acrstealer | 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39

Analysis

max time kernel
298s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 10.5MB
Sample260903-pbtsmsgm6v
SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
MD5 7dbe5a7928c4048d67413510bf15f3b2
SHA1 a6737313438f77142c2ac7c878dd40a31341d52f
SHA512 adf50f9432559b245c5029cbed4c91a8b0783078112a9f5985618ac6054b3f95e1c36b17fd4706c9e8eb01736205ca2e95d2c072e88f2fe7ffd5c6b3b1cff141
SSDEEP 98304:zOPwW4aV15KImMX+wP4UzFmt2a+sBZp5Fre0x7ahqR:GwW4ad6MuwPlz8Lp5Fre0xzR
TLSH
T187B65C6F72A8C12AC16EC27EC1A78F50ED33B0B51736C2FF529052655F12AC49E7E660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

sync.canyonmere.cc

Decoy

cdnjs.cloudflare.com

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
01a034f4-51c1-7e0e-a650-137d7032a680

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 57 IoCs

resource	yara_rule
behavioral1/memory/3432-0-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-4-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-5-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-6-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-3-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-2-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-37-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-41-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-40-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-73-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-79-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-78-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-122-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-126-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-351-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-355-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-360-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-361-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-358-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-353-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-352-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-350-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-349-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-409-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-424-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1538-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1540-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1539-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1546-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1545-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1550-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1552-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1555-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1560-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1554-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1553-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1568-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1569-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1567-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1571-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1564-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1577-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1578-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1576-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1573-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1586-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1584-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1585-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1579-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1597-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1593-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1588-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1622-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1642-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-1678-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-2813-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral1/memory/3432-4024-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3432 created 3364	3432	wab.exe	56
PID 3432 created 3364	3432	wab.exe	56
PID 3432 created 3364	3432	wab.exe	56

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3432	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 3432	2804	Setup.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	chrome.exe
4104	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329111591088122"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F5D1D9C1-DAAA-4F9C-A9A0-0AF6578E7AD1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe
3432	wab.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3432	wab.exe
3432	wab.exe
3432	wab.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2804	Setup.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
2780	msedge.exe
2780	msedge.exe
5652	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2804	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 2804 wrote to memory of 3432	2804	Setup.exe	84
PID 3432 wrote to memory of 1068	3432	wab.exe	90
PID 1068 wrote to memory of 396	1068	chrome.exe	91
PID 1068 wrote to memory of 4644	1068	chrome.exe	92
PID 1068 wrote to memory of 3992	1068	chrome.exe	93
PID 1068 wrote to memory of 3992	1068	chrome.exe	93
PID 1068 wrote to memory of 852	1068	chrome.exe	94
PID 1068 wrote to memory of 852	1068	chrome.exe	94
PID 1068 wrote to memory of 5048	1068	chrome.exe	96
PID 1068 wrote to memory of 5048	1068	chrome.exe	96
PID 1068 wrote to memory of 1060	1068	chrome.exe	97
PID 1068 wrote to memory of 1060	1068	chrome.exe	97
PID 1068 wrote to memory of 2304	1068	chrome.exe	98
PID 1068 wrote to memory of 2304	1068	chrome.exe	98
PID 1068 wrote to memory of 696	1068	chrome.exe	100
PID 3432 wrote to memory of 2780	3432	wab.exe	104
PID 2780 wrote to memory of 4696	2780	msedge.exe	105
PID 2780 wrote to memory of 4104	2780	msedge.exe	106
PID 2780 wrote to memory of 2688	2780	msedge.exe	107
PID 2780 wrote to memory of 2688	2780	msedge.exe	107
PID 2780 wrote to memory of 2688	2780	msedge.exe	107
PID 2780 wrote to memory of 1600	2780	msedge.exe	108
PID 2780 wrote to memory of 1600	2780	msedge.exe	108
PID 2780 wrote to memory of 4752	2780	msedge.exe	109
PID 2780 wrote to memory of 1832	2780	msedge.exe	110
PID 2780 wrote to memory of 4752	2780	msedge.exe	109
PID 2780 wrote to memory of 4752	2780	msedge.exe	109
PID 2780 wrote to memory of 1832	2780	msedge.exe	110
PID 2780 wrote to memory of 1832	2780	msedge.exe	110
PID 2780 wrote to memory of 3712	2780	msedge.exe	112
PID 2780 wrote to memory of 636	2780	msedge.exe	113
PID 2780 wrote to memory of 3712	2780	msedge.exe	112
PID 2780 wrote to memory of 3712	2780	msedge.exe	112
PID 2780 wrote to memory of 636	2780	msedge.exe	113
PID 2780 wrote to memory of 636	2780	msedge.exe	113
PID 2780 wrote to memory of 4532	2780	msedge.exe	125
PID 2780 wrote to memory of 4532	2780	msedge.exe	125
PID 2780 wrote to memory of 3328	2780	msedge.exe	117
PID 2780 wrote to memory of 3328	2780	msedge.exe	117
PID 2780 wrote to memory of 1888	2780	msedge.exe	136
PID 2780 wrote to memory of 3520	2780	msedge.exe	119
PID 2780 wrote to memory of 1888	2780	msedge.exe	136
PID 2780 wrote to memory of 3520	2780	msedge.exe	119
PID 2780 wrote to memory of 1656	2780	msedge.exe	123
PID 2780 wrote to memory of 2364	2780	msedge.exe	127
PID 2780 wrote to memory of 2364	2780	msedge.exe	127
PID 2780 wrote to memory of 4532	2780	msedge.exe	125
PID 2780 wrote to memory of 4532	2780	msedge.exe	125
PID 2780 wrote to memory of 2364	2780	msedge.exe	127
PID 2780 wrote to memory of 4564	2780	msedge.exe	126
PID 2780 wrote to memory of 2364	2780	msedge.exe	127
PID 2780 wrote to memory of 4564	2780	msedge.exe	126
PID 2780 wrote to memory of 5684	2780	msedge.exe	128
PID 2780 wrote to memory of 5684	2780	msedge.exe	128
PID 5628 wrote to memory of 5652	5628	firefox.exe	131
PID 5628 wrote to memory of 5652	5628	firefox.exe	131
PID 5652 wrote to memory of 6008	5652	firefox.exe	132
PID 5652 wrote to memory of 6008	5652	firefox.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3364
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83c63c728,0x7ff83c63c734,0x7ff83c63c740
    3⤵
    PID:396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,4123485397975254218,616459455468999109,524288 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,13124811158633213828,13314375666615418861,262144 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,8660567495778856271,17543156125865255476,524288 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,843838248813746842,16971146726172513402,2097152 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,2311173039794192501,1162689965513548268,2097152 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,721667700501964578,11008099913745678872,2097152 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,3636791207948347729,4700761103795389550,524288 --field-trial-handle=2012,i,3249117610383634509,23849079462178541,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff837afc188,0x7ff837afc194,0x7ff837afc1a0
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,3734488242004116104,7987294068085293855,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,10750421445017867181,15317314416748204282,262144 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3340205383840316001,5658175305609545837,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,2382655593310819703,8853345071567244149,2097152 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11374816495335872828,12188603085841442000,2097152 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,9552779693711745469,9839852386988189396,2097152 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,190504554611121320,8984018554272621051,2097152 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:2
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6539340449164939156,17610047554762920322,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,7151578657599162280,9128379576434336569,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,3319084383625199552,2456500228537199672,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8899957219136946617,1498714716565256448,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,13208922124847717240,643932948360424502,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,13208922124847717240,643932948360424502,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,13484052776817524697,7638354534960682161,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,5912084417947849024,4971703026616028476,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,12544978685435961183,12096675055379444105,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9109091535973681942,5108806323293873390,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,4303379346038041520,8301050905065149957,524288 --field-trial-handle=2156,i,6635627222098415340,15364277886988393939,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:5684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2744 -prefsLen 24447 -prefMapHandle 2748 -prefMapSize 268500 -ipcHandle 2812 -initialChannelId {3bc2415e-f6e6-4523-884e-e7d1048266ad} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:6008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2092 -prefsLen 24610 -prefMapHandle 1824 -prefMapSize 268500 -jsInitHandle 1900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3608 -initialChannelId {42d46266-36d5-4411-b909-62bb36298fb7} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 25495 -prefMapHandle 2068 -prefMapSize 268500 -ipcHandle 3696 -initialChannelId {a42741ee-dc5d-4625-b11f-db2025f5d538} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4024 -prefsLen 25606 -prefMapHandle 4028 -prefMapSize 268500 -jsInitHandle 4032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1736 -initialChannelId {b57118b3-64bc-4527-ab46-c0e0897cc698} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:5444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4712 -prefsLen 36251 -prefMapHandle 4716 -prefMapSize 268500 -ipcHandle 4720 -initialChannelId {84ff967f-b40c-4fef-9bce-5af1c0b1efec} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:1888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4740 -prefsLen 34356 -prefMapHandle 4840 -prefMapSize 268500 -jsInitHandle 4844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4876 -initialChannelId {54272f76-5fdd-4101-b593-1f1be6e6defe} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:3472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 34356 -prefMapHandle 4864 -prefMapSize 268500 -jsInitHandle 4868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4884 -initialChannelId {f55de2cb-e628-4e75-9de3-21ef2535b421} -parentPid 5652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9ca09de8f905d3f2b0181c45ac1371a511c9c6c0ce443a367768f4270c2f648d
MD5 fc540d122a20b0081280fd634498832c
SHA1 9e20b341635b1cf9ea9aa1a6126ebeea94d3e4f2
SHA512 44bf8f38f948616632f719c1883f4e43fec19b797fa5974c887f634e00173ebddd2dce036e701b80694efa244ca27c364b1603afc9ab42a728bee4a71edace95
TLSH
T1BAE0E5AADA21A8775DFA076D50541747EB50135B3F40994B363D810ACFB5A36814981C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3e4333600353c1c741ca21361da1f2336b9b9dddc5635100779e7975d0640c22
MD5 138c567f20e6288e183e56b7832a90fe
SHA1 9ace2317ec247b9d1a19c6ccb91fce2998bd5d0c
SHA512 dbae9ba964cece57e3467e894645f9b0602ca22ac2aa7dda64f3bd91c4a31e896ab1024ff609cfb2d48023412650b2e083855c7db027b17b71caaf1e6b86fb37
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:qm7Rkm1tYpBeh2BAoO
TLSH
T1FBC3123B5D65E9375979A71EB48E0B1E1EF24DA6C930DE4288D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8ccad3cdbc720a239edf226fdeece84d18b64d686513e5293c5118975d88abc
MD5 5e3fb24160bc1ada3a22b42c8bd2d1d5
SHA1 c8e5a32d65d61c77e4eb7fe59a5eed312eedbaab
SHA512 3d6e9daeecebe980b4ad987b8efded3155ade57a904ba2fa9aa60e1bead2375a1e05e8e3cf41ffd530b329b617ae5b762e4904be1715d3759b86439e2b85507f
SSDEEP 192:sxZTRZEN/f8sq52GYKVb1wdpmTHW6+WNBcR/YCkGrYZIg4J:sxZTUN/f8sq5b3gIHbe/DIc
TLSH
T10442E7067E24A83B5CC7D25DFA15BB53E6F9503694940E48E6FCCA1C04F6ADE220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9774b55a28a2d1f2d728bb4e0fb6625a2b72b4c9e1fa098c722203fc9363c849
MD5 33dae76cd58d4fd0b228e326855e0080
SHA1 53acd45f6b0237b58027288a09d3a3d604181351
SHA512 4564d98e54ece12fd9f878d1850959fcb8aaeb1c78e17e3be98fef193802d414801afb10f64f2b09eabdceba0c65c1b27ddfb22c8b9f39f5467b28754d96d3ce
SSDEEP 768:tbqbUqH7pLuLze+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVpTaZLlRTKryrow:tbqbUqBEze+WvSCs6u1jaATaZLbWrpw
TLSH
T150E2FB3B380CCA7E4F804E9DDD1A7F9F6EA8028B9698C94447F9945C02C76EE511B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 417b08103d001bb3d09bbdf90167c555a4c6f81dc8140399c26c39222b9fa878
MD5 71af610360f7f90f3daf8a2d916143b2
SHA1 a17e142e19ef8fde24bb3ce055157f85bfe1d694
SHA512 5f055e3423fba9d89c33190313b9339aafce596f1dcd844a6706bd6b5651c830526050fd7492c87ae99244151fbdd1730e0959bc55823e32d37505351a663c0c
SSDEEP 384:njNZcIhsNEMTusKvt8Ea++d51mysa+VYhoX:ZhB3na731zhgaY
TLSH
T1E5827C3169788CB759E6A245F88B371B8EF890BB99CD6F54D5D9CF0C00D6798230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8b54954c5ec7cba30056be72bf3f91c9ddb58e7784b1cb2073acc47bf7ada0a
MD5 ea43cdd3fd73258286f78f9729cab0b3
SHA1 89ee6e7fe508611011f57024752d8a658f5c1a8a
SHA512 7691e94acd9852ce4716b8c33ce951a0868db910a6e0164cd33358d9b7cb6f5f629ec1560e277784d0ec196b37766d1cc9b3937df3b976897c3ef6559e12771c
SSDEEP 192:vONR6Db6QmiUyY4HBa+j1+FdCKHRghxU6:vONR6uyHBa++d5GHU6
TLSH
T16302E83568785CB79EF26E49F48737279FD4103BAA962B94DAD84F0C00C764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b04e83f38a9ecc67648ba7db734c3a3663c813e68644665fd69af5b15e5e2e3
MD5 0c7f1679f46c1a7afc5db607609e1012
SHA1 31d0b5870b4e505970f1c218be08c2b4e8320047
SHA512 9715312070d7127a6c522233f239f890aa12eea16e1179b9cc8a6a03e35b9f8c1412ec80f97cd1e9ce20472d37847aae95f7918497f06b0ba84298850865826d
SSDEEP 192:aONt6Db9QmiUy84sBa+j1+FdCK2dNzoqSlyU6:aONt6jgsBa++d5MmyU6
TLSH
T17E121831687C9C675ED27508F48736679EE4607B9D8A6F54E6D98F0C00C679C330F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82854aab-2934-4278-8ce9-2561b8a57992.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82854aab-2934-4278-8ce9-2561b8a57992.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69451fe7b12dcc1e8e56c2c1ae5c92dc20fa731cae662cafbe26e1d79b333b69
MD5 f2d5dc31d38fa24e528664d3ab65f47f
SHA1 f19166dc8bd266fc6f9e1f30e337290003e07201
SHA512 29a9339eb8ce8048accb8804a938c4c7af67f6e8ca197ea9189cf663ca21f2fe7a450858894815f300676d708df35770c21d0010ce7684bafb173df9349d9851
TLSH
T1B241D658A6F91148B3B76E5AABF7A86D947ABC772F56D45E00110D4F0A22B00C872733
MD5 SHA1 SHA512 TLSH

Submit Download

489bdb2c-9402-4379-a544-2edeeaa90b3e.tmp

Path C:\Users\Admin\AppData\Local\Temp\489bdb2c-9402-4379-a544-2edeeaa90b3e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7b202a18-3301-46a9-97c6-5f36bff3c1d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\7b202a18-3301-46a9-97c6-5f36bff3c1d9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 573KB
SHA256 edc2a572c854afe9093725c2352561cad86cfa538081c21fe95e49cdd2ea989e
MD5 5c92e1527b771317f0d5de7f1dfa3ba5
SHA1 78ed17717cb8b2363bdf04891ce9327da22d9ce7
SHA512 b6040d473dc5a487a6f6599850dad8785d7b621a4b29167047b901ca57b2126302ee07b41570d89b76c9a1745058c4fb73ff7781f21a9d25cf5b84f164889e5c
SSDEEP 12288:BiHVTZ0PuwnimEaldw8Xv7n1I7NvewjaW4ne6om5YescParlCi3tn11XD8R2u:BiH1ZGuoFEal+8f7n1IZGBjpoIPvyrlK
TLSH
T108C402F5F7A07CF3A7BE034A9D85AFAD07664622C74FA08C443B2BC2455372AAF65504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4855ab4-26fa-41b9-9078-cdac70ef9fb9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2780_1149594488\f4855ab4-26fa-41b9-9078-cdac70ef9fb9.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2780_671773924\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 df892d1ad79483b2e7e0a7014a98c1d2717134bdfc941a65dc4393877cdb39a4
MD5 fa53e8279e688414b9f40522b0073e19
SHA1 c08a16311841555f1153c8b8c36aca20fa33c4a5
SHA512 f6c6bea03db4289e12d1e78c66610a7ca62a917ec77b6847b5de53418208a1709db4566bd4a59c6fd3b49516a4d4410f6c6e32c639120351fbb343b6334964d2
SSDEEP 96:xHa4qGqIdGzv36ElW9FnIAlhz1g1w8h9cnP:sTRId+6E1Alhzm1w8hm
TLSH
T1EC912F786144CB6F65B5776CBCB58C715E72027BB7BF288610A98484410CF3846F9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 e979016122b744cd4b793312dcaa2eef4228d23946a454d0b1af0b18fc63d9c7
MD5 537070896d068302d04f0926d660244c
SHA1 9e17bfd03932f55c2f0e7d0675f4ae20dcb20a00
SHA512 c345b18de37e80eb64fea3d0e2109eb61393ef9c9134a562c42d928630ad127af1936650738adb1994dbcdf9a8d5a4cb1cca9fd4f69ba1bb1aefacd2edc0f053
TLSH
T15C3112AA2945CF6FF5B5366CFC154A60C7730636B67F5C8224B880858418F3803F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 f2e68ce14ab47d453be9d6473c776bc6790dbd3869857bd9d79a35d8004c0309
MD5 035de925bf5368146f85d85a5e9f228f
SHA1 5af9996e0d8f2eabf47b1cb72e5f319f8df90627
SHA512 f6481c24c04075de6c2c84abe9150210eebce13d6595f285aa3003997211b8fb1cefb38b98a53853e494fcda102f686f9db0a9df9fc23f3ca9cea30f94770b76
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B08ZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWhyh44CfiaR/skL0H7
TLSH
T10323448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 a6ac48bf5fae609557ade1a3da8673135da876e5c0d4a6971edffcb500b904ab
MD5 c444d3061afd6ab31fba5cc7ef89ed92
SHA1 f02e309467f529474eeb6e9ac8c55877d570e855
SHA512 1ea119b8df7d89f7e16f77593c8870a281c917530288c44c229d3ce5603712debd9e0ed3334f70bad51c50ea30346b9592f19f9d5f36137ac904d714c235eb48
SSDEEP 192:wa16S6CdFAWXsfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAW8HjhcfZ6k0H79H2h4f+Tf
TLSH
T10043848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C441F5AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 128KB
SHA256 9bdfb54bc4ba8fa6ace5c1402895b6ad6f0a86fafd30db1c09a9082406aacc71
MD5 d4f30d040502a3398baf4f4c931b61f2
SHA1 53c190c3d09a4d0c55dbbf0a7cd57cc1e3fd1574
SHA512 22438e540f11d1a17ff22de513775767f7577c9e48d9f231c5c24662242c1d8b556e5771bca399cc71255ec0b40ff915c26900d5c80acc833569c3328468e0ef
SSDEEP 3072:taY3p6x3p8UcHLeHZ/+y+aY3p6x3z+eHPcHy4BH8ey8aY3p6x3P+eHPcH9Q83aYL:taY3p6x3pdcHLeHZWvaY3p6x3z+eHPcB
TLSH
T10AD3D5E93432C953C721D43F666AA2FB542FD2DC0072A2886775574C385F14B6EAFBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-34-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-13-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-1691-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-35-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-7-0x0000018A4B670000-0x0000018A4B671000-memory.dmp

Download

memory/2804-10-0x0000000000F2D000-0x0000000000F2E000-memory.dmp

Download

memory/2804-11-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-12-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-33-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-14-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-15-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-130-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-16-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-17-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-18-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-19-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-20-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-21-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-356-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-760-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-22-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-23-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-24-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-32-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-31-0x0000018A4B670000-0x0000018A4B671000-memory.dmp

Download

memory/2804-25-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-30-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-26-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-428-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-29-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-475-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-28-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/2804-27-0x0000000000F10000-0x0000000001A7B000-memory.dmp

Download

memory/3432-1552-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1569-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-349-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-350-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-352-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-353-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-358-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-361-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-360-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-355-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-351-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-126-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-122-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-78-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-79-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-73-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-40-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-41-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-2-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-3-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-6-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-37-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1538-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1540-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1539-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1546-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1545-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1550-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-409-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-424-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1554-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1553-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1568-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1555-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1567-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1571-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1564-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1577-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1578-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1576-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1573-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1586-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1584-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1585-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1579-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1597-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1593-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1588-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1622-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1642-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1678-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-1560-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-4024-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3432-2813-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5528-2811-0x0000000003780000-0x0000000003D52000-memory.dmp

Download

memory/5528-2806-0x0000000003780000-0x0000000003D52000-memory.dmp

Download

memory/5528-2812-0x0000000003780000-0x0000000003D52000-memory.dmp

Download

memory/5528-2810-0x0000000003780000-0x0000000003D52000-memory.dmp

Download

memory/5528-2805-0x00000000013C0000-0x00000000013C3000-memory.dmp

Download