acrstealer | b46345e01df2117f6857fd219bf132a9382453c8386476ca3773437fcdc8eaec

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1-2784.ps1
Size 1.5MB
Sample260905-ah2phashnb
SHA256 b46345e01df2117f6857fd219bf132a9382453c8386476ca3773437fcdc8eaec
MD5 d7a8b531be350ff428477e76b65c0451
SHA1 947676f61fe1cc9cbc27844523007d273b730640
SHA512 62495f4a56dc847f8f6433259a43167bc61be2bd7a14a2dbbd32a1a10f437be933200ad541d1ea40dedee03ec5e09bcbfde37d9dd67e795e2ed8e9582add0619
SSDEEP 12288:F52vE0t1wkHNbHOxVWBwL6aWfGlcKRHpHOFSOkpOk20kptPQZA20RwO/TMUzg9CL:G
TLSH
T12075F0523651FD7D029693B16E1646F0A46ACA80CFDF8557F24DCE88A14DC863AFA3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer spyware stealer

Malware Config

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 58 IoCs

resource	yara_rule
behavioral2/memory/3580-39-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-40-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-41-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-45-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-78-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-84-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-125-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-126-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-131-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-387-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-388-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-389-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-390-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-391-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-394-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-421-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-423-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-430-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-438-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-696-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-697-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-699-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-701-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-703-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-705-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-707-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-711-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-713-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-717-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-723-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-728-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-734-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-740-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-748-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-754-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-760-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-765-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-764-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-807-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-843-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1957-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1960-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1965-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1968-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1980-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1982-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1986-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1989-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1991-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1992-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1993-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-1996-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2011-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2034-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2033-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2095-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2637-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3
behavioral2/memory/3580-2638-0x000000000A7C0000-0x000000000A880000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3580 created 5084	3580	powershell.exe	80
PID 3580 created 5084	3580	powershell.exe	80
PID 3580 created 5084	3580	powershell.exe	80

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3580	powershell.exe
9	3580	powershell.exe
10	3580	powershell.exe
11	3580	powershell.exe
75	3580	powershell.exe
78	3580	powershell.exe
79	3580	powershell.exe
82	3580	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3580	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4312	PowerShell.exe
3580	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	chrome.exe
1344	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	PowerShell.exe
4312	PowerShell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	PowerShell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
5148	msedge.exe
3152	firefox.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3580	4312	PowerShell.exe	90
PID 3580 wrote to memory of 1460	3580	powershell.exe	91
PID 1460 wrote to memory of 3528	1460	chrome.exe	92
PID 1460 wrote to memory of 1564	1460	chrome.exe	93
PID 1460 wrote to memory of 3828	1460	chrome.exe	94
PID 1460 wrote to memory of 1564	1460	chrome.exe	93
PID 1460 wrote to memory of 4680	1460	chrome.exe	95
PID 1460 wrote to memory of 4680	1460	chrome.exe	95
PID 1460 wrote to memory of 3000	1460	chrome.exe	98
PID 1460 wrote to memory of 3000	1460	chrome.exe	98
PID 1460 wrote to memory of 2400	1460	chrome.exe	97
PID 1460 wrote to memory of 2400	1460	chrome.exe	97
PID 1460 wrote to memory of 3704	1460	chrome.exe	99
PID 1460 wrote to memory of 3704	1460	chrome.exe	99
PID 1460 wrote to memory of 1800	1460	chrome.exe	100
PID 1460 wrote to memory of 1800	1460	chrome.exe	100
PID 3580 wrote to memory of 5148	3580	powershell.exe	101
PID 5148 wrote to memory of 3444	5148	msedge.exe	103
PID 5148 wrote to memory of 4128	5148	msedge.exe	104
PID 5148 wrote to memory of 1344	5148	msedge.exe	105
PID 5148 wrote to memory of 4128	5148	msedge.exe	104
PID 5148 wrote to memory of 4128	5148	msedge.exe	104
PID 5148 wrote to memory of 236	5148	msedge.exe	106
PID 5148 wrote to memory of 236	5148	msedge.exe	106
PID 5148 wrote to memory of 5756	5148	msedge.exe	108
PID 5148 wrote to memory of 5756	5148	msedge.exe	108
PID 5148 wrote to memory of 5756	5148	msedge.exe	108
PID 5148 wrote to memory of 5580	5148	msedge.exe	109
PID 5148 wrote to memory of 5580	5148	msedge.exe	109
PID 5148 wrote to memory of 5580	5148	msedge.exe	109
PID 5148 wrote to memory of 4364	5148	msedge.exe	110
PID 5148 wrote to memory of 4364	5148	msedge.exe	110
PID 5148 wrote to memory of 4364	5148	msedge.exe	110
PID 5148 wrote to memory of 4084	5148	msedge.exe	111
PID 5148 wrote to memory of 4084	5148	msedge.exe	111
PID 5148 wrote to memory of 4084	5148	msedge.exe	111
PID 5148 wrote to memory of 5700	5148	msedge.exe	112
PID 5148 wrote to memory of 5700	5148	msedge.exe	112
PID 5148 wrote to memory of 5520	5148	msedge.exe	113
PID 5148 wrote to memory of 5520	5148	msedge.exe	113
PID 5148 wrote to memory of 576	5148	msedge.exe	114
PID 5148 wrote to memory of 576	5148	msedge.exe	114
PID 6096 wrote to memory of 3152	6096	firefox.exe	117
PID 6096 wrote to memory of 3152	6096	firefox.exe	117
PID 3152 wrote to memory of 4484	3152	firefox.exe	120
PID 3152 wrote to memory of 4484	3152	firefox.exe	120
PID 3152 wrote to memory of 4484	3152	firefox.exe	120
PID 3152 wrote to memory of 4484	3152	firefox.exe	120
PID 3152 wrote to memory of 828	3152	firefox.exe	121
PID 3152 wrote to memory of 828	3152	firefox.exe	121
PID 3152 wrote to memory of 828	3152	firefox.exe	121
PID 3152 wrote to memory of 828	3152	firefox.exe	121
PID 3152 wrote to memory of 1624	3152	firefox.exe	122
PID 3152 wrote to memory of 1624	3152	firefox.exe	122
PID 3152 wrote to memory of 1624	3152	firefox.exe	122
PID 3152 wrote to memory of 5840	3152	firefox.exe	123
PID 3152 wrote to memory of 5840	3152	firefox.exe	123
PID 3152 wrote to memory of 5840	3152	firefox.exe	123
PID 3152 wrote to memory of 5840	3152	firefox.exe	123
PID 3580 wrote to memory of 1056	3580	powershell.exe	124

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5084
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1-2784.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\1-2784.ps1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa6e1fc728,0x7ffa6e1fc734,0x7ffa6e1fc740
    3⤵
    PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,17804713529022923763,9350874525213489466,262144 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,6297990662007012647,3074292119579738368,524288 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,8225068186867075754,17119470444105517392,524288 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,3729216579938366841,12222085929228126274,2097152 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,15736570820914836785,3055897660105892096,2097152 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,3140055619185648387,17900180031416330530,2097152 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,3754747035695110560,1242378536915094712,524288 --field-trial-handle=1936,i,770353378822258809,1179429854122581327,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
    3⤵
    PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa69c4c188,0x7ffa69c4c194,0x7ffa69c4c1a0
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,7197442246500022247,16783961628389414270,262144 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,10002891549859055422,9537280485060677394,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17621905761961488007,10743599717237443313,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,3933079770448856774,8281784057440984895,2097152 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,18347272952084064049,12011896790871856275,2097152 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,10612430572071944653,7374517387813177187,2097152 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,8527140036697531911,11718449185835498545,2097152 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,15506583931052950103,133987413559895650,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4165334415142561371,14315091920112981660,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,15003121495972215217,12680197559968842052,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,1145133653672504853,5011863540171772825,524288 --field-trial-handle=2504,i,5052772207825604266,11994813343143821121,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
    3⤵
    PID:4196
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2776 -prefsLen 24445 -prefMapHandle 2780 -prefMapSize 268500 -ipcHandle 2856 -initialChannelId {8ad72f65-94e7-4ba7-b576-6218df08db51} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2000 -prefsLen 24658 -prefMapHandle 2004 -prefMapSize 268500 -jsInitHandle 3620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1788 -initialChannelId {956282dc-5a31-418d-a6d3-13cf4cd1e264} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1776 -prefsLen 25542 -prefMapHandle 3624 -prefMapSize 268500 -ipcHandle 3832 -initialChannelId {6693daca-6e1b-42f9-a1aa-de2818d2333c} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:1624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 25604 -prefMapHandle 3744 -prefMapSize 268500 -jsInitHandle 3644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2000 -initialChannelId {1f8c4f75-497c-4c83-bb77-85ed86d3f6a1} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:5840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cbb8fc7bda82ac37948f624b4a807f42feb9f6ef67d089bcf5ba8ed469af850e
MD5 9acb143e60d238d7d72de9ef75880da9
SHA1 72b2cada5262e085802ab7a197613f9311e1e478
SHA512 ffa65f0becfac945ca7bb0ab1c35534e8848c0e02423653f1da45f86d978ff6e327bc42c6e387ebc861f69eee5108c68554d4623a3d451289a0106c6ac9df277
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5OCDBB6/dGyv95Sqhbb2Jv4a:gC0LA/TE57cDUD53UweSqhbKl
TLSH
T140A10871B4A95EB75D75C584F9827E83CF68A117A9227F80D8EC1F0C11E70EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 697281ec5baf23e9ba50186e1206c5d568cdba06c98f0e3cb0e1e5e16e129bdf
MD5 bc60d29bd5c5016ae56ffb4d0fea5f6d
SHA1 c322a8df208620a3e79529f0790a33e58d01dd01
SHA512 e6b519eb8975563cdb798c7a5b6fee515a543adf531f08a5e230bf68ed3229badedac3cc54b025cc431d3ad97cb9842d382c7fb1aeedf86a90a14ef1a74a80e2
SSDEEP 768:6rv+4UNbds34HDZIO03SNzc4ReyIsXJeVH1S5D:6bsbS3gtc44bs5EH1Y
TLSH
T16F03BE32A868D977ACF66686B50B75533EF8512B82D81ED0C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 edd2aba0a10a71b2884a4a561c365e1a7561bea6c858639cf4f5c13a245cd9e7
MD5 7f56e022ca0a796fc9f1963b152f9f75
SHA1 3a75d3f6824f3ec19f8b14426f6f1178b39c4b8a
SHA512 8ba88c46d019eb8d2c4b328ab30eec46f04c357c41f2c59f48f5c4e966d3fe152cd0dbf125816ebdd850d3bed697df0d994e6be75e0fbf81fd6671c06115f7f9
SSDEEP 768:Crv+4UNbds3TuDZIO0338Nzc4ReyIs2xYeVH1S5D:CbsbS3mtc44bs5EH1Y
TLSH
T18903DF32A838CD73ACEAA646B14776933EF8612B81C40E94C9EE5F4C0A475DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 70KB
SHA256 f4e8a8c3b6d58d6cafb7546a94bfb9de8d36e59d4ab766017064913f745d45a4
MD5 1cc49ad626ece80bfd85fc064dd7f3a4
SHA1 d9dba197c27623c9ef36ca666b0f66b4ae82d6f3
SHA512 22346c3ae1ad0f6da275f027f03d096c2eacf574facac135c574f38ad37f47b1c24924fa376479140d485d577631201a29f1076530d859241454aeac06e0b7c6
SSDEEP 1536:gzQdscIoYo2hOovdfKQVTflJdCHYWh4iUx9R40i71Yi9MMyPcMrxaaV3CNBQkj22:gzQdsvoYo2hOovdfKQVTflJdwYWqiU9a
TLSH
T1436373D2E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA9879970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 3e62f45a2680d4be51ef96f845f9684eba5575095e0091550cd27e8dd8fddd54
MD5 13b4d536a420b1bac50ce33ff2cda658
SHA1 005c6bd77baeb9ddda908deebb2f38e425e2fb62
SHA512 218d8bc40a8ea1304cdae7acf63e731bb9705024f9e24ac89e23952cf1d21c595c039e4d450ae6b3aa75aa162fc2b24051a57b174b02ea95862793708a702181
SSDEEP 96:xHaEqGqwdcJzvd6ElW9hnnwCONBw8hGcnM:s3Rwds6E2DONBw8hS
TLSH
T1DBA11F789444CB6F65F6776CACA588716EB2023BB7BF688610A484844508F3846F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 11c9b9e5fbb220b9aafca73e6e40b9235d5135f77526aaa0eaac5e7272754a37
MD5 8ce6e7f104abc8e9e6617f18e3c96a8f
SHA1 3a55e58254b25ef264fbbba496ef35afadab6cbc
SHA512 41cf2b799387aac7a682ff04b5c4992d42b68246e131b0527976419fc870150354675d1c753592a7755b844c6e521d8b0a06bb91ad81904f26c3775ca95ff428
TLSH
T13331CCA65C45CF6FA1B537A8BC554961D7634137B6BF9C8224B880858418F3402F68E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 5802e1a5038bea7dedc88c40403c2630cac207f284fff39d3824fa452fa12500
MD5 158a0636f207cf7729c5297c328406a8
SHA1 8c3207292b699b4125ac32ce8d62c5d49cb5ddb3
SHA512 aa66394966217d76df189e5764765afed50b5040b158e6e9b8ea3fb212dbe22a03647cc8f06ca0a8817e5667b9b7e5a432d3cfc30663a7db4ee3c0b84ce58fc4
TLSH
T1887110B85454CB6F61B5776CBC658861AEB2017BB7BF688210F890C4440CF3856E5AE7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 40aebcebad3080eda1ccfb6fb7c89a8cad6e7f7e1bebaf93d05186b9090c6978
MD5 52fe71792b58c8bd7cf3c4dad8e8d0b9
SHA1 7456692cab20ef7aaa672a0ad84fe447ce0a7ed3
SHA512 043a02f8aaa8447b042f7d6b1b34ee78cc3876fc00101fae8fbbb1de9e75e38bc75a46982d8da0e03003e23c640068086840d2b3e0b9ad7d69bee614204592eb
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0pZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWsyh44CfiaR/skL0H7
TLSH
T15E23458D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 475862d48d0ec7340bce56982302f12f5053078abfec57396c2723326ca34e82
MD5 16a78d23f1f1e917f3ff0cf9686c59f5
SHA1 99fa1ba4180997e684d07cc8512a5eba11fb8627
SHA512 98b54aa85260231a3d0a6bed089e4b1b037b848e75d934608ec929a1d82de1fd5e84b187f812d6ff3a7e2200e32a082d211f19b4a98148a822c6f81f080b9bee
SSDEEP 192:wa16S6CdFAWusfPjh44CfiaR/suOPk0H7qSfP2hk4CfiaRWAMS4CIfi5/:wk6S6CrAWRHjhcfZ6k0H79H2h4f+Tf
TLSH
T14943848E3633DD52CB19E07A629642FB544FA1DD0030138866999F8C841F1AB9E2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-1949-0x0000000000910000-0x0000000000913000-memory.dmp

Download

memory/1056-1951-0x0000000002E70000-0x0000000003442000-memory.dmp

Download

memory/1056-1955-0x0000000002E70000-0x0000000003442000-memory.dmp

Download

memory/1056-1956-0x0000000002E70000-0x0000000003442000-memory.dmp

Download

memory/1056-1954-0x0000000002E70000-0x0000000003442000-memory.dmp

Download

memory/3580-34-0x000000000A320000-0x000000000A33A000-memory.dmp

Download

memory/3580-843-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-25-0x0000000005A20000-0x0000000005A86000-memory.dmp

Download

memory/3580-24-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-26-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Download

memory/3580-23-0x0000000005980000-0x00000000059A2000-memory.dmp

Download

memory/3580-29-0x0000000005BC0000-0x0000000005F1B000-memory.dmp

Download

memory/3580-30-0x00000000060F0000-0x000000000610E000-memory.dmp

Download

memory/3580-31-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/3580-2646-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-33-0x000000000A3C0000-0x000000000A456000-memory.dmp

Download

memory/3580-2638-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-35-0x000000000A370000-0x000000000A392000-memory.dmp

Download

memory/3580-36-0x000000000AA20000-0x000000000AFDA000-memory.dmp

Download

memory/3580-37-0x000000000B660000-0x000000000BCDC000-memory.dmp

Download

memory/3580-38-0x000000000A660000-0x000000000A6AD000-memory.dmp

Download

memory/3580-39-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-40-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-41-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-44-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-45-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-78-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-84-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-125-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-126-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-131-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-269-0x0000000074A92000-0x0000000074A93000-memory.dmp

Download

memory/3580-387-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-388-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-389-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-390-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-391-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-394-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-421-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-423-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-430-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-434-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-438-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-21-0x0000000005300000-0x000000000594A000-memory.dmp

Download

memory/3580-20-0x0000000004C30000-0x0000000004C66000-memory.dmp

Download

memory/3580-19-0x0000000074A92000-0x0000000074A93000-memory.dmp

Download

memory/3580-2637-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-2095-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-2033-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-2034-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-2011-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-524-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-1996-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1993-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1992-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1991-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1989-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1986-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-696-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-697-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-699-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-701-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-703-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-705-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-707-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-711-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-713-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-717-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-723-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-728-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-734-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-740-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-748-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-754-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-760-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-765-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-764-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-807-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-22-0x0000000074A80000-0x000000007523C000-memory.dmp

Download

memory/3580-1982-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1980-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1968-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1965-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1960-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/3580-1957-0x000000000A7C0000-0x000000000A880000-memory.dmp

Download

memory/4312-11-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-13-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-4-0x000001EDC4BE0000-0x000001EDC4C02000-memory.dmp

Download

memory/4312-12-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-7-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-8-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-9-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-10-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-5-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-1-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-6-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-14-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-15-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-16-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-17-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-18-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-0-0x00007FFA777DF000-0x00007FFA777E0000-memory.dmp

Download

memory/4312-32-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4312-2648-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download