9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
Size 897KB
Sample240213-d3f53shf63
SHA256 9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9
MD5 6099a8fd5e1e9b9a92139992443f93c1
SHA1 3f5d432455f9bc1bbff44429c916ac8113c3f380
SHA512 144463243bd0cc619da2204f750b34fa4dbeaa9cfed9fd397a033fdf041600083047a07d16927ce9a3ba2515eb7ff667112f48c0ab22fb71c4862aecb24f0dcc
SSDEEP 12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgazT2:TqDEvCTbMWu7rQYlBQcBiT6rprG8aH2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3336304223-2978740688-3645194410-1000\{C0DD2BCE-6412-4AF7-B207-0876710F7F31}	chrome.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
5508	msedge.exe
5508	msedge.exe
5516	msedge.exe
5516	msedge.exe
5564	msedge.exe
5564	msedge.exe
3040	msedge.exe
3040	msedge.exe
6292	msedge.exe
6292	msedge.exe
6900	msedge.exe
6900	msedge.exe
7068	msedge.exe
7068	msedge.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
5244	chrome.exe
5244	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
3040	msedge.exe
2792	chrome.exe
3040	msedge.exe
2792	chrome.exe
3040	msedge.exe
2792	chrome.exe
3040	msedge.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	3520	chrome.exe
Token: SeCreatePagefilePrivilege	3520	chrome.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe
Token: SeShutdownPrivilege	2792	chrome.exe
Token: SeCreatePagefilePrivilege	2792	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3832	firefox.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3832	firefox.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
3832	firefox.exe
3832	firefox.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
2792	chrome.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3832	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4008	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	84
PID 964 wrote to memory of 4008	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	84
PID 4008 wrote to memory of 4892	4008	msedge.exe	86
PID 4008 wrote to memory of 4892	4008	msedge.exe	86
PID 964 wrote to memory of 556	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	87
PID 964 wrote to memory of 556	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	87
PID 556 wrote to memory of 2432	556	msedge.exe	88
PID 556 wrote to memory of 2432	556	msedge.exe	88
PID 964 wrote to memory of 2308	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	89
PID 964 wrote to memory of 2308	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	89
PID 2308 wrote to memory of 804	2308	msedge.exe	90
PID 2308 wrote to memory of 804	2308	msedge.exe	90
PID 964 wrote to memory of 3040	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	91
PID 964 wrote to memory of 3040	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	91
PID 3040 wrote to memory of 628	3040	msedge.exe	92
PID 3040 wrote to memory of 628	3040	msedge.exe	92
PID 964 wrote to memory of 2044	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	93
PID 964 wrote to memory of 2044	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	93
PID 2044 wrote to memory of 1708	2044	msedge.exe	94
PID 2044 wrote to memory of 1708	2044	msedge.exe	94
PID 964 wrote to memory of 3648	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	95
PID 964 wrote to memory of 3648	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	95
PID 964 wrote to memory of 4640	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	99
PID 964 wrote to memory of 4640	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	99
PID 4640 wrote to memory of 2880	4640	msedge.exe	98
PID 4640 wrote to memory of 2880	4640	msedge.exe	98
PID 964 wrote to memory of 2792	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	97
PID 964 wrote to memory of 2792	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	97
PID 3648 wrote to memory of 4312	3648	msedge.exe	96
PID 3648 wrote to memory of 4312	3648	msedge.exe	96
PID 964 wrote to memory of 3520	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	103
PID 964 wrote to memory of 3520	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	103
PID 2792 wrote to memory of 868	2792	chrome.exe	100
PID 2792 wrote to memory of 868	2792	chrome.exe	100
PID 964 wrote to memory of 1464	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	101
PID 964 wrote to memory of 1464	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	101
PID 1464 wrote to memory of 4152	1464	chrome.exe	102
PID 1464 wrote to memory of 4152	1464	chrome.exe	102
PID 964 wrote to memory of 4664	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	104
PID 964 wrote to memory of 4664	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	104
PID 3520 wrote to memory of 3928	3520	chrome.exe	106
PID 3520 wrote to memory of 3928	3520	chrome.exe	106
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 4664 wrote to memory of 3832	4664	firefox.exe	105
PID 964 wrote to memory of 3544	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	107
PID 964 wrote to memory of 3544	964	9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe	107
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108
PID 3544 wrote to memory of 3036	3544	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe
"C:\Users\Admin\AppData\Local\Temp\9d6e803608352225b79cc75bf2f876703124a268ff193ce6ce7d30a6b2bb0da9.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,808141929130008911,9910634198133224170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,808141929130008911,9910634198133224170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0xd4,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,16772498769145869688,6118217787310672607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1448,16772498769145869688,6118217787310672607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3312873503066806035,10181028681392520856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3312873503066806035,10181028681392520856,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1864774190115527557,4806332865887751502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4032 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3534586156049477227,5538928677501139401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17498339229292881883,10472865018521433541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9da9758,0x7ffac9da9768,0x7ffac9da9778
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:8
    3⤵
    PID:7592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:8
    3⤵
    PID:7716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3936 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:8156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3796 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:8120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:7992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:7980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:2
    3⤵
    PID:7572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4588 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3832 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:8112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3112 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:6428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4568 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:7784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2956 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2736 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5960 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:1
    3⤵
    PID:8612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5992 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 --field-trial-handle=1880,i,12432376831985063308,9373700267077103630,131072 /prefetch:8
    3⤵
    - Modifies registry class
    PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12630812406986505031,12887185564780421286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac9da9758,0x7ffac9da9768,0x7ffac9da9778
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1984,i,4923288339833564487,7362583829609339213,131072 /prefetch:8
    3⤵
    PID:7904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1984,i,4923288339833564487,7362583829609339213,131072 /prefetch:2
    3⤵
    PID:7896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac9da9758,0x7ffac9da9768,0x7ffac9da9778
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=1908,i,17490661855564432733,14960530563592829813,131072 /prefetch:8
    3⤵
    PID:7776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1908,i,17490661855564432733,14960530563592829813,131072 /prefetch:2
    3⤵
    PID:7768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.0.1379865510\1241644922" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09a619db-434d-45ac-81e1-ab50f24fdb4e} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 1960 1f11490dd58 gpu
      4⤵
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.1.2110720897\1620849030" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2392 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e484480-872d-4769-8698-e737d35e11ad} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 2428 1f113346658 socket
      4⤵
      PID:6616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.2.668536706\380266338" -childID 1 -isForBrowser -prefsHandle 3348 -prefMapHandle 3344 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d049d024-f4b1-4994-a1f3-48a3011c7826} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 3460 1f117454858 tab
      4⤵
      PID:7236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.5.559032153\2134450848" -childID 4 -isForBrowser -prefsHandle 4452 -prefMapHandle 4456 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aba8cf8-f4a5-4dfa-8f10-b7e79c5b60d1} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4444 1f118044958 tab
      4⤵
      PID:6692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.7.1730764203\1555651369" -childID 6 -isForBrowser -prefsHandle 3476 -prefMapHandle 4992 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {832cb998-7f19-4983-9e7b-adc4f5915d43} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 5004 1f118f06f58 tab
      4⤵
      PID:8376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.6.1778134601\1742151721" -childID 5 -isForBrowser -prefsHandle 4704 -prefMapHandle 4708 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1e980bc-4aa2-4d73-8f4e-35898492c8d2} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4800 1f1170a7c58 tab
      4⤵
      PID:7856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.4.1831582610\1124143910" -childID 3 -isForBrowser -prefsHandle 4244 -prefMapHandle 4248 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {332c5614-f864-4cb1-9df2-b9bf2e7a60a6} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4232 1f118043758 tab
      4⤵
      PID:6876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.3.2017393206\1883735084" -childID 2 -isForBrowser -prefsHandle 4076 -prefMapHandle 4060 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bec853b-b1d3-4a94-b5c3-079896148413} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4100 1f106f63b58 tab
      4⤵
      PID:8072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.8.235485564\2065909547" -childID 7 -isForBrowser -prefsHandle 4680 -prefMapHandle 4260 -prefsLen 26565 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ddb8ca5-8381-41cd-bf7f-00ca369bb569} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4672 1f1170a3858 tab
      4⤵
      PID:3948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.9.600336060\743207493" -childID 8 -isForBrowser -prefsHandle 5924 -prefMapHandle 5920 -prefsLen 26565 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3632acc2-7bbc-4b22-912f-4a33abfc63e2} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 5932 1f119b58f58 tab
      4⤵
      PID:8404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.10.606068856\2131906439" -parentBuildID 20221007134813 -prefsHandle 5932 -prefMapHandle 5748 -prefsLen 26565 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbc891f8-78d6-4ef0-8398-aa4da070f85b} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 6012 1f119fcbb58 rdd
      4⤵
      PID:7528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.11.854895644\1159003681" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6084 -prefMapHandle 6040 -prefsLen 26565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b3b4d60-cfe5-4885-a503-16a8829a80ba} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 4260 1f119fcbe58 utility
      4⤵
      PID:7544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3832.12.38670317\2102549820" -childID 9 -isForBrowser -prefsHandle 6520 -prefMapHandle 6412 -prefsLen 26565 -prefMapSize 233444 -jsInitHandle 1072 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f1ad361-b47f-4560-b8be-3d7011c11b32} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" 6516 1f118e9c458 tab
      4⤵
      PID:7104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
    3⤵
    - Checks processor information in registry
    PID:3036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
  2⤵
  PID:3468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
    3⤵
    - Checks processor information in registry
    PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac9f046f8,0x7ffac9f04708,0x7ffac9f04718
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:8164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d0446be9d39a2d354b4b305057a249a8c639b7c1cca804e380d4c71e56815b7d
MD5 e1e06f1bc2ea8efe486919db850c7c4e
SHA1 879c89d09ffdd29a18d65540f5caa2454795a89d
SHA512 bc5c8d6ed0484f7f1814927a562c0eda12b856f97082be04d8ef99700a99dacb361bf83ca6db5ad4531bc9b1bbc20cf97e943b500f24e13784b6a4e375b73c45
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f2f65cae4e86e8e7e6338b3c858bc9d9123d350801ba055886fb2600a8cb35aa
MD5 801024ada32edf4b80f95b1defdeb5e9
SHA1 318163a4db91e691c658094862931ccd837b287f
SHA512 28ae6556d1125ac22a49f7c698a1d1b6652a2f59290b12d065d126c673459e90f98d7475343cb94a3a31271b13b713b4a4339b72016bf712e04aed13ccf38291
SSDEEP 96:Z/jIFRXKd5oTKIwR8iZRy7Di+6MsmdeFIOPTkjVhYtjEsXt0/cg2Vup:xiRaroTc8syy+F0iotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 a495fb1f69777fab8943da388c8777327cec98f8fbb64a2488c7f9ace06fed4d
MD5 c7c0ab8d144f22fb971b07f53ab0d7b0
SHA1 170a8f1b87771d47968c76f74c6815da411ac00e
SHA512 989ccf09377a9ab816fdccf8028912225d0c6a9d05e44f7d82d6a283f121f84156b2ad1a63c416c9806d2f6cd517000cadd6e7bca554b10b2965142a4ccac5ac
SSDEEP 96:Z/jIFRXKd5oTKIwR8iZRy7Di+6MsmdeLOPTkjVhYtjEsXt0/cg2Vup:xiRaroTc8syy+FQotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 64KB
SHA256 9cf6224cc8fab4958493d816c9a43399b578d115d32a44fa4525d34a6cfb8d9c
MD5 430469b9cc6f10b92f74f6f3273ac08b
SHA1 6a993c9cefa535f64c8d1120cbf816f8ac18dc03
SHA512 2e4e6c692202002b1f14cfc4a8a7e78231dfbe3ba4edca94ae1db433a12f812800eb93c4699a64a907d8bdb8db8f27cf3fea2ae1f8af228e95211f2c12d638a0
SSDEEP 1536:sYSHjl+/yVExdd3ExXH7fNtteR93iNAd+cce6MbJHu3D:xSHjl+RZ3ExBmTyNAccce6M1OT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 c658e2ab6a0c7129336b346c04c375a5ab4333891b31795a52978c5879e4d2e3
MD5 a5dcf783d531279c472b7a18730dab95
SHA1 96c671c8a95bdfad91dcf378f1113d1f61f396d8
SHA512 66345cdf5e050ecaacc63cc9f47f31f3c7c242b584cc4b351f12ffc9b729ee0f27388c46e35a9b497284fd59d566d08d077a5ddc63e120c7bcaa20b4aa34657e
SSDEEP 3072:xSHjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCt:xuB+70xBmboJnf9/To7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 8b7a1b81fbda073d27961498ed2b75d536f0d78a2818abe6df9f454fab4901ea
MD5 1dd2a566e0b02e5e3bff27171872036c
SHA1 ea3a6e5c4a860948be89bf9cf78d871003505624
SHA512 f68ea90d44c7c56c7c28e6404c6d616bd27be3e4380da6982a7e0a9e1f2d879172a53466ff185defa55c2d380e52daa5d65738fd494e3139bb6639e4595a5896
SSDEEP 3072:vjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCt:vB+70xBmboJnf9/To7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 2c529a5a80b5928c2d356cb68cee6a3b69ea4846a4017dd73baa8d57f38e4f4f
MD5 2db49a49418291f2ee1a233fffab5678
SHA1 26c0fd513fa5e6395ce7275c8d601dd3705f09ae
SHA512 59cce8f734304433539aa3481113652bdd9ec2db831538900b05fc2bd1cac3df3d65dbea76669177f66280b74a1e81b7d84b5934886189552f170c986406e850
SSDEEP 3072:5ejl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCt:EB+70xBmboJnf9/To7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 7ca5a3ccc077698ca62ac8157676814b3d8e93586364d0318987e37b4f8590bc
MD5 265db1c9337422f9af69ef2b4e1c7205
SHA1 3e38976bb5cf035c75c9bc185f72a80e70f41c2e
SHA512 3cc9b76d8d4b6edb4c41677be3483ac37785f3bbfea4489f3855433ebf84ea25fc48efee9b74cab268dc9cb7fb4789a81c94e75c7bf723721de28aef53d8b529
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

96ff7c84-1da3-4ec3-a7ee-0a28cea25c63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96ff7c84-1da3-4ec3-a7ee-0a28cea25c63.tmp
Size 2KB
SHA256 3c9f8950d953084f0bee853dd4474988eafa6231f0eba519324ac2cd4551850c
MD5 f9a36eb1d7a2a7cbbfebde3f43247532
SHA1 0433562640a05cbfc48da29fd34963459aa85836
SHA512 40c51e17b89f6a9667d9a03cfbbbaac474259e50a64ac89f8ccad93b3c310cd288ec3b8ef383dc927a87fb78d04a86990fdfaa0989e7d8307fc5f78529fdb7d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d454afb2387549913368a8136a5ee6bad7942b2ad8ac614a0cfaedadf0500477
MD5 66b31399a75bcff66ebf4a8e04616867
SHA1 9a0ada46a4b25f421ef71dc732431934325be355
SHA512 5adaead4ebe728a592701bc22b562d3f4177a69a06e622da5759b543e8dd3e923972a32586ca2612e9b6139308c000ad95919df1c2a055ffd784333c14cb782f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
MD5 84381d71cf667d9a138ea03b3283aea5
SHA1 33dfc8a32806beaaafaec25850b217c856ce6c7b
SHA512 469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 2478a1271b5be95651d954689a8309580df2eb521f87fbf6b0caa86939b484ef
MD5 eb3f18fcaa13c17b3fddaa70b0efbdb5
SHA1 3e6eecd857e4d1e8e278d52e737e6bc4e5eb73e5
SHA512 d0651b3f9ff7bbdcdc3139441b36f1e3cf708443d7f379586f621af943518860bbfd14c625586f4834ed96c7a9d7f281d2ed051d9b447ea06d6acadd60293667
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 334B
SHA256 1c856f59b49e16ea4fbe3d2047b22f066027ac51c32c28fa01202e43c2d03742
MD5 3239677ea1e2ef3a3b4b4e023b4c1701
SHA1 053ce423c60ddb0b5e484dd7add6c50ae63fdf79
SHA512 112759f3d25ae2d88dcc3c0912ce81221e65afa72f37ee9b62163ffeb2ea95c54e3b2cbdf896e0ad9a071115ad3a9df1b83862c6da72c4dfa5a19ac0a147363e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c670ae057ac1c8023397318d29fd00c87a96b8218254c373cf8fcaaac148029a
MD5 3d6411681540e450a4f9c7bc15d32668
SHA1 59214120f118bb2ff09fd26346aa8b6107f7fd16
SHA512 979deb80eaaad40294edf76712066e94ef0a0eff32f912aaa2ef6f70c6e5bda80f755b8cc28340ead2f578e4ad34a53a2c23fc706c5b71e4e654547b267da0e5
SSDEEP 96:nRkdGY1n0nMwpvWMoiVmde5xeDSG8glUWQyV+VDCAiEwb:nRk/2MGWMpxI8glrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6f241f4b7503cfb248c09fd003f4d21d69c198fe5f4e537a4ea35bae9fb264b2
MD5 4f8c7a8e58dca74d6c13668730519c90
SHA1 114d5ddc7e17407e2715a14f13d64939873e3665
SHA512 6bc71998ea27bfdbfc2d55ab655fe3b7a9b13ef93a736696c6531cd9858f04bc9f610a303351061df24766db02704ab8f39fade142260526f8280b87d51834ae
SSDEEP 96:nRkdGY1n0nMwpvWMoiVmdeHeD58glUWQyV+VDCzia:nRk/2MGWMX+8glrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a17183df76096a1570cf4d1681b31262b92424829caae605f59c5f81223afe4a
MD5 6de2ffce66d98f0facd0553ea3996a61
SHA1 736d4deb0c9627ab188e782800f810a1c11923a0
SHA512 3ab649e5552872c715a41ca172a48c043a83decddf091f10bbb099ccace229af251e4f78b89b5f5b4b763ddcc9f5fee06f85b684379f25decdae1d20ad4e9784
SSDEEP 96:nbkdGY1n0nMwpvWMoiVmde5xeDSG8glUWQyV+VDCAiEwb:nbk/2MGWMpxI8glrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 ce08ba2818c35a1659c72379465c6d4de82abd7bb8936888ce50f8ff561e7079
MD5 559943337459e0afc20aeeb8304aaa4a
SHA1 8b47380998ae8bc2d609b4ab7111eeffd4a792d5
SHA512 a66ef4755367eb2227278d019109371f7d0e2d129c0c4209d900970ca7d18098931e0b49a8d34ca67402a8dabfd7cfd8c24743f48f255d417b4da07dc0262fce
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 063b75c1f563b40741bbf7f8ed2751f425f440c25852b82b7ac3e03e88784db2
MD5 ab04ff3a16bde854859d93717ae487e9
SHA1 552c0aac74801330cc0cac5b12e159b25e9736e9
SHA512 48ec81b9edd4d76da0c2ccd7100731b997c581a09a5f1218e6e628c197edf96f138a9580a2d95a17fe4663d81a316401c8898bee008740061d5a3aa1655dd453
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 ab8c81d8fc7436d6cc28952c7df15d1c7a7fe0ee44c20d7104af06f365266a4a
MD5 6735c581542d9bf5e134e6f09a5a4aac
SHA1 8d9d4e9f78e2923b6a4eb853d8c8ba1935f9687c
SHA512 18790bff82d4e0fb42d306f37de778cf69ae51060ec227910793d789dfe2ed8bf92074cacc35360decf6f4af281d28d8f00903344b57c13d5923f504a9a22980
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 221fd16d752f6546c8aa35caaa8e81a275b28a3c19cac53a79e770ce46ea2978
MD5 4a81ecb4b6f5171e25af5b097dcc0bf7
SHA1 985755d5357bacc0490de47323b1df8650801e42
SHA512 64322f45b05b18f838222ffb90ba1c60d5b7a5eb08af41dda2f35ff2a65f31d9f2cf8f43135675296d9a1bbfd4e288a0a5fd2bbb66e42baa7e5252b12cf3064c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 f5229317aba13520891b98635ae597e609d67cbaedf40606e93e1d2e1ebde967
MD5 a1c2288e089e96f9f99bbd7f38fe7553
SHA1 c515ab9bdf97ad45a91a69155425517a203ea53a
SHA512 1ceed83fef346dcdaf3086584bc2052e41faae05e12a73a32a2542b179e692aeb15c2782d5a99c14961c4f350a2ae686ed3379b1e7c9bed0ebeb999d04dcebd7
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 c5acf85b6f392a9cdf8609ae0e59f031b5321ea61921439e408723af86135728
MD5 915bd4f0a1816ca914575d454f58ab86
SHA1 cc60e9241ba695437748c4b7d3b5f2458f898faf
SHA512 03a81bee530de0aa65094f45a5492c8f09afceb80a47bc611f1a041866539c1b4699bebfb994fbefb8e253c47cc49f7361caf1949d6b9982ce8b1e2b1ce51092
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 fd8bd1a4a906938d1f0d880765d5df287f86c9d40be606663a8f30ea660353d1
MD5 43fa4fb12896e8edaeb05398dfb8c42c
SHA1 db8695a1a4f0c9de95d694bb211ad823f71ebe0d
SHA512 9d34c58fc613524f65ee0c66639ec155e9322093d826d27aa9dfcac86eb2e943c355cd930004775415011ea8a68e4e8091ab75915c3dd2abffca5f1259ae1655
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 3ee49a2b34c283affdea24955a4889353d181cfbdb63e2a02436b24a7e2a551b
MD5 ff991f44bfa670f63ef4a16b0e11d002
SHA1 1cf8836ee7818e19a9c51352021c9b787054526a
SHA512 0c6321d30367ce0579e0724026efba9fbfe1a9cf3086b6540f98efd7d0fdbb32644a588dcec164ef33e866e48548b590ac326a0bdebbe6dfe39fab97c693116f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 d47c42fee99e9f63275c20e77e9318653276eca84146c4d4ff9d053ff2ccbbb5
MD5 19d869782292106b41bd7c1e3af38d18
SHA1 45188f4f440819a01aef5aca2020654cc061ca2a
SHA512 3a5aa4fd5c9834fbd1cb20d5b1524aeee64414f46b20819a39d3727b8034f739e7a1eb58370eb4d711db440d019fc7c974cf07991361b9ae1c83be24e7f200a9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 3KB
SHA256 630ec0f78d5e89b58d1236308eb683c1c46c581dd018352a45c98665298f76b1
MD5 a4f26b457539f866acc406621247c701
SHA1 f57cd4b5f4b9f06061033bbd3d7f6f87361acea8
SHA512 ab38a00fc96de8200e45b17ed927ad0e907303ecfae33880e0585e4c27c160ea6b4e0dc5b131a364e55746fe07787e5244da420473cc980473e31f433fd074cb
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 5645f8c98aa49546669ea3fef410a7bfc0e1388edbdcc2179123bafeae71e9d6
MD5 d18b646ab42e3d2790b8400ce0f35c0d
SHA1 06f7f77f5f500b381c7089acd0a9ab20c3a3a958
SHA512 20d110f24aa4c5c04e8245c4945f508c1ead3168b9952f21fd5780bbe5ad25aace97edee514d1145a87d9fcdbd8c3e3c29782f55396ed35b42ac134c71a884c5
MD5 SHA1 SHA512

Submit Download

4832D199584363B876D3E7D57CA02A9B0F4D91CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mlil8stk.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD
Size 13KB
SHA256 11a718717741959ac5300f22fb30eabb6f3cc5310a37391d14ceeaa3d8ed3b98
MD5 8cfe3b0fc443525f200d802d497c2dba
SHA1 3e5a0c6ec73988bc216a3a191150b1a6235c3a20
SHA512 360bbc001a684c9b14625ebea67bc39bd924cdc629b19d4aee5938bb808489c40ab6fb698c411291a07a075051266e00e849db3ce053a5b00331253a95490506
SSDEEP 384:Hhyu9fiGLm4pUd0DuDyS4uWg938+iLO4O0lpDII+r+9:FBi8mCUd0DkyS4ub9gLOwD8Lo
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 d1310f29a678682cb0f3329a66e0fa27e75a44b19abb0f4833e829ec7f78c506
MD5 47fc308828387791f702110391b47312
SHA1 ebb2619d1b442d0da49ee5f9dd1782918cd7f873
SHA512 cd64fcab188edbd999f31ae92bfaa54e9b218c9a96344ef820b9258a369af1021337d5c90cbeb6fd13302f4c06d854450e948bfd7f2b6da8bfccc04dab8e4380
MD5 SHA1 SHA512

Submit Download

1ecb4bc4-9ccc-4581-8766-23846ebdaeeb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\1ecb4bc4-9ccc-4581-8766-23846ebdaeeb
Size 11KB
SHA256 fa3d9ecd80939dd1be32795e945721f360db2b2c82cb7a81e0633c34272ed26e
MD5 b356f0dc268351c0ee7c321a85d9311d
SHA1 6cbcd59885970864d406507392176ebd51fc6476
SHA512 c0295b8ce065ea458d7fd36305b0d956ee763e7f326963a6bf58f8461fd46a2a28b33cd30d48196bee175b92de06cf5dd0100125f0784b868485bac4560459fa
SSDEEP 192:NGGqDTqMLph3m1fwyFC/CN+xlBBWpicMq2D1LTmtzBC1jiU/zMjM/UtKV7Q/+rxp:klPqRyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f016cea7-98b6-4374-baf7-31a49f3afd8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\f016cea7-98b6-4374-baf7-31a49f3afd8d
Size 746B
SHA256 95235f05bc1c965cd25afd1c9615916c19f64e8f95652ebb179d14f6ebed32c4
MD5 788ab431468704e8749c6c2f5b30ca06
SHA1 d0dbe9719a57ba0c646f7352675d5997f2740edb
SHA512 2689c53b60da987f8a971e91ea533f0919c72e7710023d3be59bfcf6484a0dba873fd82a03cdb626b67f4843b9978fbc69f1b99f05d8ac45cbdb39e76d031c8d
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js
Size 6KB
SHA256 fb3a2a57a9271c23aea3275a3f06d91cbfe6fdaf4d84d3a4507ba5d6336c3740
MD5 9c4604eb41db743d3dbf99f5a436c4eb
SHA1 a798f134cf5f00ec36f49ab1506a1afb365c0dd9
SHA512 69f98894a072253b0933a03de4ef9dde79a91b8940add2f84cf7405d3831ee084f2e1b4203b1d7ad5e1ef4b0c77f8e2e0bbad36d166071443aaca8f3b0425336
SSDEEP 96:xHi3mXnUTeqGqudN6ueOTzSBPXAnpjWH+/A1fBw8HdER:RXnIRudN6ueTPX/+o1fBw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js
Size 6KB
SHA256 38bb7dd6374a9a05d2ed85e1dc02135e1eb0cfa567f98faad89701207280092e
MD5 057d2442a24711b081dc80add11d519b
SHA1 ca28c602d4863535879e6440fb914e7d02cb8667
SHA512 5ad59f1a8de2515fb0b095f599338217f3ab3b34ff2208b841b9ef8c65e965bfd454c11aa6443e6666a10048d32a13c0ebbe6e029548b9c0dcfeaa7a0f86f121
SSDEEP 96:xHD3mXnUTeqGqudN6ueOTzSBPXAnpjnH+/A12Bw8HdER:MXnIRudN6ueTPXE+o12Bw8H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs.js
Size 6KB
SHA256 232084090a08756cffeb371d84864daa07eaa357f5153cf056318e60aeb057ad
MD5 a1d4716d2ca6e26b0286757d879ee207
SHA1 e340614929b2d60cfcd2c158537e39fd9e47cdd4
SHA512 01d137474f1b32319de18d7f4b5a2575b32e9bd54a729ecd3ec02f606e6319997effe6194010f78e1f849530b7273ee1bdfaea9942355479750088e604343534
SSDEEP 96:xHi3m5nUTeqGqudN6ueOTzSEPXAnpjWH+/A1pBw8VdE5:R5nIRudN6ueGPX/+o1pBw8VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs.js
Size 6KB
SHA256 191a2ba72ef8b9f66b12e15cdf52a5e8d1eeab71e51ef65b38807f2b2aa42b95
MD5 06ad4d94f9ee83b4049761fae6b80686
SHA1 4c174c2ee466a2f60c7d7e61d266db154f6d655c
SHA512 36fdeff8533b924efc3f7f12c67ea39685dbcccc53800118d656aa86c18bdca000564e509de98c5b2f12be15f6aa86a55f9fd6398304325615ff7752a78ee4c3
SSDEEP 96:xHi3m5nUTeqGqudN6ueOTzSBPXAnpjWH+/A1fBw8HdE5:R5nIRudN6ueTPX/+o1fBw8HK
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 4beaae291aec60430b564d365956b2e2b882792bf85a256574083a841e0e6c74
MD5 1b208bce6563ccea3c3ee9876d39d518
SHA1 fedf63205fcf60226ef3baccbf2b6001583f01d5
SHA512 c651dfe9f03128a765122dd2702f23a928130714c303722d014528cf26fbd3f6a7eaf246a5f9bd224239cc6e2a01023586b319278a2dbd6136b5841e09fce666
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 775a9c52c25f1d74037dd39d21bb82f5b4982caeb4f2a0a3bfb054816cca0b8d
MD5 84aa7e8cad13ff94fe4d8c056c987ec7
SHA1 c5f74f2b105d98ff7c619ea334766d8dcb048a2b
SHA512 0795fad577cdf9043dde6320ff169e7a47584cfd218b01688700e307ae979564659843fe5836d7d518dea0137b429a583d7c74dc98de9a1b813a6e708c4384d0
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 0c21f01ba8bfc4b672c329ae4878b6292b3c977579c0077e6e59edf65dc33bc1
MD5 696ad6bc10a8b27548e7aee0aff4b491
SHA1 dcafa2979a5ec427e9ae1089d364cf02fca1b3fa
SHA512 e0b06041d1d6d00290f0bbf9135766d03d97820dd0bb1efba197e60927cee3be6d0e375494a2d79185164c10f146d6d533b65b6d10425ebe7b01a1f7dee7e0fe
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 f0293bbb055e8386508d04e56bb140dd8dfca1682d294a2c93dd92dd19897226
MD5 6117932fba109ee9d24862fbe9e6c3a7
SHA1 5ec2e98a48309d3b1a9508c2ebef7f5c9470f1e3
SHA512 0d05155b5651f83be97f1e30ad58ef196f2e3f725d56bca3e074521c4c7a6553a285cb7bd7dbf7288ef35e602bf63b693b79d04522c047ee2dcc56b26fe5d447
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8ad9a2701d04779375fa845feff764954a7a60ce3d9b851f2600e64da97f5a9d
MD5 d71f0900b3ec08e43cd004bf7ef9abc7
SHA1 ffd8ce0669bcca64a8b9f3f643a38decdcebd70d
SHA512 8ef00d5cb8e287c7f9d6855a36a9bf4a1a35e0bcf100aa1cf838c56d1a1f5b69c55c5a99d4f5f568816a4d8f934e6cb8e1254d5e66dcfb7609c20d196dcee88a
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7cba4447803517fb9fc2c5df75d8bba74198c86278afe7a2bb7df5fbe42494de
MD5 4f01c6bc3cf395ad5c1ed585fd4f419e
SHA1 4a868cdb70fa8c220f7fbabdb4f9221ff22c2f10
SHA512 9478b1b9ad990f86ee1273a1ff5d30275e697cd8d390867b4e29adf5a03be30f2f2cf84c1fb1044156a30c3e8fed3e643bd0615e65c026ef6f81ac3c2076460f
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 85d704f0b21cf1774528ee0dfa6805514267f811af5d5f7c903cfbe17ba62d51
MD5 fc8448448bd69898d4ebe0e6f50ef986
SHA1 232f63243afaaa2489fdb6f3ff7043ddc2e71cd1
SHA512 9ef60e550fc99af5630270196d9d2678c4e0c50ca4e37edb79f30c0e8a4d6be16588d6c4618d252558782d0618a64bb78ce4fb271b865380c190f86cd88414ba
MD5 SHA1 SHA512

Submit Download

{582d2abe-90a3-4bed-9fae-4c602ea5716c}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\cache\morgue\108\{582d2abe-90a3-4bed-9fae-4c602ea5716c}.final
Size 3KB
SHA256 b95a445bd9d295276e8423f1ad3fc50c740512a634f2115364217544bc87d44f
MD5 5b0f165bbdb71faa1bb5b26c4f022e96
SHA1 704bbe81e0d8370e675246e1cbb347bf8599aa45
SHA512 6c521b2c55135ec98f79193bf9c62b73cfb1801cdeed03a9871878f677aacea46cae165a4290682768ca1c1192dff2e87b63c39228164d72d2c7abbe732f8d20
MD5 SHA1 SHA512

Submit Download

{756599b1-cbdf-440e-81f5-7d178b1ab10b}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\cache\morgue\11\{756599b1-cbdf-440e-81f5-7d178b1ab10b}.final
Size 231B
SHA256 dae4dd8e56ccc952312b3b238a1db294d4d7ad4f532c31cd1c2e5f9dee881678
MD5 45e25bb134343fe4a559478cd56f0971
SHA1 79f18ad0b7e3935c3231ced0edd8ea3c7997ca93
SHA512 9b32b125c4183fe992630bc6ce9a511157959556fdce53f8264aba2aa8fb7b0e53b408b505da2cc96cdec771470927e74cba3bbd6eb71a5077e9f933cdc85292
MD5 SHA1 SHA512

Submit Download

{422e23e5-d30e-4a01-b7ed-7b5cc1779744}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\cache\morgue\68\{422e23e5-d30e-4a01-b7ed-7b5cc1779744}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
MD5 SHA1 SHA512

Submit Download

3173457586yCt7-%iCt7-%r0e7sap2o.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\idb\3173457586yCt7-%iCt7-%r0e7sap2o.sqlite
Size 48KB
SHA256 bc498aa22e53cce66e99aa5cc5008c6d39da0b1dd8f0a65c6bec8f592224d56f
MD5 ac173de80e38994b068de77c3a5f6be7
SHA1 e3a4dcedeb552f08069595eaefcbb9387115d346
SHA512 3958372982a086c25aa85948831ffe2370ea031fe2df08e7eb60c8e0cc5eb123fbf00b89631c361614611246f255531311733c9d39755586ba89ca9f795b615c
SSDEEP 48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEVs:D16S6CKnqlizbxV+2xVeU7X2B0e
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 4cc6fb76618c2e87f5a417f7579d5b046aabd3d10789002adcdb2f6e38d2de13
MD5 9fcdb06d89a678ea1e187949d818485d
SHA1 ed28e800f4bd95beb601c0f6105745b179db2211
SHA512 3043c0658a45056b82b438292cb1ac77249e89b72d0bf57248b9b9a57abde77604ab15f253af1dbc954a03dd87460521e56a4f389932c7917656c0956f1b478e
SSDEEP 3072:jMcHghRuFPn3y3gE396i6uacMKeHrxsSq:jMcHghR0/3y3gO6uacMKeHRq
MD5 SHA1 SHA512 SSDEEP

Submit Download