acrstealer | 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
298s
max time network
304s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260825-w96nesdn4z
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.7-alpha2

health.indigowell.cc

Decoy

fonts.gstatic.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
f1575b64-8492-4e8b-b102-4d26e8c70371

01a0353f-0ad2-7efa-8507-e484ee70ce02
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000028b6d-5039.dat	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2580 created 3388	2580	explorer.exe	57
PID 2580 created 3388	2580	explorer.exe	57
PID 2580 created 3388	2580	explorer.exe	57

Executes dropped EXE 1 IoCs

pid	Process
3604	185705182.exe

Loads dropped DLL 1 IoCs

pid	Process
2580	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3604	185705182.exe
3604	185705182.exe
2580	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 2580	3604	185705182.exe	104

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\185705182.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3452	cmd.exe
2456	cmd.exe
2784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185705182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1612	chrome.exe
5148	msedge.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321568371303741"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{6970474A-79B5-45D7-B4A4-94F3902D3B8E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2664	reg.exe
4220	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\185705182.exe:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3604	185705182.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2580	explorer.exe
2580	explorer.exe
2580	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
6048	msedge.exe
6048	msedge.exe
3900	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 3452	784	Setup.exe	84
PID 784 wrote to memory of 2456	784	Setup.exe	86
PID 784 wrote to memory of 2784	784	Setup.exe	88
PID 784 wrote to memory of 2664	784	Setup.exe	90
PID 784 wrote to memory of 3604	784	Setup.exe	92
PID 784 wrote to memory of 4220	784	Setup.exe	93
PID 3604 wrote to memory of 2580	3604	185705182.exe	104
PID 2580 wrote to memory of 2028	2580	explorer.exe	105
PID 2028 wrote to memory of 4836	2028	chrome.exe	106
PID 2028 wrote to memory of 1612	2028	chrome.exe	107
PID 2028 wrote to memory of 4656	2028	chrome.exe	109
PID 2028 wrote to memory of 4656	2028	chrome.exe	109
PID 2028 wrote to memory of 3064	2028	chrome.exe	108
PID 2028 wrote to memory of 3064	2028	chrome.exe	108
PID 2028 wrote to memory of 2444	2028	chrome.exe	110
PID 2028 wrote to memory of 1324	2028	chrome.exe	111
PID 2028 wrote to memory of 2444	2028	chrome.exe	110
PID 2028 wrote to memory of 1324	2028	chrome.exe	111
PID 2028 wrote to memory of 3852	2028	chrome.exe	112
PID 2028 wrote to memory of 3852	2028	chrome.exe	112
PID 2028 wrote to memory of 6044	2028	chrome.exe	114
PID 2028 wrote to memory of 6044	2028	chrome.exe	114
PID 2028 wrote to memory of 5652	2028	chrome.exe	115
PID 2028 wrote to memory of 2152	2028	chrome.exe	117
PID 2028 wrote to memory of 1412	2028	chrome.exe	118
PID 2028 wrote to memory of 2016	2028	chrome.exe	119
PID 2580 wrote to memory of 6048	2580	explorer.exe	120
PID 6048 wrote to memory of 2452	6048	msedge.exe	121
PID 6048 wrote to memory of 5148	6048	msedge.exe	122
PID 6048 wrote to memory of 5124	6048	msedge.exe	123
PID 6048 wrote to memory of 5124	6048	msedge.exe	123
PID 6048 wrote to memory of 5124	6048	msedge.exe	123
PID 6048 wrote to memory of 3592	6048	msedge.exe	126
PID 6048 wrote to memory of 1688	6048	msedge.exe	125
PID 6048 wrote to memory of 3592	6048	msedge.exe	126
PID 6048 wrote to memory of 3592	6048	msedge.exe	126
PID 6048 wrote to memory of 1688	6048	msedge.exe	125
PID 6048 wrote to memory of 1688	6048	msedge.exe	125
PID 6048 wrote to memory of 3028	6048	msedge.exe	124
PID 6048 wrote to memory of 3028	6048	msedge.exe	124
PID 6048 wrote to memory of 4060	6048	msedge.exe	129
PID 6048 wrote to memory of 4060	6048	msedge.exe	129
PID 6048 wrote to memory of 4060	6048	msedge.exe	129
PID 6048 wrote to memory of 3084	6048	msedge.exe	128
PID 6048 wrote to memory of 3084	6048	msedge.exe	128
PID 6048 wrote to memory of 3084	6048	msedge.exe	128
PID 6048 wrote to memory of 5420	6048	msedge.exe	132
PID 6048 wrote to memory of 5420	6048	msedge.exe	132
PID 6048 wrote to memory of 1044	6048	msedge.exe	133
PID 6048 wrote to memory of 1044	6048	msedge.exe	133
PID 6048 wrote to memory of 5372	6048	msedge.exe	135
PID 6048 wrote to memory of 5372	6048	msedge.exe	135
PID 6048 wrote to memory of 2268	6048	msedge.exe	134
PID 6048 wrote to memory of 2268	6048	msedge.exe	134
PID 6048 wrote to memory of 1688	6048	msedge.exe	137
PID 6048 wrote to memory of 5436	6048	msedge.exe	138
PID 6048 wrote to memory of 5436	6048	msedge.exe	138
PID 6048 wrote to memory of 3888	6048	msedge.exe	139
PID 6048 wrote to memory of 3888	6048	msedge.exe	139
PID 6048 wrote to memory of 5412	6048	msedge.exe	140
PID 6048 wrote to memory of 5412	6048	msedge.exe	140
PID 6048 wrote to memory of 8	6048	msedge.exe	141
PID 6048 wrote to memory of 8	6048	msedge.exe	141
PID 6048 wrote to memory of 2696	6048	msedge.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2784
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:2664
- - C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\185705182.exe
    C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\185705182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\explorer.exe
      \??\C:\Windows\SysWOW64\explorer.exe
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80a4cc728,0x7ff80a4cc734,0x7ff80a4cc740
    3⤵
    PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,15763162594000451940,9099188504120398114,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,481530326235598911,10329741984694664133,262144 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,2704522388755166733,2210808268191370850,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,8360173053586492605,6377194306352305225,2097152 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,12490704719879324695,6809842555285647202,2097152 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,6351688263176309008,307787847853114930,2097152 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4172 /prefetch:2
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4520,i,3871202896253920161,13659879903352343431,2097152 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,9217135177839843726,13025897105096327797,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,9757502122081774135,4753909828671142683,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,13617914581892752352,17182932012835412532,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:1412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,13230547449337109805,13156607336859972758,524288 --field-trial-handle=2024,i,9313192047955631792,4175737575609775891,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff80533c188,0x7ff80533c194,0x7ff80533c1a0
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,2468949367546351398,16888873738929618402,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8484168063162515485,1698975623991295080,262144 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,15002360697561178833,14738158485307467043,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,1456948138090074221,3577208568892260182,2097152 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,3752692581176113280,10750949079603119658,2097152 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,16059321874824577069,16029523271794784334,2097152 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,15244238880793053700,4193423669995516454,2097152 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:2
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12428118648333054975,1401886949763721212,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3759027095540987331,13128768974703548883,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10180769214001150183,16021377843369402946,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,4657826242375178764,13363317373641935057,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14771546305454166242,5713018410687717639,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14771546305454166242,5713018410687717639,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,12200637584805091271,3619680216829438766,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11842379834268585439,18157993094843036081,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,18426952145882997935,3433341868955527217,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,6173729576039097973,12551514256269083401,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,608808556517257079,10616889060641834976,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,15175461749144767444,12058518133306059814,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,5140469155309408486,12666205788899917663,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,4163945006927508096,18205675296475199502,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,17972272631392702889,7747791333803838700,524288 --field-trial-handle=2580,i,3849024492134599094,14954404094781089259,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:5168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  PID:1140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2360 -prefsLen 27100 -prefMapHandle 2364 -prefMapSize 270315 -ipcHandle 2428 -initialChannelId {eaeb6c83-bf1e-4fa3-86f2-ecb37cb24b4c} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3560 -prefsLen 27241 -prefMapHandle 3564 -prefMapSize 270315 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3576 -initialChannelId {ac370e51-9037-4112-93e1-60a7733f185d} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3784 -prefsLen 27241 -prefMapHandle 3788 -prefMapSize 270315 -ipcHandle 3824 -initialChannelId {8d8f0d37-d1d8-4221-84cf-5ed6386e2b44} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 34740 -prefMapHandle 3020 -prefMapSize 270315 -jsInitHandle 2912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2908 -initialChannelId {37d4c077-5d4c-40ce-967e-e5da51d43be2} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:6008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 34977 -prefMapHandle 5080 -prefMapSize 270315 -ipcHandle 5088 -initialChannelId {47c89910-3a6a-47c9-8cbf-c67162a70917} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32864 -prefMapHandle 5144 -prefMapSize 270315 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {6ce69f79-0fc3-4d78-9af2-170c25cebad1} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32864 -prefMapHandle 5168 -prefMapSize 270315 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {89f53eec-5752-47b4-8108-81ceb8cd3a91} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32916 -prefMapHandle 5668 -prefMapSize 270315 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {6fbbd5ce-ab3b-47c1-bfb5-89976c0f1557} -parentPid 3900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3900" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e4a397a0ba143e6208e2041e226a69b7c838d3a70cbf6b331e809071b874d5e0
MD5 995baa1d8d55659a8bc714cd23ddc0b9
SHA1 15a2456bc59f85bb999ae9cdb26dd5022b95bea1
SHA512 03f15ab5b7a014d68bf8e4e2171b14eec4452d37eab4b7d676ef999cf7524fd28bb0799c0b521484fc411c180d2a91bfd2f5358c1e262e65ca1b874b71c5dff6
TLSH
T19DE02BA7D821ED371DFD0B1C91284687F79113072781454B7A3C810CCFB5A7A059BC9C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 703ade3b39132887d18af8e9969f3139e99799fb20e8c35cce1a3324a9ec7658
MD5 89917ee30a3be3a8262768f74aad724b
SHA1 88ac458b8fd354736b0576389c78482e37ce6127
SHA512 1b5bac08c39c4b5fdfe1b20bb78d1540316656a5ce71a28e7610a85cefc1b9e0d301012e5446a346408b6c31669d10238c020f3b0c760b810fbbe081a9f77bf3
SSDEEP 192:WRdd+7Bu2tj8qcZApuAmtaV9bPv7SVpAPRp2q9fHsb+WNnd60Dz29esYadVyIsnH:WRddg4BuhMUX5xwo0H2Oar8
TLSH
T10242C66EBA11A63B5CDBD229FE217753D7F9202120942E84EAFCCE2C15D75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 12c953d824d37f2911dece87103645968222d9440f29f0d4f503a292fc62cc14
MD5 8d40a55c044a409a3488213d4c91c2a9
SHA1 cf6f49fbb3de63cba584e9bd584a420697544d48
SHA512 0f7d83d8ad6d49266f4904431223e6c856416b39fdc32115a3205c68931e62ac858d782bb72c771b682f49270200b3d3a976793f052b5bc6798b7c7c5568d410
SSDEEP 384:Zfjd07KxkXqKf/pUZNCgVLH2Hfgsl/X7pLuLcSjrGXODd8+ErU3HYHGt64PH:Zrd07KxkXqKf/pUZNCgVLH2HfgspX7ps
TLSH
T1D372F8676C4C9E3B4FD4C98CD8267B4FADB5014B25D9C86883FA982503D5BDF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 01545bad04e4e534913ecbeb3692dbbd688592126914c1b9e7918e2d93855d1e
MD5 9a3408db452d08ea66533d95aa1eab40
SHA1 f077322f3cd324891764eb7e9d46f56e859aa633
SHA512 940c793731ef5cf228df5a677dc3ac9dd9425b76a03bfeb0f65c86e5c0f3a2ae11fd43d1a5275ef8b75152e027a31aa1bc30950995da949a0b4d8d20a37b6f2d
TLSH
T1C8B0128080116201C00202F425461488B11C9F219F0F2B0643F06D228C255518015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597277.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597277.TMP
Size 96B
SHA256 8146f377b95a493df71bc335be257bc7664218aeb7d8dd7c5969328439d217ae
MD5 1cc1a0fbf7091ea41c4ecc56bb3a3b15
SHA1 e762d404eda2e4b24e20a2b8510cca8dae0376c3
SHA512 a27994d061b62f65677ec39d583b84272f7428496f0614f7040ccd9385402edfe9460eaa6c55725a688c92f1bc3c0be822906440e1ef81516c9867e80a0a19e0
TLSH
T152B00296C102A612C05247B039D695E973A8DF2DC643231E92F01EAAEC256B4457E564
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 8ffc5678e085cf02aaac48f1bfaf6f6b86f97f0f5aa711d8538b5a0aaeee1ade
MD5 14b2c81e73a00aeb9ba8d6eef9e39117
SHA1 84c7db13e54f78efc76214297894ac5008f3e6ae
SHA512 85947f83bc0d3938ef26842a953ca697edbd13b23f6a39f21930f3ed146d073864ec94ea81083437fde083febbe45434578a2bfc0cda940a58cb0f4fafe49e08
SSDEEP 6144:9870WGRrmL9trACIknkhgy3LfqBZqenbyyVEd1cB1k:9873GY9trACn4goLCVDuenk
TLSH
T16A3423B1E569BF37B62D4927A60F532F28E94623A1D3B318419C3B14D4C73A4EF16E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2825801836466c51bb99a0efa117237c41451b5e8f08414d9fe0fc5ef4737e05
MD5 c5fa8fc0ed2713377b7bb208e0fdfed1
SHA1 08e80315b6495a9ba9251a9b3942cdfe4f095553
SHA512 388f7fefac9be7835ab2b1c735ddf27c1403c38417c2d1a7df8152b30a6273fd69a2c3c5bcbf15825a4756a792b0cfbe074745db4be8983f894977c8c7e04be5
SSDEEP 1536:MS0SwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/QW:Rw3LffUnBKU/F8enCW3iyVEXGey0cB1W
TLSH
T1EEB31231E5E6FF7B6269562A790F93191CE149FB44E1B788443C2F19E0CA388EF99C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 5fc3508c6f6405db703df9430d9bd2582fd6717d070a742e7b6a67ed15633065
MD5 0848886b8dcaf60a98659db2612fb3d5
SHA1 e3654ec8b54cdcd5a438ddfe8fa367edec825ede
SHA512 35e8292aba90ea2444eae58598a3a1ebe05011cb607de0e52e52c35c5b9032d4fe013e08079c14e62f82e9ca39f9c757f1167e85b473ea2f4f4618d086402ac6
SSDEEP 6144:0870WGRrmL9trACIknkhgy3LfqBZqenbyyVEd1cB1k:0873GY9trACn4goLCVDuenk
TLSH
T16F3423B1E569BF37B62D4927A20F532F28E94623A1D3B318419C3B14D4C73A4EF16E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5ff05a621df8df05426fbba3639de62cbb6d573187a90f20bc797fdbe4b71bf
MD5 c23168c2b4dd096d77fb57bb53393a90
SHA1 0038662e136abcde2c29c9d3d3c3bf2dbb11d164
SHA512 7ee97c45aa94467885b8aa2145e0879de4ec2397c36198ceede5ec06664080ad500e1a9d62566de09c10902658158cd7d9f529ec85a76fea0c32eb7ae7182b5f
TLSH
T1E0D09B2036CD5443C59133B398455F45165D59681556D242A434514CDAA6044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 4e3bf163aa7cd4f4994e4515161be528cbe4e5789c6595c764eb310293f4cf81
MD5 5c563768d6e582314a36f4f5b67a7d90
SHA1 e70703665df5ea9b061b4995ee84edac922a8bde
SHA512 7454e7da4ad1bc28abefe8401897300d810f69b1be78dfd0d346d816b73adc172ac3d196730c34d8268ec60faddc135fe84c9f96ac574eab63e9962d462644a0
SSDEEP 96:0zmxKkzMSO8phQgRRjo9r0ZDcRxDyY0ozC0ZC:dKaMSO8phJjo9AZDc3XjBZC
TLSH
T125C1C7C564BB24DCEFD0CD3042928844337FC97599AE3B1349AA9B343517BD9A0D22B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a54e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a54e8.TMP
Size 3KB
SHA256 9602fc0909797c5b29d2c67b2b118552117577bd93853fb3ed30dad69b15122a
MD5 dbc4f7ffc3c9d06c065bbc64ccbef4d5
SHA1 ae2bb3b5d7749cec2bcff76a9fd9668f694f2308
SHA512 d1325b087bc42b99af323e4a888fa965b971e216fed3730361af5cfa6ec027e74baf798abc4a8dcefa0d201b4e7e967ae90850ae75b38e34053c151b181b8ab0
TLSH
T1B3717086041F04E8E3D1D23050D24291377BC2BA9EA72E695DF61F347A0776AF1473B6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 882efcc23d916b3f50b6dc517caeb5635506e8e1e75011e35c781675a8093b84
MD5 bd3f38df30dad7020c21c960fc6d3a53
SHA1 c0f1e5ac151f1583dd1ac16ed2f16a65b366c711
SHA512 a90fdf71053726d5929935bd3cd91d216437bb27091fc7020d9e5c1ba79d1cc0ab1a28fc0debb2bb25be7b5c806fc2609f2231f1b1bbe97782415b1f56798bf0
SSDEEP 192:sxZxRZyM/jK1Ml8MEh/fasNBf+nOVfsg5bqGdpmWHW6+WNBJG/Y4QaiqIg4J:sxZxfch/fasPfK2UG9Hb+/zc
TLSH
T1BE6209056A349A7BCCDBD219FA15BB53D6F414A3D1904D88A9FCDA0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 398a48e86da506c0544b842364258c87105aae997ccb0ee663e7a0d8ee63283d
MD5 f7027397decc6c23d643beea9ada699a
SHA1 52e9bb7ee4613cb5e429eb58faf709d49eadc9eb
SHA512 ed82d8cc74140065d168f0d2b716fbdbe6c7d3582c9a573c0f296328ecab0a3aac1ed28de3003b3e604b557f6e4409c02e1c8be4e5ed509ad1b82394e116e566
SSDEEP 768:2HEPOAi7pLuLzWKWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVfHfqLlBHu1Zroo:2HEPOA6EzWKWvWeI5u1jamHfqLXO1Sob
TLSH
T165F20B3B6C0CCB7E4F844E9CEC2AAF9A6EE8018B56D8895447F9844C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 3KB
SHA256 403d3458a842e1bd89bb3f3a701b80aea57d19df6abcaea5009fba164f9989fd
MD5 9b58a79a553c2c373c571705ed725dfe
SHA1 ea18f626a5f45bc4295a0811c42fc9ea7b9e20cc
SHA512 3c5af7127e3870e6319de0bc6adff30b38e668b950e970b90b4fcb6cd2ef299e223a7dd401f1a5606b9ea84b09cd33308c4d255cb991e5e9d4319c9602a0ebbb
TLSH
T16E51C74FCE4A1D5EC9EC06B329FA0191337918EE4750CA873A9CA13178D73791D0D169
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 912B
SHA256 dfb552a3b4077850363df8d030e4cec76845edf7225d7c930c55b5054d3d53f2
MD5 89a9e6642be28fd167b27276ad59e354
SHA1 b4a9f527f72ae43af2cfdd04bee3042250dfa58b
SHA512 ea4b0a8eff6a992b6352838d5a7230e2dc5feb55aa522d7d7aba890f62d642e086c2711d79629328cd944dadbc1c1fce24f529437fdfbb35d346bdb7d9fc8725
TLSH
T15F11234A8EA6892FE85545B310B920F47370CFDC5712E273443C272B2C2730E69871C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d9dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe59d9dc.TMP
Size 912B
SHA256 46990cd7f1d79c7cd4ba5065cfa2836fdd8be8262831edabac97b63822abfe6b
MD5 cc3f030b58f60c566b057d675be9adee
SHA1 4ae74c18caee30079a7cc400d088a2cbc9376f99
SHA512 81f27c123161ffe56b9f263f28c3b84f41a6796044665b85b6eabae66813e8cb41f72b3b11d3b3a5a0cfbb7aba367582d44b2de614d3b512e5194a9fa0858543
TLSH
T1891162468BA25C1FE85441B7009A60F87330CD002362F7A3903E253E2C3638D59470C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e5918d14-f4e9-439c-b504-57f43742688c\index-dir\the-real-index
Size 72B
SHA256 83065fa1fe8c33849f5da827ef60cb6356185b516118b582e96eb8be11c0dc6b
MD5 012e6dd2ded23a871716655c57f44c18
SHA1 5ae8006eeb9d0cd4c26a43ba07e67a865c52483c
SHA512 b9adf093116f89bf9756e00ed12613764e07605535584507d30b72bb41fdfe9c6e42886fd2a3d11d9f09430870db87cffefedb3626a33d0be9e253ca1ac5a2dd
TLSH
T1B3A002170681400DC002A2B1259A42722323EA331311138752A1414CDC905564FE504D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e5918d14-f4e9-439c-b504-57f43742688c\index-dir\the-real-index
Size 72B
SHA256 e7faa1204f2dc9d1df695092b0224fb71a3553389d850b0f02bed60c8e07d18f
MD5 42e91488de902ffc288ca3c341966395
SHA1 dc5f3275978f7682435e4848cc75e34fc7b94b34
SHA512 bcc427219644fcd87691957a8d2377b2bc0b68b2f1fba788973247897d72f60cd67115cffb943b2034ebf4d722b0a8da52406ba339be7e57951fccf24b99c38a
TLSH
T1B5A002100B861086EA1615B1155687421700CA2015909317A1910144CC534C08E4100C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3548642ac598cb6a840cf5fa7b4b5409f868f3e00e17a0f2f3ffa87324da82b7
MD5 879d90b96da5ac69e9bb9a1476628166
SHA1 a2de2945750828b2b63b84688f05bde24dce0d14
SHA512 beed576246f6b32149516091a6bf51f35470ba18aad000ff042d4aba452078031eeecfdeb0aecafb7a02ce27a40909cf31eaad931dc91b79a3b01f9a84f4a550
TLSH
T190E068B63CB71C10FCABC3C6A4B054A40416B9A88600AD8F141AA2CB30E2364344EC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b4fc610d43e900865740b0d43f10b758ce7678a65e5629df0d0345e51e922597
MD5 aa6967a4dde88e6c0046ca66a5fa0b0f
SHA1 609d2858ec5f73817440e7d18712ced82c377bd2
SHA512 739ca946b42b5cda49030a7ea194abe8035fe4100f2ae9af42bc00903d7f6011272c1dff4485be67276584b9913a7fa5479787ae79b5bbb5bf021f9e5a099939
TLSH
T16FA002159EAD9059E0000270A0A585CC72619DEC1609A61384BC08789C9016441F204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2f4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2f4f.TMP
Size 48B
SHA256 f9e7e3d53d72f54a0067d97c133a465e29e1a29a1dd4e040bb230caa99f6b3a4
MD5 c0ed7d3f0f47fe4995f4037ed11612cd
SHA1 687bbf527958734993d62a8fd9525793f4290681
SHA512 b5c4353a3e43ad395317943d3008f71d25fb924397354ca376fb2446cd262f020d173c6d0a391741142025651a37aa9f403d9208fdf97c6bddff5656fe584148
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 083e73c83a68db55f772e8763c2c27b0eb55359657239a329853513044666550
MD5 f71722af7faad83d396053389b6b3c6b
SHA1 a386e96964276b28b90f025a9f98d05622fdb98f
SHA512 e29996c794dfb4032a4fa1422b5659a8dd6d2495e6806435bd783d2976f81ee303ce6507822baf9f146d99d9e313fc69080237f9134b700887c3e2f1c0550019
SSDEEP 24:KdMfDYZaWduOK4mi+5IjEKKi5haaK1E0aSmoMJ8kjyXYAfnUFaqdSSu4Ce+1IjI/:KoNIdKuYAPyFhIdKigwSnIJK0A0DyB
TLSH
T1E891710331BB06413CBE3848A7918A276B4130B63055ED6F3BAD95A10F67E121EFCACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 744452decc4b79e9c7d25d90a91dd5d86faa94a00a197c855996189aa2b7d9cc
MD5 eb86057fc8c3116ec7a793c06ca56d73
SHA1 adbe134f1709bb90f89ca1a4779490ccaf25b86f
SHA512 bbe35a0bf9062728175d45dbf5b681d406e1c6ef7028c132c59c922045d51a4383553efd792d94ffe9d8cfa372e84da09eaf46b9f322c6bc98bbcbace1a5b7e7
SSDEEP 192:mON26rvoQmiUyRKDDrKhD4XqMB/1jejzoofOM/SEx83U6:mON26cR+6Xq6sumjaU6
TLSH
T10002E83568786C7B9EF76E49B4863B135FA4202B9A952F84EAE81A1C00D765C130AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c297c544119a2a0758eb11809247cc3e2da22eb2bcc9bde9081a4815abb4fef3
MD5 e726236b752c2c878239442dcdabee54
SHA1 369b4319e395502ed21ff9557d466eb427f151ad
SHA512 358f0f7b26c964ffd90d5169eaeb515eeae8f6505a65614622517e567d98a8f31eac9a16639c4626c3868fe36c506335d5d2aff25a9f9b0fb4d31165743f7eb7
SSDEEP 384:n7ZcIhsNIkWTIa0jRVXq6sumPXEYouc2+HBbsyoG:jhQTsEG9gl5
TLSH
T195828D72A878ED771CF7E105F64B26435EB810679AC42F80EAE8AB1D04D6299170FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6281d0e6fbfc4ecef87ed7cf73694662a68df22a59e38a8e7ce3e3ffc134ddea
MD5 415b336abc7e41cd43788df72d37194d
SHA1 b56998cc6dc067512a3138dbd1d77be6b6319c5a
SHA512 28748a401c5f1c48157a01790b6ef45ea868e3d831f6cc730a8dda1de68ccd4347a1e6c9e81da82ebe9af9f10145af6122b15296d039170194e3386a079bec21
SSDEEP 192:QONR6rvDQmiUyLDDjhD4XqMB/1jejzoofOM/PX4egPwokICFqAO2U6:QONR6Zoj6Xq6sumPXEYoCc2U6
TLSH
T1D712F831A478EC2B5DE7B545B58B36839EA42137DD856F84EAEC1A2C00D779C270EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bb81d8552552ecc593e00bff5ef441aeeda0cdcfa3fef424d388916ef577153b
MD5 b690debfeb48426d4b01871c98b5477f
SHA1 81384aaa0250ed9e8acc1d25bdaad46a8bf970de
SHA512 0e1eca3c07b53939c145b3246050bbb138c77abe80499d7e866eaa88dd3da85e07a1f268d69b05bc1046ee6721e8b4efeb55d67b86fb747ea7dce202e71311e9
SSDEEP 384:nBZcIhsNIkDTIa0jRVXq6sumPXEYouc2+HBbsyoG:JhJTsEG9gl5
TLSH
T1F6828D72A878EC771CF7E106F54B26435FB810679AC46F80EAE8AB1C04D62D9170EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d47ffe-17ca-4e15-b525-0b756fc2b1eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44d47ffe-17ca-4e15-b525-0b756fc2b1eb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff14c60ecb3c543f99064cfa4ecb84b2a5c9942e908139087ef2bc3cd8c4a6c0
MD5 d105331199997c9b8e117ee914082918
SHA1 7f0f1bee5864a0aab2491744919806c7e31236a1
SHA512 61552d73394022889a84c2c4c82c5b4173f0e2497e100b24adca14bf695c27f4bcaa36305a07bb69ad160e24934c1c0c299d908b1de1f07afaa815aed07a072a
TLSH
T19541E598A6FA114CB3B76F5AABF6A86D447EB8732F06D45E00110E4E0727A41C861733
MD5 SHA1 SHA512 TLSH

Submit Download

185705182.exe

Path C:\Users\Admin\AppData\Local\Programs\AppRuntime\WRiN\185705182.exe
Size 2.4MB
SHA256 81de4d530901a1df65b325368728f4eea2c39e7e53a2df97aec3744771d86a1e
MD5 91f4d29bbd95d3f69bde9a5a92c85143
SHA1 ceabbf3ec577b2a3aa5917b9566da8f6e6a2b1d1
SHA512 2d7ab735474b46aaf56e435096637e3e6135effca731a5c296d13ceebc7e7961e5abf4318db270dc9b90dfcc06b8c8fb5056a08151f1ce6097caae29a3a7a73a
SSDEEP 49152:eQq0Qwk/KJ4W+ujH5oydgBcnWOAWinDZPZLgxiyVWu22:90w2W+PtpDVW3VVj
TLSH
T140B5F152B6C24470F59201B1426AE73BAF39B2816734CAC7C3D0D864AD526E2EE3F75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\data\saves\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

f049742a-c292-44be-8fe9-267f834e69b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\f049742a-c292-44be-8fe9-267f834e69b8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6048_463488826\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2ef8181a07f99f6d7d457aa23b926d334d81a92f46d7957b22f0d13a9b12b023
MD5 cacf133bdf96842542531076e0381cb3
SHA1 0f1c73ee6cc8a51072ea96bc127df449b0012c1d
SHA512 8c8c714560f2ca1066a6bdfd0e6e44d580bcf45c020e12480424cf5d61e4abecbcb59e5684bd043b206ee211591a1363306fd75568dd8cbd49f3880e3ec7026d
SSDEEP 192:nAAtt1/66Joz1zgCl6mc0d1Ov5zboA72ByjbQu:R/66Joz1zgC1j8boA2ByjB
TLSH
T172E10FA8E638863BC008127BDDA61B810F35388AD84E7F1535DC741D2D572DE3A8E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 671a924cae10cd99d964c99a8a55b6b4483bd6c635208fcd03c244077bd5448c
MD5 3027d8de222577d7546240e3ed50395e
SHA1 37ea38f111dc34ee74b92057060e7287e94259b4
SHA512 02e9f5651cee7dc5f6fed868eb803417fef06352ae86ca702fb96e29982a1174dea3d54bc438cd46d7f6fd84cd439fedf93a2a291e23f5acb4eca7e79865b7d3
SSDEEP 192:gOv5zboBW2ByjbMaKAtt1d66Joz1zgCl6mBM2z:LboBW2Byj5d66Joz1zgC1OG
TLSH
T124D11DA4EA38463FC448523BCDA21B410F35395AD88E7F1535DC251D2D5B29E3A8E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b192bcd1f79d98e7ed04e4efd53f86b6b66d2eed15395a069f9cd966390d29b1
MD5 2766016f43e194cbedd6cdb01b5904b1
SHA1 0ab5303a8687fd1d2fccdbef669ee891d55dc393
SHA512 bc11ddec2e74618f292b26427198403d4cde3bc467135787a63a034dac95b5c7ed522ce0d0c17dea12dc33ff669666e37784ffae16949e759ef32ff9915d885c
SSDEEP 192:SKAtt1d66Joz1zgCl6mBM21Ov5zboAgs2ByjbMN:Qd66Joz1zgC1OBboZs2ByjK
TLSH
T192E1ECA4E638863FC408127BDDA21B410F39399AD84E7F15359C741D2D5B29E3A8E2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b4967d9580840f18e8744a0176c790440722689eebcbad50f8b90c6a73394c02
MD5 a24b3b3ab3b494e93f6fcc3b9c2da8c0
SHA1 cfff7d8b9cf2b4fe2d4d4ec8510a23eb7d1a473a
SHA512 59288b9a95ac2cc49f31d0bbfa24785c9ba7669e863c9719ebe1243cd090e92dda3b183c32617dea60b7411144e3500db2264ccae941b35546da9a4a89259569
TLSH
T1EA11575C39B98EAA98C7E2A9F85102CF53154A8719871C474D12FF8CCE81BD9326E829
MD5 SHA1 SHA512 TLSH

Submit Download

1b57e013-a86b-4640-a3e7-d7de96fb4fd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\1b57e013-a86b-4640-a3e7-d7de96fb4fd5
Size 15KB
SHA256 7e27d1f0f7155bb7e6a6be0f5f91d8bd549a547add36ca5681c623059488a6c1
MD5 67df4df448a288b8b03247377f9af9f1
SHA1 6c7a6f11c9a3b662030358bffe774ae1b1d6d773
SHA512 13736a29f711ead9812a5836a050a809a06e5a2c9fa2dbdef3fc671afa47979e0cd553d7e1c96d66ec95ff11ebe4cbd95b9c9330cff1d3af85e4e0bb7d23c790
SSDEEP 192:lywzu9Gywat9JkIAoX1rgA8G8nzdCwNXP/Br1YLaBPNF1SfGnKz+Tftf7Yfes:++NvnzdCw5/ciPr1SunKCTfx7YfT
TLSH
T17F72C956686045BA8251E36DD4F87FC3E6F528CF4C018FCADBE47E0859DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f156b81-eea6-42e8-a679-f9479a220114

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\2f156b81-eea6-42e8-a679-f9479a220114
Size 235B
SHA256 f06e64a6c1b343a19505abb9624c7774d7ad2acc3ff1dba70a91a6fad945f3c4
MD5 65566a14fdb6abd02cc95a00ce37ccdc
SHA1 ac0b555cab806833af93b31b0607d7aa8f9046a0
SHA512 08f89c02013fde97f32fa38071f8ffe359b17c885a77e0a591324cac3276bb2ef19e41863f153f34a35c1debf701c3f99ceb9d3b955a38994b9c9d57103f7f04
TLSH
T16ED0978034886B5E080C0F06F0A028C631484C37247DA820E95145B89AB8DC49355C47
MD5 SHA1 SHA512 TLSH

Submit Download

403429bf-3f75-45b3-8535-c6ad60501e25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\403429bf-3f75-45b3-8535-c6ad60501e25
Size 886B
SHA256 a4368bdff7d40ce9a52c7eaedbe306c0c9487ab7cc82473d3c3daca0bd996d02
MD5 01a9055acaee6a714720926f8d34a44d
SHA1 f16a8b5a2345876d78f1f80772962eae1755ce44
SHA512 bad9f6aecea8b25b68f2d28e303e693a1e514fdee696ddafe6ca3f777a201ab1d3a0406d411bc1c0e8febd21ec572278a3405113bc72acdef9f70fb6e0ceb93b
TLSH
T1D8110481863476B28CACD24B95E1778347E43513C0C559047EE06B184DBA51E579770B
MD5 SHA1 SHA512 TLSH

Submit Download

78aee84c-5fd1-4d3b-a11d-87b80fb05877

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\78aee84c-5fd1-4d3b-a11d-87b80fb05877
Size 883B
SHA256 dc5b22f511abb929868198070b70a63c958a06bf78eb4e760228ac320a79829f
MD5 2089964c9b057828d5d297c9a383e2aa
SHA1 31095f74581d4cbb70b011774c98f5b279c6448c
SHA512 0e48dacbe0bc2993dd56d16bce0e10a6e3cf71056fd6a46f9ff7585cf64b32ab3de7b2f8082df14bee6de4f09b466cd06a2b56d9ee704fe65fa59e2ab167f4a3
TLSH
T1AF1100C19A30BBA2CC6CD35FC6A1775247F4242380C954143EF5AE094D7E61DA7AA70F
MD5 SHA1 SHA512 TLSH

Submit Download

e998506e-4f55-45c8-b3e4-5b7cba5e9d40

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\e998506e-4f55-45c8-b3e4-5b7cba5e9d40
Size 235B
SHA256 05d8378c7b913c08bb6f1cbef22ad56b315930b65bfe760b894924c0dbd30977
MD5 fce75794e0c73bf77452191eb97da83f
SHA1 59913f285c538d46c1208ef1826212a1d1a2f4f9
SHA512 7698e70bf2e145b9d9aa2e570eb711d190c309b03b4eb7b1964d0b3dde362f763c8713cbf17e83f96aa28d8c4b9c98caa3c17fc30fc9dcc94ec33fdc01b642a5
TLSH
T122D097C168A867AC08140F1BF0E02AC6785C8C3710709C60E9A185348DFEDC862D1907
MD5 SHA1 SHA512 TLSH

Submit Download

fc9be2e6-70f7-41e6-bf83-cf5f968b9a1c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\fc9be2e6-70f7-41e6-bf83-cf5f968b9a1c
Size 2KB
SHA256 b2ed74463a8a0214e8dc6ee6e6d89dceb84b033a6f46ea91074d240190b94b06
MD5 e6d37ada939552eb8cb7075799ca74e6
SHA1 ad329e49091b016ad3e644833fbd47d2add7d52d
SHA512 0c5be12022443179edbc2f20c2616f5098d37db108e5238f15dad68a635aa80babf2c4d8325859b6f255465fcc562061c98048649262254c1f9d3c4fde4f13f3
TLSH
T13A41545C75785D7A8CDBF18DD5C1238E57A04A1350C52C472E62EF0CCCAA269336B53B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 a817025f86ebd8674252fab564123819c6d1daa43a308706282e1d6fee4c8461
MD5 183940e147c690e19205b49352a93568
SHA1 ad1bb4033fc90694e385e1aee9fc04ce65a34fc4
SHA512 f90e9e57fb13cda8049f3eef39c4063758bcdb57552e7f9ea921651d95431a5568e2599c60ad54d87a31d7a740f69b952e446c396a6b997686f7931156f8935d
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSP7SSlNdv9j/ngH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5Yi7SSy5ZKSYBw88q
TLSH
T148E121789018CB7F75B6776CAC6888316AB2013BB7BF68D650B554C8051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF70A5E83CE5ADF9B3.tmp

Path C:\Windows\Temp\~DF70A5E83CE5ADF9B3.tmp
Size 607KB
SHA256 07566e4f804e924fb9a8b564c65e9fec6985b935e9e7fd46f8d2f1a6f910143f
MD5 c3a5c336664eb05f98261c0827a38b25
SHA1 735e8c5007bf1d9c911db6e20b21135f0b9faf91
SHA512 1e58477047f5c7c5af47c89ecceb01686ef4b74c3d52c05a8062679de2125851f0162909cd48bd8a762c7f1ef9487b63293c355c5192ffdf931c4464fd1a3a48
SSDEEP 12288:tIvC3on6ar1Ev57imrsbfsOEyVBE4+uULDeAKbsImfoQfsfEUoek5:tI+onXr2v5prusXyV2PZLssTfFuro55
TLSH
T180D4AE58EAC342F2EC839971746FF33F5F718E16C835C6DBDBE809660A23254950B992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3604-1400-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/3604-1393-0x0000000002A80000-0x0000000002A81000-memory.dmp

Download

memory/3604-1375-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download

memory/3604-1374-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download

memory/3604-1373-0x00000000029E0000-0x00000000029E1000-memory.dmp

Download

memory/3604-1372-0x00000000029E0000-0x00000000029E1000-memory.dmp

Download

memory/3604-1371-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/3604-1370-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/3604-1369-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/3604-1368-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/3604-1367-0x00000000029A0000-0x00000000029A1000-memory.dmp

Download

memory/3604-1366-0x00000000029A0000-0x00000000029A1000-memory.dmp

Download

memory/3604-1365-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/3604-1364-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/3604-1359-0x000000007F050000-0x000000007F055000-memory.dmp

Download

memory/3604-1377-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/3604-1378-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/3604-1379-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/3604-1380-0x0000000002A20000-0x0000000002A21000-memory.dmp

Download

memory/3604-1381-0x0000000002A20000-0x0000000002A21000-memory.dmp

Download

memory/3604-1382-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/3604-1383-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/3604-1384-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/3604-1385-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/3604-1386-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3604-1387-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3604-1388-0x0000000002A60000-0x0000000002A61000-memory.dmp

Download

memory/3604-1389-0x0000000002A60000-0x0000000002A61000-memory.dmp

Download

memory/3604-1390-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download

memory/3604-1391-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download

memory/3604-1392-0x0000000002A80000-0x0000000002A81000-memory.dmp

Download

memory/3604-1376-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/3604-1394-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/3604-1395-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/3604-1396-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3604-1397-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3604-1398-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/3604-1399-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/3604-1401-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/3604-1402-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/3604-1403-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/3604-1404-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/3604-1405-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/3604-1406-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/3604-1407-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/3604-1408-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/3604-1409-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/3604-1410-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/3604-1411-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/3604-1413-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download

memory/3604-1414-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3604-1415-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3604-1416-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download

memory/3604-1417-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download

memory/3604-1418-0x0000000002B50000-0x0000000002B51000-memory.dmp

Download

memory/3604-1412-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download

memory/3604-295-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-276-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-278-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-279-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-281-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-283-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-287-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/3604-273-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download