acrstealer | 93c1efb3c3ea7d9de86bf4b10a2a3ffebfca1f750c506cb3897e05ae0b5663c3

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93c1efb3c3ea7d9de86bf4b10a2a3ffebfca1f750c506cb3897e05ae0b5663c3.bin.dll
Size 5.9MB
Sample260820-kfbemssgpe
SHA256 93c1efb3c3ea7d9de86bf4b10a2a3ffebfca1f750c506cb3897e05ae0b5663c3
MD5 810e6d55df57fe81cd34bd74b260b8e2
SHA1 1936b82cca1b7264d1d85d8b2581bfcd565ad68d
SHA512 66b2ecb26be47de44a0450f565e7a096f7292ed1b2596f9531c108894afe64724536b0029ac1bd596605cfb81a7b1602cf8fe061fc8f485c931f95aa0bda241a
SSDEEP 49152:8BYvboJtjLjGofSOo8IVhPoCIEdowTrTn0zadrCnpg/oIFzJAcU3LoCIlHggcfa0:S
TLSH
T1D45609124E5C24A7D1E5C1FD25DA76C8CD9E48289AE877972CD381FCA5CEC2508CA2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c4eb-6.dat	family_acrstealer_v3

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3264 created 5280	3264	explorer.exe	92
PID 3264 created 5428	3264	explorer.exe	111

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3264 created 1328	3264	explorer.exe	81
PID 3264 created 1328	3264	explorer.exe	81
PID 3264 created 1328	3264	explorer.exe	81

Loads dropped DLL 1 IoCs

pid	Process
3264	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3264	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 932 set thread context of 3264	932	rundll32.exe	90

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4808	msedge.exe
3056	chrome.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316884394451469"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{73FA96B1-8BFD-4921-B151-BBE633D1D523}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3264	explorer.exe
3264	explorer.exe
3264	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe
Token: SeShutdownPrivilege	5280	chrome.exe
Token: SeCreatePagefilePrivilege	5280	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5280	chrome.exe
5428	msedge.exe
6080	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 932	1732	rundll32.exe	89
PID 932 wrote to memory of 3264	932	rundll32.exe	90
PID 3264 wrote to memory of 5280	3264	explorer.exe	92
PID 5280 wrote to memory of 2696	5280	chrome.exe	93
PID 5280 wrote to memory of 2432	5280	chrome.exe	95
PID 5280 wrote to memory of 3056	5280	chrome.exe	96
PID 5280 wrote to memory of 2432	5280	chrome.exe	95
PID 5280 wrote to memory of 848	5280	chrome.exe	97
PID 5280 wrote to memory of 3212	5280	chrome.exe	98
PID 5280 wrote to memory of 848	5280	chrome.exe	97
PID 5280 wrote to memory of 3212	5280	chrome.exe	98
PID 5280 wrote to memory of 3680	5280	chrome.exe	99
PID 5280 wrote to memory of 3680	5280	chrome.exe	99
PID 5280 wrote to memory of 3220	5280	chrome.exe	100
PID 5280 wrote to memory of 3220	5280	chrome.exe	100
PID 5280 wrote to memory of 1568	5280	chrome.exe	101
PID 5280 wrote to memory of 3664	5280	chrome.exe	103
PID 5280 wrote to memory of 3664	5280	chrome.exe	103
PID 5280 wrote to memory of 1560	5280	chrome.exe	104
PID 5280 wrote to memory of 1560	5280	chrome.exe	104
PID 5280 wrote to memory of 5904	5280	chrome.exe	105
PID 5280 wrote to memory of 5904	5280	chrome.exe	105
PID 5280 wrote to memory of 1192	5280	chrome.exe	106
PID 5280 wrote to memory of 1192	5280	chrome.exe	106
PID 5280 wrote to memory of 1364	5280	chrome.exe	109
PID 5280 wrote to memory of 1364	5280	chrome.exe	109
PID 5280 wrote to memory of 4592	5280	chrome.exe	110
PID 5280 wrote to memory of 4592	5280	chrome.exe	110
PID 3264 wrote to memory of 5428	3264	explorer.exe	111
PID 5428 wrote to memory of 4476	5428	msedge.exe	112
PID 5428 wrote to memory of 1108	5428	msedge.exe	113
PID 5428 wrote to memory of 4808	5428	msedge.exe	114
PID 5428 wrote to memory of 1108	5428	msedge.exe	113
PID 5428 wrote to memory of 1108	5428	msedge.exe	113
PID 5428 wrote to memory of 1924	5428	msedge.exe	115
PID 5428 wrote to memory of 1924	5428	msedge.exe	115
PID 5428 wrote to memory of 5740	5428	msedge.exe	117
PID 5428 wrote to memory of 5740	5428	msedge.exe	117
PID 5428 wrote to memory of 5740	5428	msedge.exe	117
PID 5428 wrote to memory of 2664	5428	msedge.exe	118
PID 5428 wrote to memory of 2664	5428	msedge.exe	118
PID 5428 wrote to memory of 2664	5428	msedge.exe	118
PID 5428 wrote to memory of 752	5428	msedge.exe	119
PID 5428 wrote to memory of 4848	5428	msedge.exe	120
PID 5428 wrote to memory of 752	5428	msedge.exe	119
PID 5428 wrote to memory of 752	5428	msedge.exe	119
PID 5428 wrote to memory of 4848	5428	msedge.exe	120
PID 5428 wrote to memory of 4848	5428	msedge.exe	120
PID 5428 wrote to memory of 2072	5428	msedge.exe	121
PID 5428 wrote to memory of 2072	5428	msedge.exe	121
PID 5428 wrote to memory of 5964	5428	msedge.exe	122
PID 5428 wrote to memory of 5964	5428	msedge.exe	122
PID 5428 wrote to memory of 3952	5428	msedge.exe	123
PID 5428 wrote to memory of 3952	5428	msedge.exe	123
PID 5428 wrote to memory of 1584	5428	msedge.exe	139
PID 5428 wrote to memory of 1852	5428	msedge.exe	128
PID 5428 wrote to memory of 1852	5428	msedge.exe	128
PID 5428 wrote to memory of 5244	5428	msedge.exe	129
PID 5428 wrote to memory of 5244	5428	msedge.exe	129
PID 4588 wrote to memory of 6080	4588	firefox.exe	132
PID 4588 wrote to memory of 6080	4588	firefox.exe	132
PID 6080 wrote to memory of 2456	6080	firefox.exe	133
PID 6080 wrote to memory of 2456	6080	firefox.exe	133
PID 6080 wrote to memory of 2456	6080	firefox.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1328
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c1efb3c3ea7d9de86bf4b10a2a3ffebfca1f750c506cb3897e05ae0b5663c3.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\93c1efb3c3ea7d9de86bf4b10a2a3ffebfca1f750c506cb3897e05ae0b5663c3.bin.dll,#1
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffddc5bc728,0x7ffddc5bc734,0x7ffddc5bc740
    3⤵
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,7251868379607910698,8669543476641805938,262144 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1428,i,14208816450038938713,12705241813588873130,524288 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,7877807532005371137,9057048494759621102,524288 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
    3⤵
    PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,15627643181721011047,1863609735763464913,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3036,i,15060507610796745957,2955280981801734230,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,1016039245150405481,12835775612310968344,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,4454472113428447107,11409504708089799101,524288 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5400,i,16292453162657294794,12395017282105725138,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5356,i,9763169501625689452,4115201058050534091,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5692,i,2160696450224698457,8996892360633484093,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:5904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5872,i,6313771812266202558,6036273670904390953,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6192,i,522863643970223481,7793479131798927155,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6204,i,10297445422245383381,9549908271784830496,2097152 --field-trial-handle=2104,i,6877312050154142038,5085660681737927153,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdd126c188,0x7ffdd126c194,0x7ffdd126c1a0
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,16212502383620042393,15127114613216147673,262144 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,12308682064218770109,11157663308863997052,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,4176737898962562857,13212639713113563507,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:13
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,4308011044320531710,6628240661512675856,2097152 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,6615992519483200993,12728888880320848162,2097152 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,17392631023071812869,7794096014834236898,2097152 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,842459306915862858,8035754349703385968,2097152 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5121253302438537474,7553480128308044144,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,6866009751072323855,3560938355162470985,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7764559042725036659,17127383672113518522,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15418750747156427212,6650667465440719601,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15418750747156427212,6650667465440719601,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12349960452581466838,16849155691863343967,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,942949852735197882,6944280900607132361,524288 --field-trial-handle=2404,i,15674333924512875476,5683570309190613792,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:5244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27097 -prefMapHandle 2296 -prefMapSize 270315 -ipcHandle 2376 -initialChannelId {04b635a8-bfa9-48d8-8aed-2d2fc4de0e17} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27238 -prefMapHandle 3820 -prefMapSize 270315 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {8f5ce52b-4ce0-49f8-92dc-08029d8021ce} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27238 -prefMapHandle 4016 -prefMapSize 270315 -ipcHandle 4024 -initialChannelId {85a699d3-ac73-4d41-99ad-b87dcb2c06ee} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34737 -prefMapHandle 4408 -prefMapSize 270315 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {77793b68-a995-40b2-910a-18abc01dae32} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1592 -prefsLen 34974 -prefMapHandle 1604 -prefMapSize 270315 -ipcHandle 1612 -initialChannelId {01e8abf3-6e6c-45c5-b391-cd45c79b7a7b} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:2712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32916 -prefMapHandle 5188 -prefMapSize 270315 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {630c66da-43f5-424f-89c0-07c4d1c7139d} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      PID:1096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32916 -prefMapHandle 5224 -prefMapSize 270315 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {03a089bd-2ba2-4cfa-a1ab-743c0a4ebbd1} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:1584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 32916 -prefMapHandle 5564 -prefMapSize 270315 -jsInitHandle 5568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {6126f188-1171-4654-b200-18f2f7e51aca} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:3620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 8a656c53f47011b147a593fe4c9032c60d7c3314a1db30019939e756f37c04d5
MD5 683e66d2433ce75dd4f799df6c6ef8ee
SHA1 5c054b7a7c788d73cc4d35009bc8547d4be69a0c
SHA512 2c64484924a7dfc687ff4c2ff7e4d4271abf3ddf30453775b2839c3e9550aae2e011dc5093b674bf23e4bd3a77f524b8f8645b199eebcd0ec2e5895b45adf20e
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OPbOVumFnjG:1nbZeMrv/hGtjonjG
TLSH
T190D3A74B3A747102EDE58A761CE054BB5E3CB16D8F15A1D528B720588EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1f1acb6603892fe57df63cd6d473d533744c5e14e83b1b85cfbb7d08ced0b1bc
MD5 234436412306b282e115b8f567fe785c
SHA1 9d2ee369027d5030bc78593f3ddbf0113e24d941
SHA512 4dcfab1f61d93c756840891e4224e02fcff79d0c2f916d151aca61e5cecb4a91050a9ef382f9d7ada638bd3f98dc46328c45136f6f2d263d82fb931d41750a8d
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5s4DUB6vGyvk54EBTboRYv4a:5C0Ngjf5ZKSNqDUDvY7qEBTbog
TLSH
T118A109B1A46D5DB394B6C5CDB1467B43DEE421A7A5A1EF80E8DD1F0C00FB1D81382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4819ad84-968a-46b1-979b-7a097410ca7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4819ad84-968a-46b1-979b-7a097410ca7e.tmp
Size 34KB
SHA256 3b7e207427829bdf66e4f1e4824217255e6d167f9db7025cae002e8e8c898784
MD5 04263736a7f338decc302acb88396df7
SHA1 c2e7fbee6f8a7fca311d907970d68a50d3b0c6fc
SHA512 ff888b4acfd390cf823bb96a3fdb0b34761147c52131b6235f3a6457d399bb124d6b2af8c1330527003018cc902adf7408860ff8ed6d2d2ad1b7902525a7d96a
SSDEEP 768:/rv+4UNbdq3xqqYLrYpAAam6aQMGdjWca4GhfBbPeU/:/bsbc3qWKmaME6pTH
TLSH
T1FEF2AE31A87C9573DDB79A99F21B6787BEF021A384C40E84C9D96B0D439718E230792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8693afe4a0dcde295a5fd83e27f3ebd89b51757e975556be3dc373560dcf012b
MD5 5a6bbe3636806bf5bdef416217d76ced
SHA1 09f4b3578fdd932f69f4d558adde19a16fc8b3cd
SHA512 9c8850da05951f5d6c0fe5d1d9459164c42860f29c944f8718a8ece9484bf30a26abe54bb7a9e2981341ebed000c199d7f1572c8be901f87db30d2666d1ddf5e
SSDEEP 192:sxRXRnx5/fPsvCeQ/+Ubh+WoA8pJv/g6+WNPzo/YZ7uKsHGVIgVeeJ:sxRXT5/fPsvCeQG8IB/50/NIT
TLSH
T1D252C5166D78583B5CC7D25DFE16BB53E7F91422A0D45E48EAFC9A1C04EB6CD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f1c6fb0e4c95c46cfeefa35477e04a96ed388624962b5f359d2c79d107340184
MD5 e89266857fe06fc41dea703b5900f2a5
SHA1 899aaed171db3dd994620432fb696c06a01d85d8
SHA512 f68beae3b0550e8cac7b46bbdd49ab1ecb218ab8807ea1132c726dbae0a45b0a42290c8b7d0d25835307568de54dd6215836cdeb991a549a13c35637d041fb0b
SSDEEP 768:ky2SNS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTSV4crobd+l:ky2SNqE7evWgd5f/bu1ja0U4H0l
TLSH
T16AC2CA7B640CCB7F4F804ADDA8197F9A6D6802CB96D8CD8047FE951C03C6BEE51264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\61bee4c6-9d6c-4478-a017-7031c7e4dbc1\index-dir\the-real-index
Size 360B
SHA256 e434a813f518b4c145a0d102817d38c5fc551d335363553dabb3c31350d5a649
MD5 987ca58ceedc953d109bc1e716bc3b17
SHA1 bdba1c3d766b78c7fc2b37e351530878493d33ff
SHA512 f6d3ee31b3f65d041fa56f15d3e2ad13764c5fb797d0fb1557632d9662db5e47624cb5d931705ffb41b217323e51adc3e55b29a6d6df166a4c4e84ff25b3f47f
TLSH
T15EE0EBCE4C458883CE32287909B3280E333F07FE2A00AF3310FE002AA55252C2447200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad6d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\61bee4c6-9d6c-4478-a017-7031c7e4dbc1\index-dir\the-real-index~RFe5ad6d9.TMP
Size 360B
SHA256 0f66c9157414a74611edc6a3fce2ae3fa6b8914218d02f6345c23b2775d2d206
MD5 d38a76d5fe289e7810a34c2d183dc376
SHA1 85dd4c5e8f56ce34c1fa02298c46b5dfe9dc452c
SHA512 8f708573d1002ad21f55429bd667d7699e6b2393ed21c43cc3830e6c5d7cbdb4e6d94cd18baa7cf8996815ae17e8f17f06cf59caa72a4587c5b76c71dcaa1a98
TLSH
T178E02BDB00805CE3CD2515785943961A337F08252915870720DF185A55A1B9C4449646
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1115da17dfaa239e3e94fe8a2007a1cec39c41e7b655420220f209b665d5e663
MD5 1f26b030f3b28ba05d0ab238c5ce0966
SHA1 4cbde09a7d7aebf24fa9785d01a15baa1778cce3
SHA512 d80575dc4882e1ac7020a05a1784951a3446593eced35b11ea37f99913b6736cf295fd8fd0d412eeabe8e2ff2c1ca02d81364ad360b4c4bc3184a1da7afadf36
SSDEEP 384:DNrRZyCSDnxTICurMEhIKyll7svbFKfk7:xFZJSDnivgyI1l7svbF9
TLSH
T12A44740A7B747001EDE6D9725CB080771E3C716DCF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5e3f1fab61ba6dbd0f37a67055de6647bd67e9020172118ef06cefa020de88ee
MD5 4779b7d7f07a4186f135cba71b2d74e8
SHA1 34797c7be4efa40de2768e2c2d721ed65b841309
SHA512 f3118122d5a987dd5da3695a7a64e8688fdf3bd7de905dfafbfd1171e08d867cc90865b84ff990c02dc95020b468da3e05edcb621920b3c8e3d7e6b3d40df022
SSDEEP 768:Hrv+4UNbdq36FwqYLrRLxsAam6aQMGdjWca4Ghf9n6K:Hbsbc3xvemaME6pnF
TLSH
T11703AF316878D9739CB6A699F61B7687BEF411B388C80E84D9D86B0D079718E230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8a930bad2e4546d4f0d39d76d1dc8ca26f7b164328a78ddae8ccb5ff9e287e9
MD5 ee5c45c9b87afa45af023ddd5a3be71f
SHA1 6d137e21d13254bf8c96814c40b32c2f7e279fcd
SHA512 92d8d007b002810f1310195751cef89adeabec4ea27f7a96330a1e5bb0c99322bbbfa1bd63c4d52175d774fd8be1e41e6913e1e63a18b092e2fb77fb7205a410
SSDEEP 768:Jrv+4UNbdq3HKqYLrRLx0Aam6aQMGdjWca4GhfwnPeU/:Jbsbc3gvWmaME6pcH
TLSH
T112F2AF31647CD8339CB7A695F65B6687BEB421B388C40E84D8D96B0D439718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a841a6e7-dc0f-42bd-9926-0d04e26544f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a841a6e7-dc0f-42bd-9926-0d04e26544f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5428_632011016\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 993b5aca84b5bc19b0ad086d5f79acc4d8968d2db9041a99591716906e98a011
MD5 dcfba59cb3349431b6330fb1993c60dd
SHA1 08503673a8a529ef8335338dcee61eb85648b779
SHA512 2216407e681a70a022af55b056dbb2ecd906e3bf9b33a4350ce8570da0e1dfa040b3424139802f2e7346da10d40a290cfd66a9c019bff7963c39c4e9067f66a3
SSDEEP 192:+Ov5zbo8WmAyjX8DoI1d66JoztdzgCl6mBM2:Vbo8WmAyjtid66Joz/zgC1O
TLSH
T16DD10EA4EA28863FC458423BCCA51F410F36385B985E7F1931AD64482D472DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f04152e0044c594e2b1d206bb3d51fec929c6a8e93409868a9a76af460b330e9
MD5 beb836d1d7c008552f4c870bfae0a07f
SHA1 f04eaed272efd4c842d1bf88c8ed79238810146c
SHA512 bbec9fe7c20679ae2178e30d069dfec4352bd98fe71df16baef9c253199520fb8aea9a7a641f36dc4e24c1e08afdb71c621c0c955774123f40c15a60580f2c97
SSDEEP 192:IOv5zbo3smAyjX8IoI1d66JoztdzgCl6mBM2z:zbo3smAyjkid66Joz/zgC1OG
TLSH
T14BE1FF64EA28863FC418427BCCA21F414F36384B985E7F1531AD644C2D476DE7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b89cdcea92a052471d549e38d54a70a97432f321804d2823283c6cdffd192e9e
MD5 0bdbc2075f0e3790a69bf8b8ebc12787
SHA1 ee6416c394f5dd254f55c3bf702b4b8c44ba9d21
SHA512 6023783a1d992a22cee061937e5dab4c8befc0896f9782c7685f70b4bf5bea5a85c1a4e3ffb842e4b419623d1932820987dc11989baf2ae184d8a4391e20f728
TLSH
T1BC116A5C39F98D6A99C7E29C7C51128E53224A06448B2C430D02FFCDCF91ADA316943D
MD5 SHA1 SHA512 TLSH

Submit Download

0ca316a3-4285-4a35-a665-4ea7edaef7e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\0ca316a3-4285-4a35-a665-4ea7edaef7e3
Size 2KB
SHA256 934a142c643753ff306a2702f2ff8c1754e3faa76c5e27bca6173222ec35ef8f
MD5 9df8e233d2b8b9cf8d6aa9e746de2c36
SHA1 0d6178d107a4d4bbdc3bd39484121dc80acdbcb0
SHA512 8e7101ed5656cf5e483aff2d8204888d288c1cc5819bf7d625a868cf5f094f3f7a7be10d587c963b6832ca571c9633adca862ad39fe27074fdc5edb0f2f3beb5
TLSH
T11F41739C34785D778CDBF14DC091238E9361994300C21C472D62EF0CCE866DE33AA22B
MD5 SHA1 SHA512 TLSH

Submit Download

1138c99f-5555-4e37-9fc8-f12d743cf9b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\1138c99f-5555-4e37-9fc8-f12d743cf9b5
Size 886B
SHA256 02e827d4c2686c884ee129cdaa4bce120f3465281b4e0c8cf86c00ace2c6e2f8
MD5 6b5f9f7ee2fd2c7fc12fbceea06a734b
SHA1 0bdbf792cbe6f2d14f663aad87a2775e0d3e77f1
SHA512 c2dd7c3600a7d628dc819012e11ce8b39bbd291be3f1d4eda013fca5ff3f96c555f3c9f53c408fe99e7fed2355a396253b171a719b1f1cf26075cf350f0596cb
TLSH
T15C1123908678B572CC3CD29BD5E17B439BE57423C0C619143DD09A080DFE51FEB96603
MD5 SHA1 SHA512 TLSH

Submit Download

5ae42c77-0cdc-46c5-ab0c-55fd6fa75e87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5ae42c77-0cdc-46c5-ab0c-55fd6fa75e87
Size 16KB
SHA256 8f275270b45722830e71daba2c47f55440e8020988311aa97745024fd00234b8
MD5 64cbbb5ebec004996157a4b43aea9c9b
SHA1 8f9a52daf23b9dd0cc1e69514f481321e66ac722
SHA512 f85ecd3d7cd0823172469e6fe32717ee658f965706e55e38f8b54055aa42d9f8c9390a8ee01be5dfc01d31f0a8ed51322951950a5089e513135ecf61b477e4dc
SSDEEP 192:MhqXvbXR8IH0xorLhbvd7CC8Xnr7r5MzxRJiL2SluvB41p48wBoJJ0xhCB:/17CC+nr7r5MlRJi6SkvZpIe0B
TLSH
T11372CA56686055BA8591E368D4F87FC7E2F638CF4C019FCA8BE4BD0869DF06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b169d6ab-a5c8-415c-bf9e-4ae8ff1ca323

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\b169d6ab-a5c8-415c-bf9e-4ae8ff1ca323
Size 235B
SHA256 36d964c18ec0274204941d65c39e079bf95c58344104f0cc003678e67025652c
MD5 0395dc332bc5e10bb4420dbd7af3ede7
SHA1 8d5b2b499928ffde8c285b1c1a4dd456fa27a11d
SHA512 5ba7cb00b9a7b232dbd3e9ea7b8798641457d51fa68498c79232f6151af09458a17a83b40283aa22fe6506432845002c89e28f7e1ecd718db9c98c47ac33fe1e
TLSH
T133D097906488737E0C240F63F0E03DDA30948C372070BC20EAA140B48EBEED4425582B
MD5 SHA1 SHA512 TLSH

Submit Download

b3c2b71b-7236-4e50-951d-f62996719514

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\b3c2b71b-7236-4e50-951d-f62996719514
Size 883B
SHA256 14b03aa8650fac5101d30bfe5408d612a84097c4cae0973e53784af73fe821e5
MD5 ba7c3d1e69040e1aa0a715080f55d93d
SHA1 9814e988ae425a96dbb32d6b4d79f4b32b7ccfb3
SHA512 633568acf446d6a665d1618fd58b2d29ffca0a15de516f94176bf88296609962cf33aa4042bd0efed3988784a4a98e04322e9a83b196f637a6f360de609b6083
TLSH
T19F11C080D539B572CC78D24FC8553B429BA9782380C655143DE19E084EBE51EDB9A747
MD5 SHA1 SHA512 TLSH

Submit Download

ec2a567c-84e1-4bb1-92af-07ffe5863f59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\ec2a567c-84e1-4bb1-92af-07ffe5863f59
Size 235B
SHA256 064f00755b56ac8d3bfa96708a353e7fc466eb1f7b405a2fea0b7918f9e82e1f
MD5 ccc817d2b86e7ed20470d92feb2d57a7
SHA1 74752cbc3fb2bbd65169901f763184924bcef3fa
SHA512 dfcbfd7bae6e42c9a6c364c2423e6eec81de8d6b694808514ce4eefd2049ca485ff85cef4ac985825377eb247dc58c9ae7d064e5b79279ea1c4ef8e86955554e
TLSH
T114D097C0B498772D08040F02B0E1B9C671498C3368B09820D6D06274CAFDDC44161A1E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 8ecb2467177ebddc4cb064b5dc9c030dd0610e54e084304a697da0cd6cb97e5d
MD5 919bfa7d336e12b18367a627f5a64cfb
SHA1 932db1182ee8ed2dd894514da158155161aac37c
SHA512 d97e1ebef0acebcfa3b7f049320b6e34c883419b59d86e433dea5aff6f89b27ed85c675bb39ed7c6c1f414f9d23b96af8ce8e2cf299291cabe6e6842e3147107
SSDEEP 96:xHdUTUZqGqofyP21zSvSSlcdv9jznUHgYETBw88u8L4cn7yTM:P0RofyP2WSSrgYeBw887
TLSH
T133E1207850088B7F74B677ACAC648C316AB2417BBBBF68C710B55484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 14363d516084380499433ca44095f49d37795e95cb2913739216cdf01f634cf8
MD5 f625199a128b5bfbaba857f560c25269
SHA1 df5c37e04992c0ffd68feb9d355dccb5c70d93ae
SHA512 b2b77acca7b3a589bf1875e97c3a5fe91ec433673545da39af4dcc7805f746c9500275901270d8937ed18ebd80b769c32e169e9f36e48cf81f5251b9e20bd8c3
SSDEEP 96:xHdUTUZqGqofyC51zS5SSlcdv9jTnUHgYETBw88u8L4cn7yTM:P0RofyC54SSngYeBw887
TLSH
T183E1207894088B7F74B677ACAC648C315AB2017BB7BF68D710B59484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF2B338417974F9412.tmp

Path C:\Windows\Temp\~DF2B338417974F9412.tmp
Size 589KB
SHA256 36f61265af7ef12dbbe86c482d80936855306bf6d8a6feeb6396da348339a419
MD5 8c360c8804116cbcb1a7322267dffc93
SHA1 14c11b9a78c9f9986db211676661349e12489c6e
SHA512 087acd0241a36d687bb741fc199c4b2815892d97cef0cabff8200981764a0795bc37759c51684f6673e93a804005704f48e5e370355e4e21a9aa92abbb383e51
SSDEEP 12288:XxgK6wQU7amMm1MdyLtzaC6EWNLWUUPg3DQyhoe3Ifp5cTrOsFI:XxgK6wQU7amMm1MdStuC6EWNkuvie3w1
TLSH
T126D4AF45EAC380F1ED436871326FF33F6B72AE16C871C9DAE7E19952AD63360161B181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-0-0x00000000374F0000-0x00000000375CA000-memory.dmp

Download

memory/932-2-0x00000000374F0000-0x00000000375CA000-memory.dmp

Download

memory/3264-9-0x0000000000E80000-0x0000000000E87000-memory.dmp

Download