
TLSH
T1C9E1107890088B7F74B6777CAC688831AAB2013B77BF68C750B95484055CF3445F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-778-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-829-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-375-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-356-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-358-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-355-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-351-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-348-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-331-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-330-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-329-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-91-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-85-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-84-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-43-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-42-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-0-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-783-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-784-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-785-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-37-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-790-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-793-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-799-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-805-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-811-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-817-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-823-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-396-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-835-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-841-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-849-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-855-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-856-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-862-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-904-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-943-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-1-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4440-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4441-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5407-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5403-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4475-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4482-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4485-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4495-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4497-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-4500-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5147-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5353-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5354-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5355-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5398-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5402-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/4624-5406-0x0000000021A80000-0x0000000021B3B000-memory.dmp

Download

memory/6004-4454-0x00007FF70D540000-0x00007FF70D580000-memory.dmp

Download

memory/6004-4452-0x00007FF70D540000-0x00007FF70D581000-memory.dmp

Download