acrstealer | 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WTSAPI32.dll
Size 1.6MB
Sample260903-qvba3syalg
SHA256 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434
MD5 a14313f547139025473612833687c1a5
SHA1 9c91b00f37e2c91ec52f60a7d3115ea824c6d2c6
SHA512 73b1fd2e942bb283b5d93735f4bfd07ebee6ddf68318a0b7aa5dbe3cad030411467074e461a11becf7abe8112b282cfcfe6a6a3b9b706a35fd5d48684ca9f7d6
SSDEEP 24576:3HMe8e18KimZP1k26rnWodwwz6JreJRa6K1jytX7q3iVF1N+DU7DGb7ohyy:3Hn8eCRxldwwz6JCJwPgqSH1FDeowy
TLSH
T13785DF05A3E80AB5D6B7D334CA675632D7B1785107709ACF02A4DA5E2F33BD06E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

sync.canyonmere.cc

Decoy

cdnjs.cloudflare.com

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
01a034f4-51c1-7e0e-a650-137d7032a680

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 62 IoCs

resource	yara_rule
behavioral6/memory/5252-0-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-5-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-4-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-3-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-7-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-11-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-15-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-47-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-53-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-52-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-94-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-95-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-100-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-327-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-328-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-329-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-330-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-331-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-334-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-336-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-340-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-342-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-348-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-350-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1097-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1480-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1481-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1487-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1486-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1490-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1504-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1514-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1527-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1534-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1537-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1543-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1546-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1550-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1549-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1558-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1556-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1555-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1561-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1566-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1552-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1576-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1574-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1581-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1582-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1585-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1591-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1630-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-1666-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2777-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2785-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2793-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2792-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2794-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2820-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-2821-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3
behavioral6/memory/5252-3137-0x0000000000400000-0x00000000004CB000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 5252 created 1096	5252	wab.exe	82
PID 5252 created 1096	5252	wab.exe	82
PID 5252 created 1096	5252	wab.exe	82

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5252	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3332 set thread context of 5252	3332	rundll32.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	chrome.exe
4352	msedge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329161270718447"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{AB659D40-9D19-4A08-8B64-11453300681C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wab.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe
5252	wab.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5252	wab.exe
5252	wab.exe
5252	wab.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe
Token: SeShutdownPrivilege	3176	chrome.exe
Token: SeCreatePagefilePrivilege	3176	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
3176	chrome.exe
1656	msedge.exe
2532	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 3332 wrote to memory of 5252	3332	rundll32.exe	89
PID 5252 wrote to memory of 3176	5252	wab.exe	90
PID 3176 wrote to memory of 5020	3176	chrome.exe	91
PID 3176 wrote to memory of 5076	3176	chrome.exe	92
PID 3176 wrote to memory of 464	3176	chrome.exe	95
PID 3176 wrote to memory of 464	3176	chrome.exe	95
PID 3176 wrote to memory of 924	3176	chrome.exe	96
PID 3176 wrote to memory of 3352	3176	chrome.exe	97
PID 3176 wrote to memory of 924	3176	chrome.exe	96
PID 3176 wrote to memory of 3352	3176	chrome.exe	97
PID 3176 wrote to memory of 3004	3176	chrome.exe	93
PID 3176 wrote to memory of 3004	3176	chrome.exe	93
PID 3176 wrote to memory of 3472	3176	chrome.exe	98
PID 3176 wrote to memory of 3472	3176	chrome.exe	98
PID 3176 wrote to memory of 5828	3176	chrome.exe	99
PID 3176 wrote to memory of 5828	3176	chrome.exe	99
PID 3176 wrote to memory of 908	3176	chrome.exe	101
PID 3176 wrote to memory of 4000	3176	chrome.exe	103
PID 3176 wrote to memory of 3784	3176	chrome.exe	104
PID 3176 wrote to memory of 4000	3176	chrome.exe	103
PID 3176 wrote to memory of 3784	3176	chrome.exe	104
PID 3176 wrote to memory of 2404	3176	chrome.exe	105
PID 3176 wrote to memory of 5588	3176	chrome.exe	106
PID 3176 wrote to memory of 3788	3176	chrome.exe	108
PID 3176 wrote to memory of 2404	3176	chrome.exe	105
PID 3176 wrote to memory of 5588	3176	chrome.exe	106
PID 3176 wrote to memory of 3788	3176	chrome.exe	108
PID 5252 wrote to memory of 1656	5252	wab.exe	110
PID 1656 wrote to memory of 3368	1656	msedge.exe	111
PID 1656 wrote to memory of 4352	1656	msedge.exe	113
PID 1656 wrote to memory of 5324	1656	msedge.exe	114
PID 1656 wrote to memory of 5324	1656	msedge.exe	114
PID 1656 wrote to memory of 4004	1656	msedge.exe	112
PID 1656 wrote to memory of 4004	1656	msedge.exe	112
PID 1656 wrote to memory of 4004	1656	msedge.exe	112
PID 1656 wrote to memory of 5424	1656	msedge.exe	116
PID 1656 wrote to memory of 1060	1656	msedge.exe	117
PID 1656 wrote to memory of 5424	1656	msedge.exe	116
PID 1656 wrote to memory of 5424	1656	msedge.exe	116
PID 1656 wrote to memory of 1060	1656	msedge.exe	117
PID 1656 wrote to memory of 1060	1656	msedge.exe	117
PID 1656 wrote to memory of 3036	1656	msedge.exe	118
PID 1656 wrote to memory of 3036	1656	msedge.exe	118
PID 1656 wrote to memory of 3036	1656	msedge.exe	118
PID 1656 wrote to memory of 2276	1656	msedge.exe	119
PID 1656 wrote to memory of 2276	1656	msedge.exe	119
PID 1656 wrote to memory of 2276	1656	msedge.exe	119
PID 1656 wrote to memory of 4832	1656	msedge.exe	120
PID 1656 wrote to memory of 4832	1656	msedge.exe	120
PID 1656 wrote to memory of 4292	1656	msedge.exe	121
PID 1656 wrote to memory of 4608	1656	msedge.exe	122
PID 1656 wrote to memory of 4292	1656	msedge.exe	121
PID 1656 wrote to memory of 4608	1656	msedge.exe	122
PID 1656 wrote to memory of 2672	1656	msedge.exe	124
PID 4328 wrote to memory of 2532	4328	firefox.exe	128
PID 4328 wrote to memory of 2532	4328	firefox.exe	128
PID 2532 wrote to memory of 2488	2532	firefox.exe	129
PID 2532 wrote to memory of 2488	2532	firefox.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1096
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WTSAPI32.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb77dbc728,0x7ffb77dbc734,0x7ffb77dbc740
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,16406070418140761581,11188358310108075379,524288 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,9316464656462836691,6160965661666562165,262144 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:3004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,934240140845499656,580714187293422047,524288 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,9215569635622872303,10650407725164910609,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,3956353625100627270,9583151960135925025,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,15518852788418098881,11456419843761526034,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,15172170055387682269,10102674228206472587,524288 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,18096137999440796073,9562280394784440497,524288 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,6129122357642364313,14588702628622772418,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5632,i,13268791506466978495,12398417447821682490,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5784,i,8456905387528795012,14768493719035804814,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,12656543422745296716,6235449961048002780,524288 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5684,i,11797634482910736798,11146908873434477964,2097152 --field-trial-handle=1932,i,7384050742643989559,1824134946520160083,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffb6f07c188,0x7ffb6f07c194,0x7ffb6f07c1a0
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15138014746395025785,4290556242594931634,262144 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10543109951638522297,15377570653069324205,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,9408367094525818675,7984363509549132148,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,13976929815030900207,14068888494794751583,2097152 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11035996582616830991,14814309700594339649,2097152 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,16471412804589392758,16437840103074417205,2097152 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,12246798987276353685,8411970710013032491,2097152 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9132162436802559827,16087940540863746622,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,14137388655060487227,10114185713579585283,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6647083884143405334,14619445814140091932,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,5957754051473752332,10538802702188884048,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,5957754051473752332,10538802702188884048,524288 --field-trial-handle=2612,i,6099008883686534294,17959825798360628805,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:2672
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2780 -prefsLen 24445 -prefMapHandle 2784 -prefMapSize 268548 -ipcHandle 2860 -initialChannelId {33448b76-74fc-42bf-9eaf-0c3ba92a0099} -parentPid 2532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1768 -prefsLen 24657 -prefMapHandle 1904 -prefMapSize 268548 -jsInitHandle 1784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1776 -initialChannelId {f6f9f819-9efb-4241-a54c-b893c803d360} -parentPid 2532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1768 -prefsLen 25541 -prefMapHandle 1500 -prefMapSize 268548 -ipcHandle 3748 -initialChannelId {4a11fb10-964c-476e-959f-f91f706d431b} -parentPid 2532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:2348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 25604 -prefMapHandle 4372 -prefMapSize 268548 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {08c01aa8-6488-4b67-96c4-8bee6de6277d} -parentPid 2532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 36449 -prefMapHandle 4972 -prefMapSize 268548 -ipcHandle 4984 -initialChannelId {ca68ee1a-d678-4610-bc09-73b543e23064} -parentPid 2532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:2052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9f0aa302408ad9d3359efa27312ef6d325a2d2f5c68175e4501d23a02ee80e51
MD5 4d07d0bc62edfe4a7b14f3538f06c830
SHA1 c721d6286e308e3f285e04814a39b11b8fef67d6
SHA512 0379ac82ce6bc406c849e28447da3e9aa15b955348c8f87c747734f75afbd536ef4402435375cfe0f0bced3aea55d789b918ee37d52a9cca847e2816b5053112
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5oAHDdB6eGyvkonxob1v4a:MC0HJm5FHuPgXDUDoiDW8nxobZ
TLSH
T1A0A11AB1A4B94CB75AB7D745F8823A83DEA4A2276991FF80D9DD1F0C01F71D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3c0d2d09885d415a12ad417207628ffdad21e829c69386f749103090902965de
MD5 614c7d6f46c2977ca3b70afce2cfddd3
SHA1 f50e0110fffa37c5bd6c00d606e98a7524afe3a0
SHA512 32d63ad91d649ea840d81467e2cf22ea39d7145a58f34cd6f6df4142af01c94f00ab72a71c00338f12df11ec0871a47fffb624994e54646b7767be76387860b9
SSDEEP 192:sxR2MRSxRW/f1esMdDde5lSXxbCP1oD8pJv/g6+WNPzk/YCSEuOZG4IgVKJ:sxR7Ww/f8sMdc5lvNB/5g/zvQ
TLSH
T14252E806A9289D3B9CC7D25DFA15BF53D2FC5032A5946E48E6FCCA1C04EA7DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ff767217ead364e664c8d9fa119eb5f3c8b29d80092eeac48e54bddd1e913f27
MD5 544c0e94a6d5144b3b95f2e55277f68f
SHA1 48ebeffd318eb17bdc91ecc527e1e482d01cd20e
SHA512 796d7f8da65b1a36d1cec192716dd54644aa84438fffb837626a8f7d9cebcb01b08db47833e3dc827edd99329ccae3da0174616fd1677cefc9931bf223d99c88
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoQqc7roZrL:jC+vA7E7JQWgQ+f4+u1jaTVcI1
TLSH
T166C2FA7B640CCB7F4F800ADDEC197E9B6DA802CB5698CD9047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index
Size 288B
SHA256 45408fc9983cf805d5aa9c64a12fe4e40cd9bba6707039997f46cb56d49e28f3
MD5 3724d1743a6a655a11b7b4b997255ac8
SHA1 75eccd6b089c8f49f4ce5c3964d597028f0efb4a
SHA512 6889b716cc8510bb6897b04c7ee4e0236b3c3708621ef783830d8ac7340e60399b88af8805600404e40ebeed4a123e3a086a05519055a9514f96178bbcacc773
TLSH
T1D2D0A7CE8C729957C629607505B72419333706FD2112AD6600FD183E5596E6DC545606
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599021.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index~RFe599021.TMP
Size 288B
SHA256 b70992e710c7862aee8c30cbbedcc10e892da53be23195f1cccddd8aeeb262d1
MD5 a2e5ad41a7c3b87d4275f9198efeaabd
SHA1 0fe955370b72037ecd98d657b6bb42efe78361eb
SHA512 2fe9a0eb23af4f3bb240969c8d11c3b36ae19ac69dc4d6e54a6b826eb906ba823ab63a41c69ce3ed8ba13f2b57b8cdeedfc5196b888c85404af95347a848d2f9
TLSH
T171D023DB45516966D617197524436516333708342515EE3110FE082F4A717FC9942106
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a70234bc6a0c42efebaa8aacab8518d345423ed0513b9f16b22c15afb3892429
MD5 4aa4041477583a7464e594954fc11369
SHA1 c28b2348e1b5d3975e1445fdc8477b4089e2d2cc
SHA512 e0be447e29751f3739ae632bc64a488c8dbb88258e2bae5b3f9a8751c20014a6c6036dd76961a3b010918e91df675f6c6d11b388ff94cd98266497ab00d67d77
SSDEEP 768:Hrv+4UNbdD3SsFf+tap8+p3bd66j+4BRv86aLIWx/C:Hbsbp3SHE8+p3Z6n4yb/C
TLSH
T18E039E71F8A9ED339CF6C644B24677837FB811A395C00E94E8D96B4D119719E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 68903e28680854d2dd68df6d351d34e0bf2c981529b3e81e73283e507753e1dc
MD5 4dc4552395b79c88315e60c8b9f592ac
SHA1 a71bc5ae84135f8e0dabfb774af0d4ebdd8b490a
SHA512 418f6904701f28f4d0fbda0b76137cf6a6785537d06d5f93c655c86e29cb2fbe000c39eaf503d1c22537c144b55b86f9ee460b1fbde48b3d182a487dce7d8e06
SSDEEP 768:Urv+4UNbdD3DPf+tNp8+p3bd66j+4BRv86aLITx2bwCl1:Ubsbp3sL8+p3Z6n4y80ww
TLSH
T17A03BE72E4A8ED739CF6C644B28677837FB811A399C10ED4E4D96B4E005A19E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3bc5469e81eb33356b1a45edc190bdf0138be0469e92a72007cce012e398e957
MD5 e4d8f91cde985adfffee0742151f0503
SHA1 6ce1e0230a69dc9d7bb4b71a4509688a0ea2a2ef
SHA512 dfadfedb2a6c67b4ee1f7b433ec8571f13d5127e740d139b120619aa70aafbd8621e1830452df0b55fe6c917d117b664a9adf1ba5dc33fc5e7a3d8aa865de44c
SSDEEP 768:Irv+4UNbdD37cfKNp8+p3bd66j+4BRv86aLIih2bwCl1:Ibsbp3XL8+p3Z6n4yr0ww
TLSH
T1EC03BE33E8A899739CF6C648B24677437FF851A396C10ED4E4DD2B4E416A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e68c1c4-064a-4be5-9f4b-91ed0520f0a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e68c1c4-064a-4be5-9f4b-91ed0520f0a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 573KB
SHA256 edc2a572c854afe9093725c2352561cad86cfa538081c21fe95e49cdd2ea989e
MD5 5c92e1527b771317f0d5de7f1dfa3ba5
SHA1 78ed17717cb8b2363bdf04891ce9327da22d9ce7
SHA512 b6040d473dc5a487a6f6599850dad8785d7b621a4b29167047b901ca57b2126302ee07b41570d89b76c9a1745058c4fb73ff7781f21a9d25cf5b84f164889e5c
SSDEEP 12288:BiHVTZ0PuwnimEaldw8Xv7n1I7NvewjaW4ne6om5YescParlCi3tn11XD8R2u:BiH1ZGuoFEal+8f7n1IZGBjpoIPvyrlK
TLSH
T108C402F5F7A07CF3A7BE034A9D85AFAD07664622C74FA08C443B2BC2455372AAF65504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 222facee319c0408b02b82ab1f3c621c3e34d77e3a5e70c203a2fd673e71da41
MD5 5b9fa858c3cf1b8e3e95d0f3feeab4dd
SHA1 1b08d06b36eafbb82c0082cd51bbd8799f626f43
SHA512 b743e83925dd2c311bf2bfa6b1def611a56ec4a08ea9e20a8cd27ab532982891b158fc8263f383d903adfd6b350dcb480955ea98786e46a917b49a731355d0fe
SSDEEP 192:d1d66JoztdzgCl6mBM2XOv5zbo+D2xyjk9MN:7d66Joz/zgC1Otbo+D2xyjkU
TLSH
T115E10DA4EA29873FC004537BDCA51B440F39399ADC4E2F19759D24182D5B2EE368E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 736B
SHA256 5df54a3cb8232911d266af775a38c5a2d06f124e85c99dea3ca9518720c9498d
MD5 c89643af54d4f5fe68d148c80a84f0cd
SHA1 fc533e382aa7c111ddd3a0c7e6e31a1cd8218c11
SHA512 cc9cb42569ca03f27c2f5f450024798f3f2bd16e4efe22e920b7d3df5726446b5def7ec80d00489f6e1d79f8362e4cde030ec279d32a5517ae24b6173bbfb6bd
TLSH
T1E301AF88F7649136E445D33ECC57AB118F306029D48EFB21306C64088E2A61A32EE43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 3d43b42333d9bfd57ed4074208ad35d418a78e70001fb32cedd94c7e552887bb
MD5 e781c1c8ee72c63c2e0689ca031eba3d
SHA1 f158a1a2864fe9889ae3c2c0533fc7110e3c29d2
SHA512 07d563a81b475cd34bcc7daec82f1ff323417d13e4f5ca770722756d41518582bf4faff8ddda5ecfa1161a17e2c97a54fb24d68218b92d59cb796d67d83d8c9f
TLSH
T1A9412349F6298A3EE448823ADC565B448F347419E49E7F2A35ACA04D2D0B3DE36CE03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 735a43f59b7a0bfef298b4209fe38dfd2e72a9df2680968618a46fc0ff9a4743
MD5 7def9557e2dc3f0190d427817a6ec10f
SHA1 42cdc7f1299f83eaf7c08c08a79be5008642f465
SHA512 7c0c71e045ba2e84976a5edebc752fbe559d7073e9f6431552021b2ad049ae5fd015e05afbcc78e0ec9e8d8a9c6a10338d65dc7b00932020e338144987f90a41
TLSH
T1E661A758F629863FD445423EDC665B004F74745AE86E2F2A31AC644D2E473DE3A8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5c9adb6b3af6b3f8dfd4161e1b439615f2629998afa16bf292d6e2cb13deff4c
MD5 38cfbde228b70258a1771cd36b25823c
SHA1 9c1a04d64f17ab42693ad737d92b4e5357607146
SHA512 dc295af705794e3469b4e50bac4127bc9c714d63b6e1547250d76f31ed2d534da0e7b5f2d3350368f7bf805104d358d6df90abbdd4a0064949ed97fd7302cdcd
TLSH
T15C61A958E629863FD445413EDD565B004F347459E86E2F2A319C644E2E473DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 d7b32a5d5ad4306523aa7b7d5b9b0897d28728e39e39401f1e1509ef7db80c66
MD5 2f518c865e052e600e67da08aba33a5e
SHA1 14b3229317d56ea1fbcb3a06daef2941c08f7889
SHA512 8be67721448cdb8f870c79e72c3eb58ebbabd15ec463efcfa4cbf2f3667d60073fb6748dab41052182959a189de1c86886e1ce71df45cdef25447a9f655e22a5
SSDEEP 96:0FoFf/dd66JoztdzgClKtmBM2/XSdF95/7bkW6ArlyUR6axlWT:v1d66JoztdzgCl6mBM2/Ov5zbo8lyj0M
TLSH
T19CA19A68E629863FC444533BCDA21B004F3A395AE84D7F1A35EC7419395B2DE368D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f75d0ce1edaf75ab5ffa8de9d2467f0978a168ca5a329e548105730ad6657a44
MD5 ae1c463207125b98b0c3a3c1e57dc627
SHA1 141aa924a56e15db3293ecfeea516205989718c8
SHA512 7c7551ce6f7956f32e7bb201e940ee37aea185d296ffaccc7e7343a2b8ec90516f15df867560550c844e57d8214efba22659679c37fc478401a531a7ddcf4870
SSDEEP 192:IOv5zbo8W2xyjk9MM1d66JoztdzgCl6mBM2:zbo8W2xyjkTd66Joz/zgC1O
TLSH
T17ED1FCB4EA28873FC004533BCCA51B450F3A395ADC4E7F19359D25182D5A2EE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0f12fbc07c63351131c30f4eddb8c519e06aec9b6599acad7d48dcdaf536ad57
MD5 2f290101fecc827df2bfe5872d041ca6
SHA1 49b0d9f37811a8fd357fc42ee1444f2fefa8b344
SHA512 7885f7c068209b897d83fc2329c025f5ef48f891dcc03fb7f679f9d0ebbe8f2e91a3077f05d808f8e235c5845ff306d854f504235c1b7f26f42207cce1720dba
SSDEEP 192:IOv5zbo8W2xyjk9MX1d66JoztdzgCl6mBM2:zbo8W2xyjk0d66Joz/zgC1O
TLSH
T107D1FCB4EA28873FC004533BCCA51B450F3A395ADC4E7F19359D25182D5A2EE768E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 239ecacaf346e5ad7644b503f03e36d54e902b7a0ddcba00b87e042cc4f8cc29
MD5 07040f4f88664256877f2a8418826b78
SHA1 80795857a9dc21813073801e2a2c4b078abf5a6e
SHA512 4e6fb4e1273ed67db151b7dfc2173f521b06b2a81ba7921838121554112843283fbceece25739800c263eb93bcf3a9ab6faefa1f43413f2dca4a52403fc3a6c2
TLSH
T10F41AA1C3AB5EDA5DECBF29C1490528E93790A5392062A436E31FBC9CA807D6326593C
MD5 SHA1 SHA512 TLSH

Submit Download

0265fdad-a893-49f6-8ab4-236900d5e464

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\0265fdad-a893-49f6-8ab4-236900d5e464
Size 796B
SHA256 a1cdb5f38c36f8391601a4866205ede8d57b202b3b46d47b491f3a246fb7524d
MD5 ea136caaab094398088122cf1b79984c
SHA1 c9b5533900e0cff58f7ec9c124cea1b735f711eb
SHA512 30963e71508c45c6a3adc076a71214ebdb214e7f242d2131c7f6e978062a3762823eb148993df562b4c2cb5c1a7f9249f37be85e287511c50e2e70c644cab8c3
TLSH
T1AA01CE919A2176B2CD78830F8AA13B8547E47823D4CE9D183D925E140EAA11EA3B6607
MD5 SHA1 SHA512 TLSH

Submit Download

8e9b0747-c709-432e-9f7c-18df3404e12a

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\8e9b0747-c709-432e-9f7c-18df3404e12a
Size 235B
SHA256 b5eb96d37c293c0914607b65b6d93ee1973906769be448eac33d9264a4298674
MD5 75a1c5fdeabba455ab7a63f0bd38064e
SHA1 88dd57399aad71df0b04c8f79ab8192ba1a96648
SHA512 463195d118865d402c3f0d1503ab167fe60d05efb10c7e69499d94728ba5dcb645723098b4c51951daec107619b68153c6fdf214b3aa3bdc27012cc772ae4f97
TLSH
T15FD097D43888379D08040F03F4A069CB30888C3710B4A86489620A34D9F9EC4822280B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 7535c0a3eb62cf42e212fe860b24d1976c7e038d0d1da00dc485c03f341191cc
MD5 f0fad9e410f86e5b42766e146c43b738
SHA1 fa90e463b86dd23a4dfb66a26f552191e3acff27
SHA512 0869c06284e1ecbb9e310b26841dbfb1bb67d645895b7c070c5ad48649e4f0ba1a351406f4a8297018ba83ac61866dac101598f78b8e324cd2e4955125e6d01e
SSDEEP 96:xHaEqGqIdHzvp6ElW9hntlTnSMzPbk1w8hGcnC2:s3RIdN6EslTnSAg1w8hR
TLSH
T122A14F786148CF6F65B67B6CAC648C719EB2013BB37F688610E584C5010CF3846E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 40d1c95f1221471fe06b5ef26d5b2b6f33a35f899403952ae422e63569c6a88f
MD5 7b5713ef47a0b213c8dcefab08e9466e
SHA1 0b65904488bd3148c7fc88b80fd8ebf7b35ad5f2
SHA512 4d966a8d5752c5b90980c55cd701d3ecb355ba9977ec90262c94460e31a092746e577dab0e5cfc59001a173a1c93110fdfa90d795e14a8bb5e70d866fbea1b3c
TLSH
T18C31DEA65949CF6FE5B976ACFC1449A0D6B2413BB67F5C4220F880C68418F3802F39DB
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 4848b58f9d3d97341bbfccd8eab650f1f0a4bb6c9f64954f05a2e6e0cf43b354
MD5 05f77a686e1050407c0d519082b9e231
SHA1 8aec6ff09eea9d0cfd0441011791baf176889dd6
SHA512 b396713ebf42920f45a9c54bb201ada9648c1ae8eaadd7c341ecf2093cb05aa34a0d58f2d567e079951c737e3feef96cc7745ebdfafe2873ff6b354d54a214bc
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0YZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWpyh44CfiaR/skL0H7
TLSH
T1AB23348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 80KB
SHA256 e8e78d669d883244ba357e981dc3a54fcd6d76dc8166f03772c5b043172485c5
MD5 520fe8bbea83b5f167d5a9db6792c923
SHA1 df2ebb125f2e3c85518ddf56e35e9d13489b5227
SHA512 23ba4d8e5ddfc258104523941be16693486fa1d92989cdd9481ab9effce084507096effcc9159f99393909cf30d79c4d5b764a1d1a5a5da94e094c92dad5adb5
SSDEEP 768:r6S6CrAWpj+f3aY3p6x3I0H7f+eHPcHt5qcTPlCJbc+Mf:r6S62y3aY3p6x3T+eHPcH/zj4JY+8
TLSH
T1BA832A9D3933D463CB14E43B32A681FB901F969D407127883BA8978C646F15B9E2FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-2772-0x0000000000C00000-0x0000000000C03000-memory.dmp

Download

memory/3372-2782-0x0000000002F10000-0x00000000034E2000-memory.dmp

Download

memory/3372-2781-0x0000000002F10000-0x00000000034E2000-memory.dmp

Download

memory/3372-2780-0x0000000002F10000-0x00000000034E2000-memory.dmp

Download

memory/3372-2774-0x0000000002F10000-0x00000000034E2000-memory.dmp

Download

memory/5252-1514-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1556-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-331-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1097-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-330-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-329-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-328-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-327-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-100-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-95-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-94-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-52-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-53-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-47-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-11-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-7-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-3-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1480-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1481-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1487-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1486-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1490-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1504-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1527-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1534-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-334-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1537-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2785-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1550-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1549-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1558-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1543-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1555-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1561-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1566-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1552-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1576-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1574-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1581-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1582-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1585-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1591-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1630-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1666-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-336-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-340-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2777-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-342-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-348-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-1546-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-350-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2793-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2792-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2794-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2820-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-2821-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5252-3137-0x0000000000400000-0x00000000004CB000-memory.dmp

Download