d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

max time kernel
274s
max time network
267s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250207-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-02-2025 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.txt
Size

18B
MD5

5b3f97d48c8751bd031b7ea53545bdb6
SHA1

88be3374c62f23406ec83bb11279f8423bd3f88d
SHA256

d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
SHA512

ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score

8^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
61	1088	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
3804	setup.exe
1132	setup.exe
2764	setup.exe
4356	setup.exe
2392	setup.exe
4624	setup.exe
3964	setup.exe
4192	setup.exe
772	setup.exe
2200	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\bn-IN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\fi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ko.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Sigma\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Mu\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Temp\msedge.hollow.7z	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\learning_tools.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ka.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ne.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Content	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\VisualElements\SmallLogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\ml.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\concrt140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\gu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\lo.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\edge_feedback\mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\libEGL.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ca-Es-VALENCIA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3804_13383505534973683_3804.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\is.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\resources.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\edge_game_assist\EdgeGameAssist.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\mk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\tr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\ur.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\kok.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\th.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_elf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\LogoDev.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ta.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\uk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Locales\sr.pak	setup.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1984	MicrosoftEdgeUpdate.exe
4440	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\BHO"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133835055664178732"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\msedge.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas\ProgrammaticAccessOnly	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationDescription = "Browse the web"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --do-not-de-elevate --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationCompany = "Microsoft Corporation"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\ = "{C9C2B807-7731-4F34-81B7-44FF7779522B}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\notification_click_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B54934CD-71A6-4698-BDC2-AFEA5B86504C}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xml\OpenWithProgIds\MSEdgeHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\AppUserModelId = "MSEdge"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\ = "PDF Preview Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\msedge.exe,11"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationName = "Microsoft Edge"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\DisplayName = "PDF Preview Handler"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --do-not-de-elevate --single-argument %1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\PdfPreview\\PdfPreviewHandler.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\MSEdgeHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\AppUserModelId = "MSEdge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/html\Extension = ".htm"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\MSEdgeHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2725887018-3128739702-485120524-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\elevation_service.exe"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\ = "Microsoft Edge HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\132.0.2957.140\\msedge.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.htm	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ = "Interface {C9C2B807-7731-4F34-81B7-44FF7779522B}"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\Application	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds\MSEdgeMHT	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\ProxyStubClsid32	setup.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3912	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2392	setup.exe
2392	setup.exe
1604	chrome.exe
1604	chrome.exe
860	chrome.exe
860	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe
5396	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe
860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	firefox.exe
Token: SeDebugPrivilege	520	firefox.exe
Token: 33	3804	setup.exe
Token: SeIncBasePriorityPrivilege	3804	setup.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeShutdownPrivilege	1604	chrome.exe
Token: SeCreatePagefilePrivilege	1604	chrome.exe
Token: SeDebugPrivilege	5952	firefox.exe
Token: SeDebugPrivilege	5952	firefox.exe
Token: SeDebugPrivilege	5672	firefox.exe
Token: SeDebugPrivilege	5672	firefox.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe
Token: SeShutdownPrivilege	860	chrome.exe
Token: SeCreatePagefilePrivilege	860	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe
5952	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
520	firefox.exe
520	firefox.exe
520	firefox.exe
520	firefox.exe
5952	firefox.exe
5672	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 2128 wrote to memory of 520	2128	firefox.exe	89
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4420	520	firefox.exe	90
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91
PID 520 wrote to memory of 4048	520	firefox.exe	91

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 27191 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1312d707-a703-4931-9aae-c44038e0dec3} 520 "\\.\pipe\gecko-crash-server-pipe.520" gpu
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 27069 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6c8dd83-95a7-4c1b-a80e-5a3f99fdc3b1} 520 "\\.\pipe\gecko-crash-server-pipe.520" socket
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 3004 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb140279-cabe-4f0b-aefa-61f6cf4920f8} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2536 -childID 2 -isForBrowser -prefsHandle 952 -prefMapHandle 2524 -prefsLen 32443 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a903a085-2b31-4e18-bce8-fcf50751753d} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4844 -prefsLen 32443 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bec8226-1b33-4441-9d55-c76bb8e63588} 520 "\\.\pipe\gecko-crash-server-pipe.520" utility
    3⤵
    - Checks processor information in registry
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4eb99a1e-6b99-4f9a-9384-ea603c280aaf} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:3624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbb065e3-418e-48c7-b495-5d2d718c380d} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5528 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b9912a8-0b13-46c9-a327-0c72d8a3d26c} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 6 -isForBrowser -prefsHandle 5156 -prefMapHandle 5856 -prefsLen 32631 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3ba7543-119d-4a2e-a743-78fe6ff426ff} 520 "\\.\pipe\gecko-crash-server-pipe.520" tab
    3⤵
    PID:1764

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTM3OEUwQjctOTI3OS00OUMwLTg1OTYtRjg3MjIyODIzNzVCfSIgdXNlcmlkPSJ7QUU5Q0FFQ0EtNEY1My00QjU0LTk2QjctNDJERjQ0QjFGQjk0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUUwNUNBQUMtQUNGQS00OUY0LUIwNkQtRDVCNzI3NkZGOUQ5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NTUwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5ODYzMjgwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg4MTU2NTU5NyIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1984

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\MicrosoftEdge_X64_132.0.2957.140.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
1⤵
PID:2688
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:3804
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff625a6a818,0x7ff625a6a824,0x7ff625a6a830
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1132
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2764
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff625a6a818,0x7ff625a6a824,0x7ff625a6a830
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff62905a818,0x7ff62905a824,0x7ff62905a830
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff62905a818,0x7ff62905a824,0x7ff62905a830
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff62905a818,0x7ff62905a824,0x7ff62905a830
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc9bdccc40,0x7ffc9bdccc4c,0x7ffc9bdccc58
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2388,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1856,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4504,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5456,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5156,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5660,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5416,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5716,i,12322269526640208717,5570422231906061691,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1276

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5956
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 28209 -prefMapSize 245037 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39751790-9e70-49f0-a6cf-d7f6d0a13a6d} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" gpu
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 28245 -prefMapSize 245037 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {282308ca-fe7e-4828-a11b-3218a651b317} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" socket
    3⤵
    - Checks processor information in registry
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2776 -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2824 -prefsLen 28386 -prefMapSize 245037 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b0595b3-9fe7-47bf-aa21-bea783d6d2c6} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4328 -childID 2 -isForBrowser -prefsHandle 4320 -prefMapHandle 4316 -prefsLen 33673 -prefMapSize 245037 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69b795ae-c181-4fe9-bc7c-9f81ac0c26f7} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" tab
    3⤵
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4988 -prefMapHandle 4964 -prefsLen 33673 -prefMapSize 245037 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13e301c6-4b76-4c4f-961f-e42363c30022} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" utility
    3⤵
    - Checks processor information in registry
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 3 -isForBrowser -prefsHandle 5152 -prefMapHandle 5148 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {809e7c12-1872-4d4c-98c1-777ca3873639} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5180 -childID 4 -isForBrowser -prefsHandle 5172 -prefMapHandle 5168 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7f6428d-152f-4295-9df7-57269c102d51} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" tab
    3⤵
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d26d7d4d-83ec-4839-830b-f15ef8960ee3} 5952 "\\.\pipe\gecko-crash-server-pipe.5952" tab
    3⤵
    PID:4520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5932
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 28209 -prefMapSize 245037 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14a126e8-007c-48ee-8682-ea2edca7bd79} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" gpu
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 28245 -prefMapSize 245037 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bc9c317-d471-43b6-8a68-1460a6223514} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" socket
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 2968 -prefsLen 28386 -prefMapSize 245037 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93bd479c-165c-4bca-925e-4361fefa2d78} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" tab
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -childID 2 -isForBrowser -prefsHandle 4024 -prefMapHandle 4020 -prefsLen 33619 -prefMapSize 245037 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6675ff-be08-42ad-9360-7ee090051163} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" tab
    3⤵
    PID:3536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4796 -prefMapHandle 4752 -prefsLen 33673 -prefMapSize 245037 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e29577cb-e081-4c37-8ce4-a9940f519338} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" utility
    3⤵
    - Checks processor information in registry
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5056 -childID 3 -isForBrowser -prefsHandle 5048 -prefMapHandle 5040 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {533ba0f2-4ce2-4d61-921e-71c53fb0e1b3} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" tab
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 4 -isForBrowser -prefsHandle 4796 -prefMapHandle 5296 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc47ab32-20d0-4edf-a3ab-6845acc6b65f} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" tab
    3⤵
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 5 -isForBrowser -prefsHandle 5416 -prefMapHandle 5424 -prefsLen 27698 -prefMapSize 245037 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e59a33df-c9c0-4c0d-8e26-84e874c8be6b} 5672 "\\.\pipe\gecko-crash-server-pipe.5672" tab
    3⤵
    PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc9bdccc40,0x7ffc9bdccc4c,0x7ffc9bdccc58
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2376,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1868,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1996,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3704,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4464,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5456,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5516,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5488,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5232,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4416,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4704,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4508,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5920,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5884,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5128,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5144,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3176,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=900 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6048,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5948,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3304,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3384,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=4932,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4476,i,2019336942073946297,1701893471520613018,262144 --variations-seed-version=20250207-130051.534000 --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5396

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTM3OEUwQjctOTI3OS00OUMwLTg1OTYtRjg3MjIyODIzNzVCfSIgdXNlcmlkPSJ7QUU5Q0FFQ0EtNEY1My00QjU0LTk2QjctNDJERjQ0QjFGQjk0fSIgaW5zdGFsbHNvdXJjZT0iY29yZSIgcmVxdWVzdGlkPSJ7Rjk3OUZCNjUtQjYzRC00NzM5LUJDQjMtNkNGNjYzRjgyMTMyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC44NiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9IntBRDEyMEZGRC1BMzlDLTQ0RDMtQTUyRi03NURGOEY5N0QzMER9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDExMDUyMTk5OTY1MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg5MDI4ODM4MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODkwMjg4MzgyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzkwMDQwMzc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk2MzY2ODAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SFY1ajNjWUpoUDFuUDVvSzA4JTJiWXIlMmZkayUyZkthUXNqbHg0QUduV1RrR0JOTVJUbyUyYmJTMkczenYyWjNBY01Ec0NUS09aekRISG9jelEySkNjbTladjZ4QSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzOTAwNDAzNzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NjM2NjgwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUhWNWozY1lKaFAxblA1b0swOCUyYllyJTJmZGslMmZLYVFzamx4NEFHbldUa0dCTk1SVG8lMmJiUzJHM3p2MlozQWNNRHNDVEtPWnpESEhvY3pRMkpDY205WnY2eEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjQzNDExIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzOTAwNDAzNzQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQwNDYyNjE1OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjAwNDIzNjU3MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQyMyIgZG93bmxvYWRfdGltZV9tcz0iNDk5NjAiIGRvd25sb2FkZWQ9IjE3NzE4MDIxNiIgdG90YWw9IjE3NzE4MDIxNiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNTk5NjAiLz48cGluZyBhY3RpdmU9IjEiIGE9IjEiIHI9IjEiIGFkPSI2NjEyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins0OEU0ODEyQy1CMjdFLTQ5MEYtOTUxQi1BN0I3OTdCODZEREV9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGU9IjY2MDgiIGNvaG9ydD0icnJmQDAuNTgiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MDc0NThDRUItODg3RS00REQxLUE4QUMtNTlBNTU3MzdCQkMxfSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{7F7AADDB-6A90-4D2D-932C-761485B1DD87}\EDGEMITMP_1F57A.tmp\setup.exe

Filesize
6.6MB

MD5
b4c8ad75087b8634d4f04dc6f92da9aa

SHA1
7efaa2472521c79d58c4ef18a258cc573704fb5d

SHA256
522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

SHA512
5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
58dff0cb2c0501b3230c4da2b61686da

SHA1
7c097d2512381e76866224bc0162bf418bf3e569

SHA256
7d674cb7bf44b2cef58225ee835174e852c4ef204869ea3229ed4849b68ef329

SHA512
3980dc43b9f1a4c8eff672067f9ebf1ab91fac1acf982981fbcff77d494b8ce9e175bf0401e83f3377095a35ca5c2131965a818ded298acf9f1bda7b25603387

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
215KB

MD5
2ffbc848f8c11b8001782b35f38f045b

SHA1
c3113ed8cd351fe8cac0ef5886c932c5109697cf

SHA256
1a22ece5cbc8097e6664269cbd2db64329a600f517b646f896f291c0919fbbef

SHA512
e4c037be5075c784fd1f4c64ff6d6cd69737667ec9b1676270e2ed8c0341e14f9d6b92fde332c3d629b53ae38e19b59f05a587c8a86de445e9d65ccfa2bd9c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
42f51a4fea65e8ffd8dcbbaca07279c6

SHA1
327b04222093558efe3f99af07811c17ac116a50

SHA256
544c870ffe516922b609cd3df0d01baf4047e99eb1d78939d26883c0f0c629d1

SHA512
cd415f5b30e534d0992ca0d44bbdb684a8bcd7872c0f581b35605a916c522ce4bf687919470f8c64b993b1e7d46e6afe88ff351ffa71107ea904c6c8461206bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
8739f11d9c6dae0ae8e7f2cd3fc90bfe

SHA1
164bf5b5e05424b91db6815a2790d07a42ae42c1

SHA256
8bb5841beb84c0258d6a571b4ecb31d08b523db881feb7e6961d4d9bfe05580f

SHA512
e45517bfac5522dd6dc6804c485c79ada8742e6756f1816e8b2966360298127d3f16eec6ee4e035f947167ca6aa803a7735f1c4ee0647a0ccc6d628c775d617c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b92e3b553eac809821e835392a1b30ec

SHA1
11fd6510d9eb8ce304c5f41946f02189fd7d7add

SHA256
e29edb9156d04091f1f551b6bf0f52c9ba5da680416d80a649aa8edaa2d10511

SHA512
07416e654ad844ffe54db03a47b5f11116860de775a0dbe89347f787dfc8ef461d4559f05586718c0ba562133e4ad148ad1197b7e3afab2a4935619bc9f9fe0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
132198c735b47f406eb9f8905cdd897d

SHA1
799d087177be6f5bbc98a2f3434c3576695d0041

SHA256
5c3f35e38468c2e23560aad169e44f31311687fc5dd1a551ac2fd6e40151ac8c

SHA512
82506abe3139295046e9e55cb05cec13413f8cad6cb2966eae1e6e857f9b107f939f0c83c8ff64fa3488bd792d0e0e50331c50360fcdf325df65f6dcfa042f87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
af64f72af5c9b1160984af36957c8bbf

SHA1
080d94ad1473d0347a5229a3d78f53e1f306d2c1

SHA256
2b0cbadbc949b34e6371781fe353f39f6f617b2d76508b2b3f9cbf0d568eb8b7

SHA512
6719580752dafa3590a526ddbad3ee89283aac9c68523964e8abfb820d93b070983a7dea8b09dc835ef3b7e6f2e0e6d72d6c09db5d67ddd3d4a772ad8fbf194b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
619c585c6a798250f8237ebba9d90bb7

SHA1
d476387ed0d13716735b0aa4c6e0b48f26a7d6a2

SHA256
065058318e0eee8a6c223f8addc839ee50cc0c5a20369cab810d126df13faa6e

SHA512
f8ff1273d279b4efcc4120deccf43b66711b9265e8f6d57ec1ce2bae00957b4c05284a09d0fd67e407f40e72e51a6432fbef4ec1d3c038b2c85ca15b8daedf92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
c64058f1ab077169f2b1f0beb7f84fef

SHA1
abbe7cf35bbbc938f316650b65a2618b7bbe57bd

SHA256
32745d7fee4d4e9ca0cf431d8ced06a30af99fdf206446cac90f411ea0f2f773

SHA512
16f77feda5689f0345519ea1f5bb4bceb1ccbbc9d11bf9ab9b0343b2b01ba1e786262a237455c2828a3a3bf7daa6f4f331338df5dc7afebf59f633d3d12dcac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
9dbcfd1fa4ca6355e135cd5694d85609

SHA1
c5997bd9d4a5ae2589ba84ee05b58aa4eb908942

SHA256
1c962f5081e25d1b38e1ea9962ddab550774d4e8c9f183207497909773899fa5

SHA512
e6c3b01b63371196c4e4aa98d5557a822fc9e3ff9bf086fa414e96b018a8a67bbbc55a92a89ac3515f07a84219d8967c77850ded27cd62bf164e140321befca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
7d083b09f5c06388da0df1a5fcfced2d

SHA1
cdfca034a788b1518a20c5957f462849661bec4f

SHA256
b24030c822dd2d1261198b60c33552f8eaa951bad380a4cef02f933d360194cf

SHA512
c6719d171f78701be4ce0a02de2ae6535457b1de969b354a7f29e3662f01c3e68fb2f38125c189a5125fc6e1355a0b1e9f91d10a0ede0752385656db922e1f90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
f1ec9b16526d1b06fbb99e0d3b98131d

SHA1
863a88b14bdea3be23f5ceaafe972beb57b76147

SHA256
50d1cdd52f73e2f0f672c9e53c055d682f56b041a48141279993f8c5d857cd93

SHA512
0ca8bc20f9e4cc2b2ac6c0a5a667d48766e873241e574c251d3ddfb7010de5144f470cd08af1e8b491ee82a5227ff64cfcefec4ba7134159c03549658b66f346

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
bf5091a69dddf72de0e91b312547d1d6

SHA1
56869f57c78c483178fee46d8f1395083168b975

SHA256
b7514a992712d3f4d658f42f8b8db596660b146f50e025bcf400bbd328bdc13a

SHA512
124bd67006d0c6e475b7fbaf6aabd182f78719f7df914b71f92f188990a6b7978dcdf39bff07c14b349553077514a8240b203d482b80bab43643d633a2780a0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
5d85191e469af1338c2ef776ef022097

SHA1
28beeb9bbc0b39d46d8235329f1a560c05884f8a

SHA256
bb5bb643cb0da98172586058dc79975c582bcc7fc2aad0c5402165d6f10057cf

SHA512
2deba804f1d6178127ed865dcba497c5ec37ae91ab287f4f11e80c2503291ad122e61bb54edc50730b820d6670c6b95a1c5d80f4ae0272f3951a03fe5bdaf412

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8a45f06176592d6a336ddbab58d3d8e3

SHA1
3c5600ac2e26051ae9503b237be63abf388cc443

SHA256
441f33fef67e4707062fa03cbb85058401cd6ba4a3d751b408010337793e8325

SHA512
d94461cd59a9b56700d2847bcf5f1e5c151bcb975a21032112b1bbd6a1cf2d3520065441610326686fbaa8c3cd3bda8520b051fee0f2bca74f7a26ad12e40e00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6a86c26517f6e2fe56a92ceefb8f0913

SHA1
c03296fc59d3d46d82a87959faf45dedcd684896

SHA256
d0dd9a1e222fbbf6023ce6ebcbe954097ff47085fcb75184eeb62586241ee5a0

SHA512
0496a1c086555ad2b97477b6f18c22ea707df072275d033078b96906259ef154a16d0b00a1bfb41c84d16360f7069c5e4c86b9bc9af6b79e57bb4d72ea7370f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
17a6ab7a50e7b766dca2c32e5954933d

SHA1
32a37ec0da610df193c69ee479e5fda8314877b8

SHA256
a44b0fe3040ad49036caa262d3a867a28e90bd43a792a6b5aba2c3b4ffb3a5c0

SHA512
bd2b857e12e196790cd2a0ce9cc213527f37a899dd4aae3ca31e7fd82c9f820fc2e6b3b734251a13be49d24e576b4833058649e1ce22d257ebf6b784e29f45ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
01e7a4301bcca4293d107198010139b3

SHA1
ba038e5f2abbb699020fcf771f4264e16efb4adb

SHA256
d1443c5fbb457425cf13bde2b5b9eb1ed9c3cc241c82460879f1b37cd6c2b5fa

SHA512
756b725106c5f9c86bc94c0c094431b8fe2361f1eab03b7c60d11723ec9cc27ce4b9dcc466b30c6b17480d5133a8908c088e73e4074700e16ac641b58fe26ffd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8d1f031ef914bed7baefb221a865cc65

SHA1
69a4593b4106c77d73eb0b8bd2b938fa50e66af1

SHA256
2596d8937f4f5e0ab445d28507dd2280ce7aaafc2c6ac840c51f13204fdb9232

SHA512
07bd763535c8e38644f521f571aa03945a057af6ad7e0542a75ca5c2f411acd3451507a9c5f3270916d51a77ab1b32b5b377df6cb5dc3aa772ffc01ce354ff44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b89d9e27cf7967cbb9a43f120b4611a8

SHA1
d4983acb1acaaf77439950e35b12c6e8bdc8780a

SHA256
f86e12fe34f68ab5cba9041c256c32faf5be61ea1564e875f77f9b69b810ae63

SHA512
45617f1209057577d5f3c5aecd9339d220f61d10cd9197b81448150963550d9e1a54f19a8ad2d6cabb0047c88532d1daabf23fad580fc4b0d6bc2f6f7c2878f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5c65984b0c44cfecf30049f71730fc0e

SHA1
03ce8a1db7737d872ae424f24038ecb5750ed777

SHA256
a0a5217e87188ce640691b306ec258bd5dc34d0580669fa4423d4e4f0023497f

SHA512
ff716e30adefa8eab9d2781d71445fdcafbcc2766e83836fdf27bdf614451c9fb64c8de96f9a8898ae24c719742d4ab5dbdc588f16b0c4774a5809f02f018268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
113bb4687a6947df1472bf6439c90a11

SHA1
4376e5a865821874c7fd4ab2d041aee15519f720

SHA256
f65e04420cc93db067ee155250c47c461ee85f9eca9099bf64de40b110c92287

SHA512
829ee1746439e2c2d011609f04af0af565bc3ad725cec2c8a931478bcdfbd70f09d6e68a31920e7e67a698024001e5d0b3f81fde34836cabe97a5db0645c205a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
02bd6759310976e22bef0c77eb199a98

SHA1
e5b2799adc7c43f29252ae6893242e87d5c57faf

SHA256
7018a52112dd0ecadd0293b7519fd9843d7b37597f001545582c7603ff577198

SHA512
4852ffc9d0e99f5e89fe4a4c0a7f5c40628e8e56f978e54dc8ae79ccb57aa1e5ff49c61383a7d13aa5d4cefcebd1e19efd86dac2d6310f4ce6aa3c9f55792170

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dd16f2072f780b882b372fb9999d3e7c

SHA1
2586fcefcf2a179f577d2064c762cbabfda2c9cb

SHA256
998f5ffd552e987bb2a507ed3f8654ad0c71c91a7bf6a58a426212fdb47afdf1

SHA512
2c4d52cb6b43c7e51b21262bca35f8fda20b5b7325863d32a84922e57d4be285261a586e04c618e6b646544a4c44a426af6655fba47286fe718f3a48aa879dcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b2b6ed8666ed460714433e1a951ddba1

SHA1
e47ffd6a817fd7c34542fb356d5458de6af5af47

SHA256
ea9577228ee730b7d93a85aeae6e28a7aaf539b9c68fbe9104e1488b3f572138

SHA512
eede8d8a266ea78f87898ce4da228161a4fffef8fbae8a592a29c9e86680a7902e7bbfd3aa7d2edc1e325ece12bad25781663bd0664737258f78ad7258a69460

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
39e667b5dbe73cb630f819e4dda19610

SHA1
7bc6d351465cf4473702e5052ac6f2db3b5967ee

SHA256
8e595fd819eb2befd25622f0cf99d4898cb1f54ac5dbc7d94e0a924d8aa9d158

SHA512
58757199ed7b63d0956ed20bc192739a1ebd76f17030c279a59737fafe41db008ae160e1a18a710a9ee3d0546396758c3241bd42343ba02e1808c3979fbd3fb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2f4bc203c83f305e7daf39cd77ce3731

SHA1
f06090939ee804891a5f1fa4de66fa59689f2168

SHA256
ab6075a692f35addda9458244b0ce3c8e8af356c5ac7613dfa329bcd6bc3d4c2

SHA512
56adb31fc808222d55eab40910e6112382855d065ca82b0f69176583a52c05a7617f5fee185e0d3277310cc45f3de32a5c8b23f9022ab3008562f94005b57417

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
125KB

MD5
51da9657ca430ee01c493e750858ecaf

SHA1
23678262edcfd5de6a95fc23aaaf5317e26031e7

SHA256
f9f306365b90290d014a922dc72d4faf7076190f4cc6b17b8a89f8cfeb2f5b81

SHA512
73f220132a593a30a710789cf73457a6ea0bfbc6c7e58c6dcffc784ac53f54e0b49e3fe27a7b874d58fa9d864702d87b22f59f22b9553a6d789d4a27a1ec4300

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
125KB

MD5
a3d1f98e97aafdf7c7916e71992700c5

SHA1
b4027d236442677af00277ff1cd73d806127b1cc

SHA256
731876840050d37cc296b509c9a3a3a11c5f795312bc141e58146698c4639902

SHA512
d89a7fa1642fe4a2f263b3bb972160955bc4948a9788b9b6f7a5fa5e91be32888223fd4592f4b19221689c113cd850560d1f3365abd8493b811db58591ebae89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
244KB

MD5
94dce6ed8255634cee28268086dc4930

SHA1
fa5194ef54add4e3557455f012060e8650f6d634

SHA256
fceee6cb90acd76cc364f2002d0a0504f97a205a581d0e8f3565a3b4a5ed823b

SHA512
2e78edd0240045630af71f305c8186da41e2483d2b6d970f0251188b7bfb88510c50e309b2424cf01b6e2a3d32700864aa93ad18cbadca58f6210cd558377ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
125KB

MD5
dc7846dd9865405910707907673e8f40

SHA1
7e72e9082aa27213ae075cfe0ea7ef059b2083bd

SHA256
c0b692af261e80900439ace13a60e7bcf3b870df5d2df1831e97fd826beb4301

SHA512
c80f6bf1b1ae23cacdfcbfcf6e4c8811ed8253dd06483d68d767d5dae8658d0929e634b0f0519317156d656146425d3716fcb0eb434c207bd840591caa870c2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ba173c28-9c0d-4e00-b43a-39be66867807.tmp

Filesize
244KB

MD5
4d451a3d0905f2405f3d987385c4d6a2

SHA1
adf8563243c826b9b5c1d5498635afc19d86cb9b

SHA256
5936decf36952997034ccd1aae98dc14130aff526ff8d7c99f00576d43801c43

SHA512
2f1929d27cb99b4e3f19a277fff126f2ddf7a78617dc83b246a9560c2adf70c39f7130cc0f8150f0b0920f1c509338138bff62cc3fe57cb98ecb33cf7144aa01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb09092c-3075-43fd-941e-ce3650d8733d.tmp

Filesize
125KB

MD5
6e29bb6f9fa39c7a3725bac5e964bea5

SHA1
bbb6f202d5684181f7c3b002a88458b85424b964

SHA256
e546125a34217b18aaabd6b7c4afd118b70006fed806a15f92b5638dbd788d62

SHA512
d4f3eb4ab8bb405ca0108d8da5bf799c250fd565941bc2fc7feccf5a275ce494992c6d0d408d17f6e3b3ef83867d41e67cdcd891b3577d5c77516f69b3f6a68f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
c0e84420165476c03c83170c03a04ad3

SHA1
63c87c799fa465ffaa34f1b686022340c3008229

SHA256
7c8315b3cfdac67743259660f7a139f1d2506f5d88893e6d787b0952f4a83782

SHA512
4ea4306ee97f163758c06b5c3170178204251360de47007cf39f347e886e41315a1fbd9c0ee6b70333f0e6083e7c2fbd20ac48b37c1a4ba23e00d596439f1f6d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
27KB

MD5
86f6f1893561d7e3d69ad36f9562a594

SHA1
a5c384e09ff11162f1722c7d64daa6102b73fcca

SHA256
79307798762ec1ca093355a0f214c94c317034df6ed3e92fd99e1670f6d354f7

SHA512
fd57003f45f83df2bc3f99a1c71290d72ad31eaddd0c0ae1a48ad2f7532bbf75de09c704b38a30062ebde7677e11ac58294396f5c097a17ffe8958f42db794cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
13KB

MD5
3ec845d1bedf17eaff212988ef8fecb2

SHA1
f41cec1a263c463136bbfd0678590b20eb2b6dd4

SHA256
6812097b5a18a72f63bdbcb689a08fa2abc30f9289ef13c4dabd98a86ba815bc

SHA512
474179027917d343c303977ca64e0dece74fc28fd90b90e4ba0861727822760863f8e7cb38b45df018888b33a9b776a1b5801339597d316f36b900087742e468

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
136KB

MD5
76304d31a30b2859a422cd96e756f07a

SHA1
5b2794a93b6e1c03c7174dbe34b590274d178da6

SHA256
450bcd8bd60865944104e8070ba8e59a1d4c8de11c822c109eb80b81699d2fe4

SHA512
2f2ef761a92bab8539f1531d83e2f7b86797fd3bc3c71ff71728aa908c0450a700c70a73913d40687b2851328cda4f4016300f4a5aace8e7f261494bfe29cd1c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Filesize
13KB

MD5
be28604b5959c49da5c883b4b0ac0ba9

SHA1
ea8d3f137cbd95fbe8b5b2ce54292e4fcdc57f04

SHA256
a7d7e1562489afe7771470819a2b26e5477077c46c6c813214f4ef9e4b5d84e0

SHA512
dba6bc2e47ddccd6d1d86c48543b4fa180e7f5ede4461e5631f8172dda76e7b819e521b4910867f8a9914c8a1832c9ccf3386c486774532b6c4989e4c67ffdf4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\startupCache\scriptCache-child.bin

Filesize
769KB

MD5
3b37dffe05aa4242c076dc09ac432313

SHA1
0837b7dafdc4814310bdc480d2cb758d9e55d14b

SHA256
a848ee6314a345d10b3871b3523da159ce7653319d90cfde140d635917c714aa

SHA512
ef061d22c2b4bf2a086897ff5c36749d47900782a3d408f8f4a5060db5f86319310c1d4dc77f18682907084bbc384d49fc0fe5e381e3673d365f1555ac08ee51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\startupCache\scriptCache.bin

Filesize
8.7MB

MD5
2c560d3723639831e19aa8195c106199

SHA1
bac6f42c24fd2c028d0c48bca5812756918ce124

SHA256
19d1b461f5e4bc0be167bfeda419763769ae3fea632760e6571f6ee6fa6af32e

SHA512
e925230eaf0ef4ef1999f8e52818d7acc954cbc1ca354907fe6fdfbdadba594f695dc3b6c2064c5b8ddd642b0fac3cecdc8889fdddc8c0f1840ccb977bd67fad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
ef7b4b28640d9807bb73d9aa3fd87ac3

SHA1
1b9c40ee02c966928f491277f7f11679db6268b1

SHA256
f537fc3612bc283ec1fde23cfb1c78942b0bbc959b5cad56cd9d0b295b734b67

SHA512
de30ab0ea1a59776254d36e1aeab2f4513249aca0c5289cd6955691035620d247d8d3483e33ad7c2acda13dc9983c5cafdc46a79ab7e8cc73ebcfdc6a1f53b90

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
d6e3345d073df536db6be0856480a25b

SHA1
c09d3667a6720fed03ec9aac6141d287f9d801da

SHA256
a060671d446c7d599fe09d84b1a34c4df994f9aabb0311bb0d0a447f65bb2933

SHA512
f8fa43837f460bd496c9402bd2f2a840ba742303c22a030b5b14526ed4683e9bea3d9a8e7685a41881715d1cd88d50dbc3ac49bef1b941eed908837e363488da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\AlternateServices.bin

Filesize
8KB

MD5
f475149d09d62030ef1d89f96bc035c1

SHA1
feb8cad93ef5d3ee07ef9b007b510a42b8fb5ebe

SHA256
84e2fa7343de1dfb8ac8555ee2ef8c3e1b153330c04c05f7fc111bb01b67f6dd

SHA512
78035975deac8127e1497b24b85e3a28650acfdd7ffca146a781079ff9fe36b1330daab7addc8676133623e852ea3cfdf1f333212a2964b1e2efcc0097c54f52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\SiteSecurityServiceState.bin

Filesize
1KB

MD5
445f1af9add3da27b446dad3cbf08176

SHA1
3c54bb57e96950075c23bd34ebdce439ab3af3b4

SHA256
0f548d8a859c0a0f1adf863754a82d70bfae44df87b701c4216a9aaa27e6e318

SHA512
67b40189f9fcc42f23ddf7ac38dd28621ee8f7d3186bbe99907f44aa8a547e440c819bd1946386d49ec128d8d61fc881c025e1e09f41d2dcb56bce2a28ebe01e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\broadcast-listeners.json

Filesize
209B

MD5
97c3738563a9448365a735f5f29ed3d5

SHA1
15a81433236ca6e6ecc4e1c8d0fdb8523b265c57

SHA256
63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24

SHA512
ed98f42d5d02ab53a9e50f80b312bed4b5d05d053bec582cf9d619ef91251e86cf4f4d1123c645500fc1dc4673b49a8b7badd3f3a39f565ac643ca4fd0157ae6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\cert9.db

Filesize
224KB

MD5
82e7230f5b4ed9ddb42232ea91cd26e2

SHA1
dae33a87daf15b80f7f27f9d93b2b7da28dcf89a

SHA256
de3b60dc2e692c58a5ab8360a9ca8b8a2f7b2c30ccf8ce00184dd6b2ab24b61e

SHA512
c2376e857a825bb2a54fe5a03136e07b9432dd571c5f1a29632965e252a3db826a497bacaa71c2e2b35bc11849b920c7d6ab21ed540b379df05ecac81d20fca2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b5acd9cf58ba89e643e7b2e839e0707e

SHA1
82c2b9cbea4acb50b446b786818287be7b0b8b61

SHA256
4d4fd87f1cdccc9f826ab7de2b3980db6fe4ed328f079ceb24f680557da9667e

SHA512
1fdaf5173a2fa956e3793b3643b44d928a4c81a1599bdf4b057396bfca5948ce1097194dbb5f528959c8cf4e34d058922828236c6060b41510e9ea2cb9ed424b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.bin

Filesize
36KB

MD5
99aa9aa79861945688cf256181745973

SHA1
f36503f83e900926be0c187a9e2a93d9e93e231a

SHA256
50709ffbc8db4647617231c7743e535ce7e26e7e3186c814b70c3712d210557a

SHA512
565bfbc863adf4391bb3b2b4af20b17eda24859b994db57648af1897898f8ecb487f10952e54fe53dbeb3840c75741df5d23fa5362adacf95ccba9ac3a345dad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
a082043dd416a7f6d62d91e5d4f521cb

SHA1
22cb8e4c124d2cb48a43260f6c92e1312b6feae3

SHA256
99bcb6bfef1a7d10df4a71889ebe2c50dec0943fae0c05d1d4b36c1c46788ae6

SHA512
7d43eea905d3e0abc1af58ea7d19f193532cea14d15fde10dad11f87d6bec2f0c47e3dc73b2b1e8d8b3a8a892f6d98a22400da96009175bb05e7e54578ccf768

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
27f618ea2c2364db262fc3162e1e2510

SHA1
1a9b5d1e254150de94776e4c9c422e28be2f8f08

SHA256
4c0f95fa78b5fa27e249606738d8a29e4ff85f7cd9843b943c6a12f875bc2e12

SHA512
665c3d36b700c4683ff1fdc626beb7048dd48e6c85092c4161f1d399ddebdb6fccbb6d5499bf93866e86c13ba324baafa0129493ad311e4401bc98335d15d1ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
dcac4ea74d0b63d5fefa04d50fb6b18b

SHA1
5a36b1d713eb7324d3773ea88426f57a3e41ba1e

SHA256
457b13361b44946be0fbe50cd20cb77015d0caa2895055d2cf32557bfbee23d7

SHA512
407bfbb21c9432ed26fc2703515c03873e92e80881925b218a14bf5082f3dec2c9eeae1ef2c8a301772f23fa6e4fe2003f010a500cf228f905ae85c526db071c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
aef9782d6060e8c6c2fae7d04a48f56f

SHA1
a916c59fde8b2b4e60346020d826f347f2444fe2

SHA256
4a91b4004ee7171e63f6da456a2a045cffd45939a14a3492043e8c74836223e8

SHA512
e897c6288ab3173ba97b933cb93f8eb883fd919de95eaf1edfb9878de966db570d8915bf8ca380bbbf4a894b5b595baec1f6d34542b04d486ccc4623e4ffc04b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
20a701446cc8a09e4a2e56ca92773332

SHA1
a37a229d97ebb41d5ff26715f91099c3e4a92b0a

SHA256
9e4e807c15f985e4cc3f632a58da60c746d666de64fe1653a7e7344551a48e94

SHA512
6fb28bc7ed5f6321d066b8ba248757c6420b4ab5d7e2118a7263cb2068318d0ba614531a0ad83a89f4dedb76dfa4cbc017ffccc7db0f1fffbab167a6ee0193e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
71dbdb2ea1ecda036704a0d70e29ba78

SHA1
f78dc9bc2f28a966334fba0059594c1e2f85f0b0

SHA256
7be10dba1ccd4ffddcf4efb076f601e7d75c53ced4a67a5809045085dfdece5c

SHA512
cb9ccce40fcca7805a45303f42c30a54f9930193e0b62f30dd5ffad98bf20189b18a0c920e5ad9a95881e981ee0e40612d6ea57aec23865e18a182acc75aecda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
40KB

MD5
9ce9689d95fb82df91a691a9ce998af1

SHA1
7252ab5e133d055577563ebf5c1cb61ff9c1042c

SHA256
32f3460e9548dd6a0d8c90a9512e7e2db43b576d92845490249216dbb68fc711

SHA512
39eddeb4d714e7300f5beecb40707e79fc27da74d0078e4d621f4d170d119ec16c37c9eeabaa0ddbb7531f48d2499d6e2445034075f0574c8ecf8a73a4bd68e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c6e9f271688a3710ed352a94a66509ba

SHA1
7b299d59a638a54495f3830ae87e147509a862a9

SHA256
bb1fd5469d4a348ae7adfbe046c4c136e1bd4f8db6cb85e3caa32bfe4e9d13cb

SHA512
d152f6dadb7a7fd5227085ff140bc275305801fd2a15d8e6f9bf50c0c48b5fdc0f002b432418647ebb26549b5ac80cd81928b079db16f330bfc57cb8258c4913

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d8b35646213ee2b3c34a20bec37c77f1

SHA1
af3fc4f55e95313d12a04499ec081a1445094dec

SHA256
7d92ac2c4a35c2d04d8d128907c2b10f60841d6a048c73cec4d7558746ba8549

SHA512
1ea36aa87c46c3cafa0ea0c502ad4af43c5a48c916971f80f5ab7edf38545ab500e7aafeeee5d8347e68169fc3d2aeb55e42b40a3ab178b209386a0609563afa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
2bf9ff64e23005880ee3a77c2f46a3a3

SHA1
c0be08704cd657e0e03c5a6c0272d46930eec48d

SHA256
8222751d50137811595ddb7907c487eaece49b32d7546b85d4ab282162ec3150

SHA512
782b803849d231df79a9bfdb21caf7fe96d9007b4800dc47bf0fd5b9c7459e1c12884f9ce10925d98e8e9e17a35a658e045835e05d2a7326f362306f968f2447

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\events\pageload

Filesize
378B

MD5
2c76919cefc472e1dbdacb6da99eb74b

SHA1
d65f05ca42c5f1b698f603520cc94281162a125c

SHA256
dc83b3fa6bc17ee1da173bfdda1ce5daf868f7c1f8f19e8e18838518db0a4b98

SHA512
9c12b3d9a5c26e9dad15bfe937ea7ae0aa14b5f31434373944a26b5160c31e0a058e6de9b16c0ef9bd36e03af47590203b14951a28b221a1389dcc7fd4faa26b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\44c298de-3101-4990-a54c-78a2abfa795c

Filesize
982B

MD5
a4a4cfc0619c8d699a0a1fab913218fd

SHA1
761fc0ba7c4b67418b09905eefcd62604fa39d1f

SHA256
c90787bb8dcf9f8401edbfa7e8e888c4ade41f3c25789453c19309d68f3eaa6f

SHA512
acf33112194fd404d9980366dda52d25888b2ed1b0d9c9b0b4ad7ef5d888eea2147701ab31ee6ce27b2f44ae50066d22258fa09cd4fb883a09294f8b64562256

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\759dd67a-43c7-436d-8581-55f61282753b

Filesize
734B

MD5
4ed302632f727391c1b6d6f53799625c

SHA1
7bb70c304d30906ca4a6878e0442b42e625e2e1b

SHA256
199d551752c6edf62c490f686316fa4d35125092372130f019a2b4abe7ae3b8c

SHA512
c36dd37c56cfae0ba112b7b0944099fea69d3b8537669db91fa5b324f6923e7233ad5e8498bac1da0742b04466d6ab7776a5b57f623fa727e00879b1ff25bc2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\9b7dc1d1-2ca6-41a0-8023-384380baf200

Filesize
27KB

MD5
0a7c1e16688eb8a62d693392013d17d0

SHA1
89197c4979d9a19922550b8ff7288ddb0ced40fc

SHA256
4854cb0a99df122b1e54e303ddf0f8285cd8ca5e066ff2b8299553e1960af70a

SHA512
20c423c9775ece388204e8e71b59f90d2e74e32d76f61a17a522d0a7efccc257837abfb044f34b4aca50413df9cb3745adc16b8f0d261bb8e878046d8e9456f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\b2387ae3-85c7-4678-85b3-2a348c7c1417

Filesize
767B

MD5
d337ff5d216028461b414e2e69912273

SHA1
08c935c4f46fa9ebb8f599c38ec52015e679e003

SHA256
211d218c3c67a8a24dce327a6b6ab65ed0bf58052e57e0817738fdb531ba874a

SHA512
5858265cf16de624944c27569a31cf1b5e0ae8b1c859827f348ffb2f458afb9e58c0dc46be1897c99df5113cdb6a70ed165d50cabc85e4993d21eb8087d041c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\b52f68bf-1793-45a6-92ae-c62b9d1da735

Filesize
676B

MD5
2b8f8e3d45f968a555353c2db7f15d35

SHA1
dc0b172a83c75fe899a22bc8e797b6ecfbf86093

SHA256
8259fcf164d3815034593768b38817fe7d82743d23579e236a3c1782c3392009

SHA512
95123f674f2d68bd19b01858f38d3634b0d7523c1c0ac75b5f9f2c3335c7a3d1e6c6bf2e34168b53915218fd7e95ac8e9d6593d2d7aeb20068b213fec415f5fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\b8bb0e3d-32d2-4797-9fbe-72fd02f64a7c

Filesize
1KB

MD5
0951b06ddfb6418c981cf23c44439ea8

SHA1
87c3e6d411a45924cbd93324d7cc6b0b358c7689

SHA256
d76f383d4d44fcc4c159671f257ecc413acd7532a38ee3cde2f167643fc1ecbf

SHA512
32dfc4c04978ac479959b9bea6b4a27c7c958216a41ca1a097f31e5290b1de78ee99a2374acf0ccddfae4db495861da2f36ec96f488e715cc5072edd16ea34b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\babf969a-e29d-49b6-bfe6-d149d3e0b60b

Filesize
671B

MD5
1a7567aa459123ffa40ec84e3ca70638

SHA1
23b34ee89ab218eca9f4caab2d3e4f714ac2ec26

SHA256
3f133a91a775803f791024e94ea40069b145df0588e1644eb30bb7213a5dbdd2

SHA512
fa9ef867c106eac36a69dda8ca89ea05cb82713c625e6c4c675e551627175277e4438f916eb9af3206348685b612753fbb8bb3587810433ece356a40ed2781f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\datareporting\glean\pending_pings\dd7a688c-147a-4607-9d29-e47688dae72c

Filesize
1KB

MD5
ce9970e611f3cec7586d48f40bbd8231

SHA1
0b4b709601bd9bd4db62fceef9eab215e6df018f

SHA256
4162b3d5be2815cf2897745ab1c0b5e6305cc575fc52f5dff60882b2582803c7

SHA512
3a23e2fb18279531d70b64b6056ecf3ef89b88787b4a90a7e6a0e32e48994d44febd73bb2b4edce43722e6dd944d9547c4572e9255752e3189f76d3d3a47249e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\extensions.json

Filesize
37KB

MD5
8b912591167a3ea94b86878ea7b997a8

SHA1
6b0fd2c97a4a2117908bb5ba1526ff88399e5bb6

SHA256
dff975270fd94d206412bc47cf1878c2d4e8d5162eb0b5d7697d03eafc4cbcf3

SHA512
6d6cd8dfafb66ddd3d4955b03144145844129f6df1bfbc9b10c5fdc773c53c642858f6d2a898b3a53550e88374f41375b2d8ff853abbf85b9668fbf0990e86c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\favicons.sqlite

Filesize
5.0MB

MD5
d7773fda604a6e33cf4251a63bde6040

SHA1
a2ef248ea5f3e6d392616ed2ae0924a935ffc0d9

SHA256
86f8113dce16f23525e519fcaf404075e4f7f2434f0ced4626566b266be97923

SHA512
a674bf1376e304b2a8f9ced92492629372907d7c3fd4cfb646ebb615a5084b5a8298414ec2f2bac8ada1e3828af56e2778e301ebef2f6e0beddba650c22ade79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\permissions.sqlite

Filesize
96KB

MD5
913e138f52e86f31f945f9a8906e36ca

SHA1
9c0e08e24edd2c47f09a653702dd0e488803ce2b

SHA256
19c7f132195fde8f40c45e2d1530bfd53517090e1d1a0c6a7fece6e8308b6e3e

SHA512
bcb05e294e707e170f3408b4df3be8e9592f5ee8f1d48a585f429104e726f3f58b87f3ebb7c51baf595d0d63eaf7e3d9eca238abcf7b2dee8b750239e271b30d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\places.sqlite

Filesize
5.0MB

MD5
122a9112d34041be843dbf8cbdb24fdf

SHA1
0dc5805ea81fd6f50b6816a8bfed6c701948d651

SHA256
07d1bb14d1a73f41d4b981b02146a57bd2bf2be9609804b7f009c099aadbb4ec

SHA512
f19a6d655fd1ff7af77d35ed1c92f9b227b786c1cc8e209d5bf7f82ac0a214ca51cfe05ceb43d0b3a2ac649e2cd6e7be00dbc352c0cd99f2f9b36b10a642a147

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs-1.js

Filesize
11KB

MD5
f5fa8fd16034c46a812f899b6bfc720e

SHA1
30bfd2f1fc14f63d836732e22a86ff3cfcdd1f42

SHA256
8fb8d0b9358f4487041613dec7ef37b89235597c93d297b4bdd9eb4e9db66322

SHA512
b5acfe17667270b44dc38d65f82e2b72217b255bc679b5f3541cc61f4e8bc4b854aa32a8d6b04150a81b58944a30423fdd525a6cc420cae2b627dbde19119f2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs-1.js

Filesize
11KB

MD5
093558257b0e47d44333d27923df0018

SHA1
d9bd83575e0a4086314ebebcb88bf08dc590dfca

SHA256
72f2c9812aabb00f1d87e0f0d5c8b4402b344ce7250ccca433bb05c35aedd8e9

SHA512
00c92d143dff20857414b6f8516bfd52363bce9a45a35ed6ab95f01821ef2f84679de61b06a73b600ff860f1730c526bf88d900bd327ddf4fce6d889b4dca25b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs-1.js

Filesize
11KB

MD5
8ea79b7bace4fd3aa015e658d9358d33

SHA1
2d8ad6ac43804f24f91054515ff022f984b04567

SHA256
85735f17760073698683a7de58f7b9047a614267a4c048245b5ea0724ac5f4dd

SHA512
2f65058ba74c055f6935fe4823616ec6cc8548b5e32d611f0d603c8afda984463063a4525faef76eafa5c568a046a52db8b7c1ecc91e04f2a0f087997daeeb90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs-1.js

Filesize
10KB

MD5
8335966d81c65c6142a62dff1c8c73d2

SHA1
d20c4ebec0629714633c1f62ffd11c1b95b4d34a

SHA256
2c44fa3a6123b9b454186570688083523dfd114a0648a2eeadd34b1c35ff22c1

SHA512
34378999b58e7c56a70f5d46bcf619a9f5953c10a5614cdfc93194f8d6c75f880773f1591b5f1bbe393de35a529aa7a1145b4b3b8d8e136af20c92ba3033916a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs.js

Filesize
9KB

MD5
86402681a4a7032d89da805cf053887d

SHA1
af19bccfcd8548106a403ae2249d7a933067febd

SHA256
f1e06ac8c67f59bd3228a73eadb7c8f82bac104c2c2015acf3e91f7d75253307

SHA512
42f80c14ef447d48ad96eec2a1b02f7c960f50ada39b8f298e53c71c3b73f2984b8aa307a09c5f8c09c4b847159bb2e3d513ffd9b73b6e546ac59be0355bd719

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\prefs.js

Filesize
9KB

MD5
697dd350c3081aa2251b34ce610753d7

SHA1
d9dfb026854093149e29eb0c782bc8c827d06891

SHA256
27ef5afaf763c51fdabe97e4a13a5d848c97d8fbd25e93f9a41f0a094100f7ed

SHA512
fb318d2f7b912e3bcff5dcb69027ceb46637b32c29a0d465695d8d6c0d3d4a1e0db12ec8b204aaf3ef1115e55697ab0f566caf569d2a5c5572c5a1a4be95860b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
e08ef355498ae2c73e75f5a7e60eada5

SHA1
c98b5ab80782513f6e72d95ab070e1ed7626c576

SHA256
d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c

SHA512
a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
676b1b44337c27092c5223d826bfaca5

SHA1
71f7e51b346db063fd7b5d71f48d93fe20ef2878

SHA256
66eca2f71299d1512ce3552bba3a8a9055e81625bccf6e189501689ed03d214f

SHA512
02be05c001b0018ad462a32d2b75e240b25afe84a922f427cea58a9db877e53c1c02d3b905cebe4b46f0a22d0969095a4dc19bfc42e7a6b8f429516738209734

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
ca5206cc5aec8f494e1f196cb06d513c

SHA1
abe4470ddf5ef782dfd6d941099d4448de0b8c15

SHA256
c7c037b4d36cb7dba651f621853eb1c3c4dc85f0e10277065d4552045984d58b

SHA512
4d3a39c8d65f12af99b94ca277cca272a9ba103abfb51820b6615934bffcedceac17c7a89d9a17a9313bea10a9fb318cb53c08a8d30eb766a854c4c8683a9b59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\sessionstore.jsonlz4

Filesize
14KB

MD5
d6933a0f91d04919157226cb83a1b4f7

SHA1
f2ee8ad067f580a442665bed2b9890f0c0d24301

SHA256
c573a7b89f3875372147e1e152932ebb7994d0943bbcf4d440e806d944cd116e

SHA512
f2728efe9ca9cf749507aaa9166c837debfa9fa3e2b3418ef2561617aa31f772b7b0419a56b5905c799f1b88105914482552d57abc0fff7005833947b99e4a41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\storage.sqlite

Filesize
4KB

MD5
23605e20ec7b9c605b210ac3996e7a62

SHA1
e01d89d33f05c4e7ef9eb63d1487b297b420ac86

SHA256
1387ad3f14749464f83e64bff542db5bdb73d1ec9a6556bbf3041d943a7e3003

SHA512
63f6a0102efd24da5fd50b0fc6ff00da33baf2cf3cd2fb1596e6293aaf551ec41b2ddda9b868f606c3c7269132e282d06d3c815b75d71ed9c2e46354ce588450

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
e38a25166fc96023a4120bcc4496aadf

SHA1
85ab832d5b083daaadb03035bccd595172187464

SHA256
2d9c7bb6c6b74835e6d9acded309a6d4c059da439aecacac99ddd38669f12e63

SHA512
d5921eb886d11558cbf20149575dcf9b5c4ec7446ac5e7db4aa04deb743eda808eadf007c5d189f01d8e4ebbee62f806f254361fb2da8a80795a43557ef5fc10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
632KB

MD5
35daded6398df996b6a1055e759fd248

SHA1
c532a952698d5091677d07091a638f0a3a41c063

SHA256
c05560e09f6e3c158975298f148cd1400dd5aaa8080aa4a2d95927b31f740946

SHA512
2a30672c11934b03836d86e14e22c561346553528227d60dc8f730f369a5d4ba8791730b30cda633cac883954cd75176afe3968682e543aab690f1a7711b2297

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9zbrs6o3.default-release\xulstore.json

Filesize
120B

MD5
8d689c06cb844185099c0398a280537e

SHA1
57073c7526ec37e94bb9db44fedc6d50276f7a6b

SHA256
96729e9b38f216605ff10715f96f364be32f02e2de23ede7e74b78244605124d

SHA512
3c7df326c695143915df1068cb2c0f58e93e4881b2c4d94b33948b80e954fbd4cf944ae53b4d15002b79fcdb8e88f8e9cf4c89ca50f56b7cfd8a13ea7dd6fff8

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
71KB

MD5
9645c7b1d5c45ce9bf9d2fb8f0d40894

SHA1
803ca40c25fe8129106cbf092fdb3abfc0eb7a75

SHA256
5122e81215f97f66e467d072b792a7587bde9ec113038d864d171902b3b891a9

SHA512
00d6896c2931eb1c7b22818b983af41b8ae83d7fad5e06da4507b64cb60dd69fc3096a37d63d01477f87301c8f61e44c39636e6bbefc07111673ab3d98183e84

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
101KB

MD5
ea37d31836c600e0c86422bc8080e379

SHA1
f673b4889f96b7e930c2cc573d4bb011dc3ff7bb

SHA256
6fd977d02c4ad4b68841763376f4122653d954421faadd73d32187e87135e906

SHA512
977fd30bc7d81493b1253ab28a0d6df8f9483c6193670cc421f5015cd1b46571e7c389a218dd13a56c8af4cc18b385d6d3422996d383626b339db5638576b300

Download Submit
C:\Windows\SystemTemp\msedge_installer.log

Filesize
101KB

MD5
c269688484187e7ef02991e38ea19492

SHA1
21d1d149761bbd30e196b4628f68428094428326

SHA256
f18e163a0758e62000f3e19a1ffe9b5b481ba7d07bfa41e2a38c0674ce18e7bd

SHA512
a04b6ad15fcb40280096213a24af673539bd2f689025141a504592e5f2dc223e4f4acef38a8a0aaf61fc3171dbbb21fc430ccd746486c11412a4cb2c376ab204

Download Submit