acrstealer | b46345e01df2117f6857fd219bf132a9382453c8386476ca3773437fcdc8eaec

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1-2784.ps1
Size 1.5MB
Sample260905-plc8msvakf
SHA256 b46345e01df2117f6857fd219bf132a9382453c8386476ca3773437fcdc8eaec
MD5 d7a8b531be350ff428477e76b65c0451
SHA1 947676f61fe1cc9cbc27844523007d273b730640
SHA512 62495f4a56dc847f8f6433259a43167bc61be2bd7a14a2dbbd32a1a10f437be933200ad541d1ea40dedee03ec5e09bcbfde37d9dd67e795e2ed8e9582add0619
SSDEEP 12288:F52vE0t1wkHNbHOxVWBwL6aWfGlcKRHpHOFSOkpOk20kptPQZA20RwO/TMUzg9CL:G
TLSH
T12075F0523651FD7D029693B16E1646F0A46ACA80CFDF8557F24DCE88A14DC863AFA3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 60 IoCs

resource	yara_rule
behavioral1/memory/1432-37-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-38-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-39-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-40-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-43-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-76-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-82-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-123-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-125-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-131-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-374-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-373-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-375-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-390-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-389-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-391-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-419-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-425-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-426-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-428-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-470-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-654-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1064-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1066-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1065-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1071-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1074-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1072-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1078-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1081-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1086-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1087-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1089-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1088-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1085-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1098-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1104-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1107-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1111-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1114-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1115-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1118-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1119-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1120-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1123-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1129-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1168-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-1204-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2319-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2318-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2327-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2329-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2330-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2380-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2379-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2378-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2430-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-2433-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-3008-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3
behavioral1/memory/1432-3009-0x000000000A270000-0x000000000A330000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1432 created 3276	1432	powershell.exe	56
PID 1432 created 3276	1432	powershell.exe	56
PID 1432 created 3276	1432	powershell.exe	56

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	1432	powershell.exe
11	1432	powershell.exe
12	1432	powershell.exe
13	1432	powershell.exe
162	1432	powershell.exe
165	1432	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1432	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1416	powershell.exe
1432	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	chrome.exe
3300	msedge.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330846970746983"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{48FDB29B-37DD-4BA5-9A92-E9E4BEF5533B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1416	powershell.exe
1416	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe
Token: SeShutdownPrivilege	4312	chrome.exe
Token: SeCreatePagefilePrivilege	4312	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
3420	msedge.exe
3420	msedge.exe
4888	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1432	1416	powershell.exe	85
PID 1432 wrote to memory of 4312	1432	powershell.exe	86
PID 4312 wrote to memory of 3780	4312	chrome.exe	87
PID 4312 wrote to memory of 4688	4312	chrome.exe	88
PID 4312 wrote to memory of 764	4312	chrome.exe	89
PID 4312 wrote to memory of 764	4312	chrome.exe	89
PID 4312 wrote to memory of 3588	4312	chrome.exe	90
PID 4312 wrote to memory of 3588	4312	chrome.exe	90
PID 4312 wrote to memory of 4792	4312	chrome.exe	92
PID 4312 wrote to memory of 4792	4312	chrome.exe	92
PID 4312 wrote to memory of 2844	4312	chrome.exe	93
PID 4312 wrote to memory of 2844	4312	chrome.exe	93
PID 4312 wrote to memory of 1040	4312	chrome.exe	94
PID 4312 wrote to memory of 1040	4312	chrome.exe	94
PID 4312 wrote to memory of 4896	4312	chrome.exe	95
PID 4312 wrote to memory of 4896	4312	chrome.exe	95
PID 4312 wrote to memory of 3304	4312	chrome.exe	109
PID 1432 wrote to memory of 3420	1432	powershell.exe	99
PID 3420 wrote to memory of 4576	3420	msedge.exe	100
PID 3420 wrote to memory of 3300	3420	msedge.exe	101
PID 3420 wrote to memory of 2140	3420	msedge.exe	102
PID 3420 wrote to memory of 2140	3420	msedge.exe	102
PID 3420 wrote to memory of 2140	3420	msedge.exe	102
PID 3420 wrote to memory of 4000	3420	msedge.exe	103
PID 3420 wrote to memory of 4000	3420	msedge.exe	103
PID 3420 wrote to memory of 2900	3420	msedge.exe	104
PID 3420 wrote to memory of 2900	3420	msedge.exe	104
PID 3420 wrote to memory of 2900	3420	msedge.exe	104
PID 3420 wrote to memory of 3980	3420	msedge.exe	105
PID 3420 wrote to memory of 3980	3420	msedge.exe	105
PID 3420 wrote to memory of 3980	3420	msedge.exe	105
PID 3420 wrote to memory of 4212	3420	msedge.exe	106
PID 3420 wrote to memory of 2260	3420	msedge.exe	107
PID 3420 wrote to memory of 4212	3420	msedge.exe	106
PID 3420 wrote to memory of 4212	3420	msedge.exe	106
PID 3420 wrote to memory of 2260	3420	msedge.exe	107
PID 3420 wrote to memory of 2260	3420	msedge.exe	107
PID 3420 wrote to memory of 3068	3420	msedge.exe	111
PID 3420 wrote to memory of 3068	3420	msedge.exe	111
PID 3420 wrote to memory of 1576	3420	msedge.exe	112
PID 3420 wrote to memory of 1576	3420	msedge.exe	112
PID 3420 wrote to memory of 4780	3420	msedge.exe	113
PID 3420 wrote to memory of 3352	3420	msedge.exe	114
PID 3420 wrote to memory of 4780	3420	msedge.exe	113
PID 3420 wrote to memory of 3352	3420	msedge.exe	114
PID 3420 wrote to memory of 4788	3420	msedge.exe	116
PID 4988 wrote to memory of 4888	4988	firefox.exe	118
PID 4988 wrote to memory of 4888	4988	firefox.exe	118
PID 4888 wrote to memory of 1308	4888	firefox.exe	119
PID 4888 wrote to memory of 1308	4888	firefox.exe	119
PID 4888 wrote to memory of 1308	4888	firefox.exe	119
PID 4888 wrote to memory of 1308	4888	firefox.exe	119
PID 4888 wrote to memory of 1400	4888	firefox.exe	120
PID 4888 wrote to memory of 1400	4888	firefox.exe	120
PID 4888 wrote to memory of 1400	4888	firefox.exe	120
PID 4888 wrote to memory of 1400	4888	firefox.exe	120
PID 4888 wrote to memory of 4084	4888	firefox.exe	121
PID 4888 wrote to memory of 4084	4888	firefox.exe	121
PID 4888 wrote to memory of 4084	4888	firefox.exe	121
PID 4888 wrote to memory of 2916	4888	firefox.exe	122
PID 4888 wrote to memory of 2916	4888	firefox.exe	122
PID 4888 wrote to memory of 2916	4888	firefox.exe	122
PID 4888 wrote to memory of 2916	4888	firefox.exe	122
PID 1432 wrote to memory of 760	1432	powershell.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1-2784.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\1-2784.ps1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9d3a8c728,0x7ff9d3a8c734,0x7ff9d3a8c740
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,13453931016019746977,11867934342008272618,524288 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,16464990722327194068,6710701926150515725,262144 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1788 /prefetch:2
    3⤵
    PID:764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15959725970491028401,7670039103240112963,524288 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,12046327481884210256,14322512139540630878,2097152 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,28008865485858764,9846769523036713519,2097152 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,8823849134255942139,8750545663081713740,2097152 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4232 /prefetch:2
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4540,i,14718426580286913423,12690609669277994559,2097152 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,11996686648500747846,17749904223201577193,524288 --field-trial-handle=1784,i,15257887458408933475,9585445683051960590,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x320,0x7ff9ce9dc188,0x7ff9ce9dc194,0x7ff9ce9dc1a0
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,7075946060781330877,1895364834458375651,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,4340407265304966242,17443267653494157288,262144 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,852954951436616456,7429814359656327388,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17392547435676552541,5134600466892751330,2097152 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14620439981079625831,9766370775297703171,2097152 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,16458385638566620683,6063715979723598001,2097152 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,7133298664084068262,1624075053753383119,2097152 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,14795960833808060142,8810895338981466797,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13289696011441058393,1400447556700065866,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,819797781917890817,16373244772916750360,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9427211977136948167,593380337874652411,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6326015471586207197,17543750310171399287,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6326015471586207197,17543750310171399287,524288 --field-trial-handle=2280,i,13901447012133775555,6407567866517781874,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:4788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2760 -prefsLen 24447 -prefMapHandle 2764 -prefMapSize 268500 -ipcHandle 2828 -initialChannelId {2750e4eb-07af-4d09-b99b-e311d426fc4b} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:1308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1964 -prefsLen 24657 -prefMapHandle 1796 -prefMapSize 268500 -jsInitHandle 1952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1736 -initialChannelId {395d9afb-73a1-4141-9ee8-363749533a02} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:1400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3592 -prefsLen 25543 -prefMapHandle 3596 -prefMapSize 268500 -ipcHandle 3644 -initialChannelId {9379f32b-088f-46e7-a6bc-5b49a7f0c059} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4056 -prefsLen 25606 -prefMapHandle 4060 -prefMapSize 268500 -jsInitHandle 4064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3960 -initialChannelId {7888745a-be62-4c14-b048-39ea540faa0b} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2280

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f266e08ac7a2752239d958255adebecfa27756a525e74c457bbdbb7aaf1230b3
MD5 cb8cc848cf13568ed1cfdf225d0e7077
SHA1 0e559ef1aff7fcf753db1e103573296929e987cc
SHA512 f1ade4c1e317d1e1b6626d0036876ca4b56e865bd292b7ad6d4fa37d99990792690644bce9db6c64d0f1efb5e17cdaa3307e7c4600e6839702e69d52892450e6
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:um7Rkm1tYpBeh2BAoK
TLSH
T1A2C3123B5D75E87B9979BB0EB08E0B1F1EF149A2C920DE92C8D85A0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f8e81331c44a1c5a7bbeb9db33297d7d265d5b015d88fc8671cd7605bd8f11f4
MD5 7b13d0369a037b2ac3a60a690b7e15c6
SHA1 0707b29593f623ca2f807b6136a311c24be655bb
SHA512 c42484162faa13fa177600259241cd525a27623c2c75b45f22b8da3390abb5aedd1442cb3183a5749e9ce620418d851747961eb28b34e6afd258c7982c5051ea
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyNvItKE0o/yFjIhKQgEcqIfKTiUzyD:KYbaKYIKmveKE0i2jaKQgbqgKTiSg
TLSH
T18FB15316713E024278FE295991A6953B9F413673350CA86F7F7851A20E6AE311DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fdea03c6faf49e8f3d8ba7e5036d5107dd3721ec91cf1296346bcaaea4fd6c6a
MD5 d61bdb2a38c5ba5b0303dd036f1623e5
SHA1 25a8aa05ccb946c05c56a62e1479f62979986283
SHA512 a5607778bf8815fede2f4d5bbd8627b9a9b356e79baac609a9105e52e4dd8df462b99a8fd6a0b79e426a78ee5abc81202dd3e0b896cafbf7adf09d2b3caeee90
SSDEEP 192:tON86JkRtQmiUyMwW+RNQOmyOmWh3xRYU6:tON86UrcW+RNQOxKYU6
TLSH
T12202E935AC382C778EF2AD49F94B27135FA8212BF9552F84DAD81B1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c52d5e8738a08578b794e9ce7d1e7f0db902967f13f3dfd8ff3a300ad70490d
MD5 2ceda84d62f914ad64bb5e0066b60dfb
SHA1 2d338616584aa8e4f2ba229629f3d9afa63f42a9
SHA512 d9e872efdb93de667cf71d5aab1571f95beea04dc95cd0e47570da7c3822779db25aa90cb428eecd090ed74a35a42ee40a380885f0146b11d4cde1f00ae1686b
SSDEEP 192:kONA6JkR1QmiUy3wc+RNQOmyOmHA9zLVckqwtU6:kONA6UT9c+RNQOxM9+oU6
TLSH
T12D12F83178389C775EE6A445F48B27939FA8207BED856F84D1C81E1C05D7B8C274F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86fb45446e3eaed0805a35304e31eeaed151d8f49762c6403d84ee62487dec8d
MD5 a401c5667b0cb4542d00cb5959d27b66
SHA1 34016e0f6f2080ab2aa387d5278c81bc1b2dee6f
SHA512 031890f874aa6bbedda9b6862c1158acdfa69614c6da00508c5a662150117b4547356aba15eb8f1421d83f542ea91a0fd25c0dd845150d6587bef514955903d5
TLSH
T1E8412758A6EA1148B3B76E4AABF7A9AD487FB8373F06D45D00010D4F0627B40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pirlixsw.iag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pirlixsw.iag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 576KB
SHA256 59ec4af1f59cfb3da27519c1e2ba477c120bf573044e884baee25f9d37b7322b
MD5 9af904252863b9dab5b79bc5fbfebede
SHA1 e3bde64adccb09992ff19feb73bee5d27ca81261
SHA512 3ec8fa12a576b38767e9a6d2ed2a1d41e52545301bf1500b70432283657d32f52062d2c1ba8a2351e1311047d8fd2a19aa9dc0b07dd88ecd5453e001a9ebc223
SSDEEP 12288:r0UnhTmKFZt9kf8imEaldw8Xv7n1IKkvewjaW4ne6om5YescPafEu3Kk11XD8R19:r0UnwUZfkEFEal+8f7n1I7GBjpoIPvyW
TLSH
T166C401F6F7607CF3A77E034B9D95BFAD07664622864BA0CC443B2BC2465772AAF64104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 6a93aa021b9902e3cc3e8a178bab2635e569a37bf2a879fe9cfbf4ecd47e82fd
MD5 d6ff733015e0e978a5c4081293dca9ea
SHA1 1c32df33c5c6654f7c6c902d9cbc8589441614a4
SHA512 dd634be3c003a23db4a7469d7e83d602e4802575af4c6305690f285073a7abd2b9dcb659cdff42b6a8a0582d155296428cde1ad40cc6720cbef02a53f52595d0
SSDEEP 96:xHa4qGqId9zvX6ElW9Fn2VKYgfK3Bw8h9cnx:sTRId16ERVKffkBw8hI
TLSH
T1A1912E78A544CB6F69B5776CBCB48C71AEB2027B767F688610B58484010CF3846F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 d725f729d2924ada2b01b862f07f78367b5da04df74614b1b7b30b61367bfc1f
MD5 3eb93e741dd90e14f9dd010e22b613a8
SHA1 736deb5c09a62132b3882d8e172d064def79ff88
SHA512 ef08fcc88becc83281ebcae5c870412df65beabd5c80e9b96e10ef6b473683f70b791a3093c0b0070c28999170ca749fe14a28810904d76f50d2df7ffa2e3273
TLSH
T1F441EBB955458F6FA8F9336CBC2804619EB2417BB67F288210B48484000CF7846F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 32b5efb5be261ad037850af2b14208d29703f15aa665f725e9a81c63c60c9378
MD5 d7e5d307865fde7b2c5b02e272f69a71
SHA1 3d37ba7e369b63002f347d3c1f55e41922e28f58
SHA512 aa458bda5f71c2975106b3a240309096da9d42a17e1005dcc4bde2b7e014c8a16d637cf5219b5532e735d40088b2473444e198deb31a31b6770754b009e9c327
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B04ZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWVyh44CfiaR/skL0H7
TLSH
T17023348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-2316-0x0000000003030000-0x0000000003602000-memory.dmp

Download

memory/760-2310-0x0000000000CB0000-0x0000000000CB3000-memory.dmp

Download

memory/760-2317-0x0000000003030000-0x0000000003602000-memory.dmp

Download

memory/760-2312-0x0000000003030000-0x0000000003602000-memory.dmp

Download

memory/760-2315-0x0000000003030000-0x0000000003602000-memory.dmp

Download

memory/1416-32-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-31-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-10-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-9-0x00000289AF6B0000-0x00000289AF6D2000-memory.dmp

Download

memory/1416-124-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-0-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-1-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1416-416-0x0000028996710000-0x0000028996720000-memory.dmp

Download

memory/1432-40-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1065-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-82-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-125-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-131-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-374-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-373-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-375-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-390-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-389-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-391-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-76-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-419-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-425-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-426-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-428-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-43-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-39-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-470-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-474-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-38-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-491-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-37-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-36-0x000000000A130000-0x000000000A17D000-memory.dmp

Download

memory/1432-35-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-34-0x000000000B1D0000-0x000000000B84A000-memory.dmp

Download

memory/1432-33-0x000000000A5A0000-0x000000000AB44000-memory.dmp

Download

memory/1432-30-0x0000000006260000-0x0000000006282000-memory.dmp

Download

memory/1432-580-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-654-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-29-0x0000000006210000-0x000000000622A000-memory.dmp

Download

memory/1432-28-0x0000000009E50000-0x0000000009EE6000-memory.dmp

Download

memory/1432-27-0x0000000005C20000-0x0000000005C6C000-memory.dmp

Download

memory/1432-26-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

Download

memory/1432-25-0x00000000055A0000-0x00000000058F4000-memory.dmp

Download

memory/1432-17-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/1432-16-0x0000000005400000-0x0000000005466000-memory.dmp

Download

memory/1432-1064-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1066-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-123-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1071-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1074-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1072-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1078-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1081-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1086-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1087-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1089-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1088-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1085-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1098-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1104-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1107-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1111-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1114-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1115-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1118-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1119-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1120-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1123-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1129-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1168-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-1204-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-15-0x0000000004C30000-0x0000000004C52000-memory.dmp

Download

memory/1432-14-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Download

memory/1432-13-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-12-0x0000000004620000-0x0000000004656000-memory.dmp

Download

memory/1432-11-0x0000000004790000-0x00000000047A0000-memory.dmp

Download

memory/1432-2319-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2318-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2327-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2329-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2330-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2380-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2379-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2378-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2430-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-2433-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-3008-0x000000000A270000-0x000000000A330000-memory.dmp

Download

memory/1432-3009-0x000000000A270000-0x000000000A330000-memory.dmp

Download