hxxps://mega[.]nz/folder/LhESWKjC#1Gn3yqj6BwN9xRFfkdZA5A

Analysis

max time kernel
90s
max time network
91s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
19/11/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/LhESWKjC#1Gn3yqj6BwN9xRFfkdZA5A

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
8772	cs_backround_maker_30_install.exe
9208	Cs Background Maker 3.0.exe

Loads dropped DLL 5 IoCs

pid	Process
8772	cs_backround_maker_30_install.exe
8772	cs_backround_maker_30_install.exe
8772	cs_backround_maker_30_install.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\MSCMCES.DLL	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\msimg32.dll	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\MSCOMCTL.$$A	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\VB6ES.$$A	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\VB6STKIT.$$A	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\zlib.$$A	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\COMDLG32.OCX	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\CMDLGES.DLL	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\VB6STKIT.DLL	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\zlib.dll	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\MSCMCES.$$A	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\COMDLG32.$$A	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\CMDLGES.$$A	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\stdole2.tlb	cs_backround_maker_30_install.exe
File created	C:\Windows\SysWOW64\msvbvm50.$$A	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm50.dll	cs_backround_maker_30_install.exe
File opened for modification	C:\Windows\SysWOW64\VB6ES.DLL	cs_backround_maker_30_install.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0028000000045382-1227.dat	upx
behavioral1/memory/8772-1440-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/8772-1462-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/8772-1461-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/8772-1577-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241119185246.pma	setup.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Uninstal.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\cs_default.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5de9d588-fae5-4c89-975b-6f3387bec085.tmp	setup.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Cs Background Maker 3.0.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\cz_default.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\dod_default.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\hl_default.$$A	cs_backround_maker_30_install.exe
File created	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Notes.$$A	cs_backround_maker_30_install.exe
File opened for modification	C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Uninstal.exe	cs_backround_maker_30_install.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cs_backround_maker_30_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cs Background Maker 3.0.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\TypeLib	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\ = "{97177EBC-0C54-11D0-B407-00AA00C14969}"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ = "AmbientProperties"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\MiscStatus\1	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA660-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\TypeLib	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "5.0"	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\MiscStatus\1	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl.2\ = "Microsoft ImageList Control, version 6.0"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\VersionIndependentProgID	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\MiscStatus\ = "0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ = "ContainedControls"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog.1\CLSID\ = "{F9043C85-F6F2-101A-A3C9-08002B2F49FB}"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2\CLSID	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\ = "ISlider"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Version\ = "2.0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ = "IProgressBar"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "2.0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\ = "Common Dialog Color Property Page Object"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl.2\CLSID	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ = "ParentControls"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ = "ITabStripEvents"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\ = "INode"	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider.2\CLSID	cs_backround_maker_30_install.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Programmable	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32	cs_backround_maker_30_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	cs_backround_maker_30_install.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Cs Background Maker 3.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Version	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}	cs_backround_maker_30_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32	cs_backround_maker_30_install.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 339908.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
2340	msedge.exe
2340	msedge.exe
3292	identity_helper.exe
3292	identity_helper.exe
8660	msedge.exe
8660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	firefox.exe
Token: SeDebugPrivilege	1196	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	firefox.exe
8772	cs_backround_maker_30_install.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe
9208	Cs Background Maker 3.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4456	2340	msedge.exe	82
PID 2340 wrote to memory of 4456	2340	msedge.exe	82
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 2156	2340	msedge.exe	84
PID 2340 wrote to memory of 4016	2340	msedge.exe	85
PID 2340 wrote to memory of 4016	2340	msedge.exe	85
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86
PID 2340 wrote to memory of 1724	2340	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/folder/LhESWKjC#1Gn3yqj6BwN9xRFfkdZA5A
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcba2246f8,0x7ffcba224708,0x7ffcba224718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff60ac05460,0x7ff60ac05470,0x7ff60ac05480
    3⤵
    PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:6272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:6324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:6616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:7316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8764 /prefetch:1
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
  2⤵
  PID:7696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:7568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9192 /prefetch:1
  2⤵
  PID:7952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8900 /prefetch:1
  2⤵
  PID:8052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9032 /prefetch:1
  2⤵
  PID:8096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8700 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9232 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:7616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:1
  2⤵
  PID:7592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9812 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9928 /prefetch:1
  2⤵
  PID:7604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9936 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:8440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10544 /prefetch:1
  2⤵
  PID:8448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:8756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10984 /prefetch:1
  2⤵
  PID:8764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10316 /prefetch:1
  2⤵
  PID:9100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11232 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11556 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11680 /prefetch:1
  2⤵
  PID:8236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:8676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7820 /prefetch:8
  2⤵
  PID:8484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1000 /prefetch:1
  2⤵
  PID:8316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:8420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:8448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17166650864551870368,16659448447475321175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9688a2e1-aa7d-43e7-84a9-499822b00cda} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" gpu
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97db51a7-11ef-4e51-bd21-8dfe0e4be281} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" socket
    3⤵
    - Checks processor information in registry
    PID:1524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50d4d473-58ad-4e1c-b3ab-cebe3ed4cc24} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" tab
    3⤵
    PID:116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e789dd64-64fd-4a50-b814-ce1a4ef20db5} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2968 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 2988 -prefMapHandle 4968 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c14d92f-046b-49f4-b8fc-052c0f93d9cd} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" utility
    3⤵
    - Checks processor information in registry
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 5232 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1749d62-1649-45b1-bb7d-b359a82e941b} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" tab
    3⤵
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 4 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16f7901c-a163-4ba6-ba67-6873b281defd} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" tab
    3⤵
    PID:4464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 5 -isForBrowser -prefsHandle 5268 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {066a283f-ba90-433d-b58d-bfd14ca230bd} 1196 "\\.\pipe\gecko-crash-server-pipe.1196" tab
    3⤵
    PID:3364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x320
1⤵
PID:5296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8752

C:\Users\Admin\Downloads\cs_backround_maker_30_install.exe
"C:\Users\Admin\Downloads\cs_backround_maker_30_install.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8772
- C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Cs Background Maker 3.0.exe
  "C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Cs Background Maker 3.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:9208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Cs 1.6 Background Maker v3.0\Cs Background Maker 3.0.exe

Filesize
620KB

MD5
cab00bb5f231d7d654e99e9589fb614d

SHA1
6abf9e8686a3ed64f75355b59e108c4ca7e84b11

SHA256
b1b183c9fe34f37b48896c0b42dcb7f2c86e275ad27314c7a25b6410325957cd

SHA512
c99f5822a865faa046a504d4def5c5cd93237310165cf5527b529d8025f76eda28630cf8d47c5386bd1848d20881a019f465ac4a3a302105ed28a2ebe8190c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
36KB

MD5
f90ac636cd679507433ab8e543c25de5

SHA1
3a8fe361c68f13c01b09453b8b359722df659b84

SHA256
5b4c63b2790a8f63c12368f11215a4ffec30c142371a819a81180a32baeb2bce

SHA512
7641a3610ad6516c9ecd0d5f4e5fa1893c7c60ca3ba8ae2e1b3b0cc3a72f7f9bef4c776a1f2fc52f366bd28a419ae3594a6576e886e79a20ebd98b55b2acc967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c629d641a112e90_0

Filesize
229B

MD5
f8ed7582c3b2bae300908da40d625357

SHA1
ac132cffc418c334c4d5d709cc7edc8d29eb5635

SHA256
2ade261330ea9e66caa1228b35eb51bae9bf6712bbcd3e3639f4a5c3b61c20b7

SHA512
21f7cbbe8c1bebf4a5f03da51dceda4c0b0dc36398a7d76ad6dd0c0919be54139a942656d0fcca4f7dd5cab990021112a4fc1c8610dfb0fe9c33ee6185692a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c629d641a112e90_0

Filesize
23KB

MD5
33ea0ac2a3ba8db8ee4f33d6e0e1c32a

SHA1
7dd5a47aa2c0c8534ae9e77b2f8e2e54a0ec7fb6

SHA256
3c85603742cd0cef876ad7d81cef8452a15bb8aa439d01403852f0da0e87e8ad

SHA512
c5ac9d81f588c8883faf18e8ef19575b9c3bf65c67b7c475689aa991ab305604a648ee7e906a1b0243ebca68f82b0d699b1c42de8f20d710608f3af7ba0b68e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a07cc42ef40f632_0

Filesize
231B

MD5
f6f75e2e7da1264ca51bf7d4657badf7

SHA1
07f6d7c988bfe336c095faed5971cbff836d48d8

SHA256
a790a2215f8d25f82e2dbdb6bd65a5cc150fce2ccd8d5fff4dc1434d73a939e9

SHA512
2e48b4c633263aaa3b3b7e5868195f8b59b58e3e4c1550d30494947351fd8dec1bb2effb5adf32211e125e2eaa2920124944f4d760c1880e9197158a6717d87e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a07cc42ef40f632_0

Filesize
279B

MD5
52428ad0fb252a5ce44292e244c132b3

SHA1
d0f10232b10d759a857f5bc49126d6e1070d1333

SHA256
21cb1cae77c1481fbd6010ee4b3963532c9d577e0a043a9dd4a747178bba4ece

SHA512
43d403f61d05516257d42c1e02f0ae9413358fb054ea24e6830c5264592399b1b0e29d46e1e29f6280eeb5f6f3a15eb270ef24d1fc15a75ef3d4f20e358d1bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\758d5ee135cde4aa_0

Filesize
221B

MD5
89c963afa4d57a828a11df9d939123b7

SHA1
52dc75062b009e98b29110b9f7121619af04e6fa

SHA256
e481b353cb533b8695e1803b2dcafc9eabf76980ba7c38433c3994e53a954c4c

SHA512
9310b88d3bc6c0e12b64ad6f46e2487f4a1182c7a0a7f9599afc65dca32318592c64bf0f16bd274ddbf3d24ce2ff1ce574317fb86f486f2f46e4c135ead0a094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\758d5ee135cde4aa_0

Filesize
269B

MD5
23f02b53f92b812756e324fb34b5475b

SHA1
e1da334835260139829f079f71336accdcd62379

SHA256
8a71080befd1861828c403909e88eca87c43995e9af734808997c83b83de0b4d

SHA512
55f5570710467c8a5a6cddf3b6488c25e0e241795c0c1bbab60f1560aa2be018bfb4d8b57bf4f925772a048693e48b08e397bde766074ef0d099eadcfedb52f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\851cd677e79bb91e_0

Filesize
230B

MD5
c79e54ca140eb90a1d2a2c7725a8f773

SHA1
e83b3de64a05d5251705ea2135488d1017a6f54a

SHA256
4947c5aedb786c1760a7bd5b57f2f2f2e3f6f2221faa43581e61647acd9fcee7

SHA512
c3aeba636774bcbe82526c0cba4cab4181dfe969e91c046b378f63efff2c5da7472cf6eecbf20a87f7c229e3daa1ce571dc2e47925bd31179011988b4d46589e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\851cd677e79bb91e_0

Filesize
14KB

MD5
1273e7e8ab22986aa0047a289f02f15f

SHA1
29f8cf89dadc65a68f09f48e39ea083807457e5f

SHA256
2dae6dad88f955c86b9c786f42100b8f4108a011138caf0d6d96e8fa6ac0b4ed

SHA512
487f4e179c9d5bc6f9f0685ebea9d3a8376f4ebaea4240b323e43a811756523ee914970bc4b3b65381636f9b9ea9bbabe186983633069dc28330305312d94ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dc1b990aadf97f1_0

Filesize
155KB

MD5
524afcd03cb4a299ef5e0cf08986df9b

SHA1
f68cb57b35400c5e55aac221d813734cc9df53ae

SHA256
e0ffb250a2081bd60329a0da48eea12023e5895bdf0e507f2a19f1e62140311b

SHA512
827bfdebb2a8bb384492c95719c292b54da9f986d299117618f77e2d7cbc7a97c654d2e34f137e968bd55fc22d1ae32f72d0a5f632cdf3581f711c9dbd59d089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e4013ff0d839786_0

Filesize
226B

MD5
8fa2d14550d3239d9910da2a8d952823

SHA1
a2531368eec3038595f223e2e0340cf8338620e8

SHA256
b3486a8e45e830eb3a7e294c2c95cdc39d915ae98361106c59caafb65f9199aa

SHA512
532ae1341b9303339ac166c2832bb538154214434d29d30c05e0c7be0489dcdb8aee1d18b18dec9354885bc6aa1a8bfe378e90421ed04b05d2f36753ef3d68c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e4013ff0d839786_0

Filesize
54KB

MD5
39f0b38051675f30445244f749033f94

SHA1
7a44d2439c4419fa7677004c805d9a74e650dd0c

SHA256
b1d693219091dc58fdedbc6fc6d323064bb5299b0f79b1153d526b248129fcb6

SHA512
35a62af6448b5f400f2bb7382f3f4025de9650ddf64f81d3d0f469846d62414951c8bf8fb7c41a5508f3cae27a0ce5e153db247f48a6914b058b2e8b122b9eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b283f3e6d10b25ce_0

Filesize
340KB

MD5
9dbfddd3565345296e35974234c03ad2

SHA1
bf5921bdff9662ce29abaca2b502c19b5dfe9fc0

SHA256
2697f116c063e2bcce76be86ff657692120be3082f57ba085f6615f609337626

SHA512
537523dfd7edbe92ca5677365a310e4158f2db09a9e1e38bb615af288466bd46c031c853f38f196f64ef645460d1a19b7a8ff09c3a33b1d7faa0c2a2b459c1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
39235896becd49f8a5a0e0c3a501f944

SHA1
1dbd67006d882218daf71a7b074fe1b65a438b87

SHA256
e319584ea09f9a3703743a25a4ca3f1143e9c0bdbab89f198a137e6a91c5f130

SHA512
4b55da0fcaed0c414ee02352fc1aebd393d099c67b467d5b212924aa665ac019f3aa61d10a6932fd5b9b78933647950d57cc00cef1ccf3b66bac63c73cc19afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7ee639980f7359654a122c6e0203cfa1

SHA1
c5626a1284fb7f77ad622a5912f3c5767bce52de

SHA256
4c0f3e38aeff42e7c8c72dfd4f085aeb227a0ace831c8267ff82ff23775ef80a

SHA512
03cefbe57a87d2904ef1bdffb953fbb399f32cae417748f0e2816ce73398faa35d23df2f95ba99ac8e45f2e29542728a86099daa591867eb0f9ad90a27603400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
b44efffefe8b5fa3af20af0f24046cf7

SHA1
116a861c840e8ed4d4ce947fef5654204766be9f

SHA256
c6b1ea25370b8e14787572e95addb727a7e1e6894407363f2643395493d1edc7

SHA512
1e804cb7967c493cb890a84cb1fd487d5b0a2e368bd20c99a2b0b0bb5a2e171dc2ca840f7ee5a2ff9f9ee1a4e4cac2694dbb4e887ec4ee9ff59a536f34a30d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58d3c6.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
c92ea11c28fb744f993811312f0c65e2

SHA1
f94b24ca23aa8ede97794022e4c88f1240720215

SHA256
7c74ca77302d9936c2db26abc65419514bdf8565bd443fc1123a8acf15dff289

SHA512
25ed05c37825279efe19faecc3eca26e3851263ef65b364a312be865a7794a4c5bab8e208670969d90058671539086e5de7068751cf7c42670eae8a4aa63cc69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8749cd8a0ee04d0d494d80bbe9207d84

SHA1
a0fdea80fcf8bb6fff8496b9b6f2e080dfb1b28f

SHA256
7d325d7a24239792213630355b3a55c3038ff76196cebf93e73263a20bf65967

SHA512
cedacf39756480676b79a051f180b59cbbbaccbcf72adef04437cab9dae3687045930f9a806df2b0db20ddccde88d0e0063bbb5f714ac107f6d0953570559ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3320825be4b684e77c138974900c5b22

SHA1
8aed0040a358d628157f587a60f5f6afd4ea3a28

SHA256
9647d16cd93acc1aec4119cef60e48ef2a40b9c08546899ac58025f5ca100359

SHA512
851394d503d9d22bdc77db5321bcdaf88faacac6e4491a700cd1e118ab1964f8387b8c04f08f9f0e502f8a1de2e4d557aca4143da0e8437a158b9190d2f76ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7d8d94c0b2f8c93999a72b1442417914

SHA1
9e098772a0b807f0e9fc8ea10f8daa9791914bb8

SHA256
cd138d51caea81b7fcc5bcc33949a7ad9e08e193fb405a831222679a80e3d84d

SHA512
b528ffd61761727e5e179919eed62b7f3f56eb28a090c3cbcca47192032a9b0fa9640028f108a5c7cbff433bf508238f980de88eac4da8f1b7234b34c3f81297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
ad6ac35962dc92ede9198f9b56b8f636

SHA1
71687cd963089f193e77ad1d0c73543fef83a2a0

SHA256
0d354d95334380763fb741e0960f95700f99d070381081fd7724f7a27b79932e

SHA512
dd6a842362a0879eaf4b9d6a35e674e21a6afb468a622436639b85be1e5a511d3205b04b23ec5d3c0c1eeb26860cd3b8712850c36864fc64144ea0d647a4832c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7ba81e18cfd3e4976450c5db402df506

SHA1
40458b6e178590b46110e0b274bd8863423c868e

SHA256
769570b5de290a8bab46ff2d3dfb7dcae3dbeeea3be17fd6f3650f2053b95a46

SHA512
84887dfb8190219645c6324ed6702f199cfb0a60842dded1bbd03e8af9f45429aab60d1b1722390925887d4c2df84011fd38bd5b8716825254d1ce37fb68797d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d044d9dca548303532007622829c617f

SHA1
d5530e51462c22ee288428617201d09a60f6154e

SHA256
faeb02d0dadacb8aee100cb4b3fe027af4fdc22aad130006759a47350245e837

SHA512
918124ecd44fb432de39620256389f3083039d2e736d49433655c301fa4145eaf04877d0522711264d094c15ae7d15739f1eef83d124cf2105a33b2f45f4f874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582110.TMP

Filesize
48B

MD5
b38269bcac93f2f8dd5d2e72fe13e575

SHA1
09cc95bc9bf4c006e5c2cb7c6125e0eb26ab4b13

SHA256
26e1c0bd9c40fd4ebda1c23bca6372d76e4c68e195c98e0ec340cf6b9e71e33c

SHA512
c7cfe9a2d2fd2172b48339e9c4dafcf5c6d9a6e2141d7a96ce5ff71be2e6c44a9ffc25f3d68929feac2407cd4e1958fb5d5dbf3ac0296534d93f1f82baf4398d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
74da39a1412e95e2cacf54062b28fe1d

SHA1
276b416b208d9b39bba868c6c150e54572bce3fd

SHA256
ee1411f495c0609b8f435df83261b5b7397225724c9d48fe6f7047b11807f438

SHA512
dd717480f7918eb8a490916f53dd657621b70cd1a890c040f07e8208b68cbf219047745e83a727d632868a06035d35c05f79774d04ac202d3a3a54b57a0af8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d041b0549e5a52be8901fefe28341a83

SHA1
e8d06069fb007fb01a0b79f851ae0cb4573c5d88

SHA256
d6f8de705ec7bb9f8a87d96cf2e78e0c609f540edc41535f5ecf4e1a54187925

SHA512
68ed189e7443e3aa50949ef5ad71bd42fc52858100c71a62b2f50128779ad0ba480f0d6ef88c8338e4ba441162c43809214d977a7bcf57d89438dc7d545b8440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
356e0e9a6878d48bcb31e5161e23adc1

SHA1
53c7d24cec078cd3fb5c4ad8d81044c01177e985

SHA256
a51c7e9a7e7d87bfdb4c2e77bd6b810769b9bd8dad5709039795fddc5325753d

SHA512
406a4f2e789b31ce08c15fa4fa16c6ae0c664efd79284d2d7e4cd3f4775c0da23fe860a4493ee144e14d0ee5b563ea085000cd2f29014c4a24e288673b414928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b5c7b3f5da6319c9e169a73ecccd574c

SHA1
4616fdf955033d7f2145a71694032368efc41f41

SHA256
e1362bcc23f72f901205ba7dcb1856e9fcfdeab11cd8a06ff2eabfbdeed16e81

SHA512
035b9549d0da8231ca16f2217cf0f76a7674b7fb6f086277a062e9cb2104d4395d21890f0ce9af053f251ff582aee1a25a798983cda11438d292c236d37ac087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816b0.TMP

Filesize
203B

MD5
6608a45cc96d69dce7bcb436e07bfe81

SHA1
6a410d24760958fc3e292172ce9b3c5c02c80cd2

SHA256
4153b752f7ef52dbc7057a4742176a507e0d93824ec9615eb5df97174ad7c72a

SHA512
69867d809f46cc886d6ec67c6c060da2f66b824a49df8b008f0703cdac9361f9e78fe05be864551af78fa87a1d74527aa1425a812c6ce69a21d7a78fc00d978b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
037c13421cd0b679e99b4ac31256b0a2

SHA1
e2669978abaff28a1c3c3577ed8e0b0f4a257667

SHA256
6f3699661f4f1e0ce37d46faf0f821bd9950ccdef1f4dcda3ed5cf59def36bce

SHA512
862665eed6aa1fa3af05980aad8a643ffaa7aae55a5a56c19d4d718d76a08100a50392a3f4f85dbcc86438a6e7efe72aaf797879e96568acf7906413d338202c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a6b0c714688ff09ca1777a7a2e7a6658

SHA1
5bfe74bee69ace5e22de167572ecfaa6e9bad8cd

SHA256
8b1b329df62efeb77f3b8ffa047bfffa4c48ede7f5d0400fb9ca09158ef626de

SHA512
6e4d5b21c076b5c16639ea839815b64ca1ce7ffc73f29e9bc5ea3f2f59d2da1cdd2e1a568a2b20615cabcda1db9c93497542a7baa3616155ccffeb58db5ef878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b89e7605517ede8586e3532da1be45c4

SHA1
5415270eb4f1323b2f31a2c9f40b015134f9758b

SHA256
f58a4d7ee64761a800d7a2617823ce7bbed9897dabd2a0f249caa7464f96de1e

SHA512
cb7da6925f96819f97caa46ec84558c2436fd638e4f110f83cc72cde5a67a4e043b3e599ab0cb31f26f10345bbf2b68d625948ab69e534cf7542d66ed398aa04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\etc817bi.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
dc9fe66d1fba6b2e30cd758131b74200

SHA1
295acbf0a0d3a66a48c044e7c4d9e1476ebc2818

SHA256
8f2e06bc8e455bf1bfd0af536392f32c6ab207028d3e8246b3e0c335286a9a5f

SHA512
2bd67cf5cf0a12de5c7adee81694c69883c564739c6e5a5ff835e97bef7e670ec884cd669b1cc2cbae1d9fab7f84d0fe785f929a87e42cd8f90a3ac1f16d2ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
50e6d5f9b64b3a4740d687baceae803f

SHA1
f5a42d9ff975edd49adf3446c7ee03757e6cb005

SHA256
db9a65702c5ed48621948d58b792f34b7db5790f2beab94341d93bdf05f27493

SHA512
1002c5f99cb495e59e4a8b038473f8c0f74be021c5f493ec59503417f37723c624b2d0892eafc41ccc8f84205b9b7c97851184973fddf42670ffa6483f54d745

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a8dce10b88eb5f757c0ad651284b1530

SHA1
0787c0484e860b1561de6a5dde0159eb752cb9b0

SHA256
175f52bf72442e808415a3c8c9426d6be0451401f7627ea2979a112b2668aad4

SHA512
6d561a17dddd438d33fff455f3503f3be72220e90b99f296c725fddb7506afe49352fe73dd0eb32788bc172170e16ef8a98461be8c7a45a297b171755c52ad3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\AlternateServices.bin

Filesize
8KB

MD5
c4b836fc3faa98f3f0624442e81ae1f5

SHA1
1486f29c8c72a29dfb5d8cb25f76978b529ad685

SHA256
3dd6ce0c5477e92e406f8265735f9266d1feeee93241953b1f7ce9290c61d334

SHA512
8e8435f1be48385d132ca8c8fc5b933fa17a93deeaeb88910bef65dd011bda0349e656a173095909d57a6a6496763ad436bd9f9b8dddd8c6a21104023c9057b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
a6b265652576046773bcbee3ec3cff78

SHA1
adbf454daa14b0288ee39c367306140410fc4dae

SHA256
18da538b080854ad1dd0c55cdb09d04637b6cf20e2d85210e95f84be9596ad7b

SHA512
7e3a0900f7a89a953df9ae3c380e4a411dc3a0dd451001631c63c78fea6d760fd03d7c07129561711b780d7fa4b9ebdb532c78c79b4a80581841c00b9e797b51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e748609acaa91343ed685d136cc1aab7

SHA1
ec776d52a58d7b2a754f09e6511e12d5ad6502ec

SHA256
fa3265e09806eb4c4cb363e2c96f2861c62506898536c2bc848f751fee9e1c95

SHA512
166d1d847963a5c25081b903ede363c00ab65cf55822905a75c709f22b9a2a9b00ced5a416e923843410e0d6c7bcc0bc99ea45f6a1293ec7b8d52271cd70b5a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\datareporting\glean\pending_pings\8e41adba-c602-4d1b-b0e0-06b61f730f08

Filesize
26KB

MD5
ad8d4618db55ed91b8a87d8c17cfb5a4

SHA1
d742959a5eb06b1970770620a3bf5e2c7892a13d

SHA256
a84a3eb4b1c8b71d084fcc7e3b2a599f8e7af3f7f2cb2ad49fe95281fbd93ce9

SHA512
a78f57b862422fc41fb23fc546b94eb4709437c9f232f775f31a0c5c5044670bf0e102db4e68c0e69c4b6be9a1c1722d19344e8b1936c34c603d9963604b9337

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\datareporting\glean\pending_pings\d3198511-e353-41ac-bb0a-4a4e0e5499e1

Filesize
982B

MD5
abaabc9dd714145f1976b4c6ae7c21f5

SHA1
dc9321a63a7bc3e7f23aace2be4f64227e64721e

SHA256
a0156f80ac4209f4139ea623494e140691ac1a392b20201b8bf5a0c3c3734b69

SHA512
706b8a6daea99fb38a03c70592343babd6e6cb011780c61344fb479c97efab4217fc7b74f5b0ffd835325b56a6a817e6397f66d2c495f76559f91c716a2b8826

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\datareporting\glean\pending_pings\e534f81e-f342-49eb-9354-980bc515f407

Filesize
671B

MD5
081ab2097cd2ce54856ce18d3e45b539

SHA1
7cfecb7f192ae12216e8ae734590977f31775936

SHA256
4053630bd9a882a7d582ba6c44c92f59dd0b39e91f032a507774077baf746498

SHA512
68e725533688ddb9781e3fbef09336c724609c9bd807e6be9cf0f5b1f9c4e15f2ae50a831cb4f1622335db20302e93ad849cad9ac5c4da1888f5d9d3fa0975d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\prefs-1.js

Filesize
11KB

MD5
5ce412d9358f11b63f0fc41be54bd7a8

SHA1
b7611f7198f77a1d9f36ae9209fe66e2774a4084

SHA256
145db7471a49f4ad312327b794019293f01c0856e792d4d84f90e3f8b495ed38

SHA512
94ac6154174ee09bf01198a6c220e3bac24fad2010394dd3b02d33e96ffb1a658ad7245e74fd81ce256748bf2b88d54112ccaa136f2cf9bcc385cda04ae1bf5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\prefs.js

Filesize
10KB

MD5
d31494608787441ade7498dd78a11d86

SHA1
a3f7b4615eabfd4aa1a7ea2e05903adc4c5340fa

SHA256
c2b5ba40cdc67e47fb30e3d755d18202bf5b2c504dde2fb5615df83ab020c183

SHA512
f35b9b4151d84e71bb39c5b6fda8a8334ba9dd0872143f51d4471b716050a1081a25b372c6d46e1d350800585531900d84c90e747332ece77d05a0967ce7b534

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\etc817bi.default-release\prefs.js

Filesize
10KB

MD5
f04c446cb6d2bbed1f1781bbe637446b

SHA1
0bcadcbf34a65b0504321517a66d0f4353daf409

SHA256
96dd3848a575125b402da1e35c3e997a07b47f3b1ca7cbfa8ceaf068a5107bb7

SHA512
3b8a98254cceb4605af056452f41dfbeb775f556ed99faa2c57c35ba0604d8d51baf456cdae2fe8ffc227adc3231d0c7beaa646d409c4f2aa8d6dde1768b3ca9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 339908.crdownload

Filesize
2.9MB

MD5
ad51d8aaef6c8a914fbb011e517a0ccc

SHA1
35b12200b6ec04c78f8dd863f5d94020376d00be

SHA256
634e32291a69cbc027c853324f8f4bcc502dcadbc35a175dc3a4ad36e05a71bc

SHA512
6a42b11bfba1f0f96130207518785d54535c27441e80bcc28c6cd7d9e4b6c94c83683500d87461d1cc52a431af6810309e1455a037645947412bb6fe5fb2de33

Download Submit
C:\Windows\SysWOW64\CMDLGES.DLL

Filesize
32KB

MD5
de77fab1909fc1badb75905f4bc45039

SHA1
a28dc5387b1784dd3824dda0ca165a7797008741

SHA256
4a6cdfeb7092a5fc2458739a471f1ea3eebc809cbfa397eec89d79a5c1c48329

SHA512
c0d549585400739f5d85cffe4563ae74c76efea71a23b2338cf060356e91588480b4e50e5120cd1b133de1007a01de54aa0136f74b219bb4621e1987b58a78eb

Download Submit
C:\Windows\SysWOW64\COMDLG32.OCX

Filesize
136KB

MD5
3ec0a48ed8d8a019175cfa3952ccb3b7

SHA1
075ffa431a55a272c2cdfe465ac130ab654ba9e8

SHA256
f9ecca1f6718f7ab711e3f675dce438930079ca8649f101fb41a93d85977149d

SHA512
0c51c31c0fa9d5b4909a5085bd72881c4e4867f90c0e576d5344b311f4e1d22ed7141ff359e43dcf53e8c84782bc34062c16dab04f63e73487e91b1db4cc33ca

Download Submit
C:\Windows\SysWOW64\MSCMCES.DLL

Filesize
137KB

MD5
5ed60554e96f0aad3c63e31e95f38e91

SHA1
e30934947f778b9c6f0d2d94c0ccd63f68d32f02

SHA256
ef501f2d3e28fd706308e7a3e8dfcbd3d36ca7ccc108a141c4f0d6a92dc63a31

SHA512
8129a66c7f6dfd237e83224e8b33fe909976f20732366fa7eeade8b3bfe0c2730402f9a4f735ce1ca32d0ea28d35133b5801d9f7270c785e496934c8e808b1c2

Download Submit
C:\Windows\SysWOW64\MSCOMCTL.OCX

Filesize
1.0MB

MD5
d9578ff8b495dc575e848c6670be85cc

SHA1
ef0b7a7859caa85bbbdc9cfc1fe2b6eb10db44d4

SHA256
a018a023d59bb76aef0b4dd6ff40aa16fd0783927972a9492b26a5e5d0433696

SHA512
08078f3c3d20e7887b0ce0f3a5aae195a30476f52b8b672e32217c9b515bad67304a91dde6a0c5edac26c2f0db70a0d31a52245fbe65f3430e1ee4a4454359ef

Download Submit
C:\Windows\SysWOW64\VB6ES.DLL

Filesize
116KB

MD5
09a79e444dba04a1ed4fc6ea4bddb293

SHA1
9d31737040423420c05ac219f6b2b6a236a961b0

SHA256
ea83bff621537e591724506f8f06c8cde89ffc8864d53a29dddc6d023088a40b

SHA512
4365dcca0718c161486e8bcf4d2a5b6a94b52241d0ed78c1118cfefc6ee5822cfef2cc25859e8644abce413ce14bbf49ceb5170c093a0b5ffb998a766b87b725

Download Submit
C:\Windows\SysWOW64\VB6STKIT.DLL

Filesize
100KB

MD5
322fa9394913911485b2e864088a3704

SHA1
7b58e19d91484117a8be7126eaeef45419076137

SHA256
c2919c57f03db1ba81a1f0e8d81bfd7770f29a18af7ffb4d6d9dd12362be2f7f

SHA512
711d6319aebc0456d4b5e545b7db60e62b89b5242b0d3fae3927b3c189df6e009f2e0d76070ef1a9c4d533df300b6e36e86b5d259eba2111ae704936167e334b

Download Submit
C:\Windows\SysWOW64\msvbvm50.dll

Filesize
1.3MB

MD5
4669d0b9452870b6e7354c0a2cc50dab

SHA1
f7535fa5b336b95989406ebabced270aa4df766e

SHA256
6d360fb1674e5e738a8e455f5abd410b2796b076692245fe3b1dc00547b055a0

SHA512
3092b24c3b28b39d64d97da05e523812abb8abd7b7ac2c54bb40fa0691ff7eacdbcdd88bb54738a52805870ed67c52dafb0d542915be6acdf1791b468c24d735

Download Submit
C:\Windows\SysWOW64\zlib.dll

Filesize
52KB

MD5
4965107d112666d3835308a831a29274

SHA1
50439b99ce525ecb74c554e1dc43ddb39481dfa4

SHA256
105280995cd5746078d67b8651dfe4ad2abcd532d7ad528d3100c535b0b538af

SHA512
38fa8f0eeadd75bf212eaab458833cfd3445d00f3d77f1f8a86b7c3ba99376231c8b3fc3cfdff6f02f2ca9c90956c76f9055717712d35a7ca7b30172a0010b59

Download Submit
memory/8772-1461-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/8772-1462-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/8772-1440-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/8772-1577-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download