Analysis
- user interaction
yes - max time kernel
1799s - max time network
1800s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 00:07
General
- Target https://www.youtube.com/playlist?list=PLVIr0a2TLf9vVMpbjDJIgh_JihPXC-rDf
- Sample260421-aem2yahy7s
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 2 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 58 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/playlist?list=PLVIr0a2TLf9vVMpbjDJIgh_JihPXC-rDf1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x278,0x7ffeff6ac188,0x7ffeff6ac194,0x7ffeff6ac1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7216402545888544598,15161710255084328463,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,9562816378035873152,3225496863062228747,262144 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,17848829584122786839,18432389916427162520,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10071905296954270516,12043201283043984992,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,605585835593742093,2626342191266789274,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,11915248436863843214,2030093265449135945,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,3232177844528196669,6533118779869448593,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4140,i,6984201299424391054,8934093422368455516,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,16538603924433385327,10481022363919319216,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,13114497168894025019,7315359146131968673,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,9819412644028823888,12613332434102086973,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5288,i,4418549326380025128,11790684711831210287,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,1331013600436152338,1451497814997326040,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,982872266257098789,18421500909672888358,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17978754831504115544,14811781190187445319,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17978754831504115544,14811781190187445319,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6273328059777106561,9486121060083972686,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,5263001557620924279,15621174009081827731,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,10481048343776837661,10437247112185983747,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,15350868242550967646,6401395607870666974,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,13279683427696742927,8111583997245693718,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,6154086196443423728,3439693150610558631,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5116,i,4805422771474400379,3221101352357265855,2097152 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,17397371159398760781,12708851729878191486,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11745727687843045629,861734989308968103,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,15152031710219079784,14679351494312233392,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,6182158835990391459,13963328940958261770,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,18144008014544071407,6785724433491945467,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,13491962477761998186,8197462112790604915,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1063833138373801806,17958715717634282810,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2892,i,6141874190719603982,4198715822878675725,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,1593171208522134591,15174726888469560265,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,8876574103299334524,4052684926711114357,262144 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2993005213802323678,12664644297274675380,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,8195429559490899929,16261471317769661485,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,3469684652882751832,6436775673294939384,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,9005026079689905231,7093331345635071686,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,11148633557203092037,17136053468474936850,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,15145201390356867327,12743636981212813923,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,13347876500904962684,6595216746624889928,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5557935015034996134,18369929170129339366,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15595521450774042268,1959268930316540248,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,833618872536170940,8858088756889085601,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,13269111905716506470,1870478419744642468,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,16597000414186930397,15059632266450114907,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15953772631126916513,17357404927949747527,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,16774147298085161022,10405430182580134698,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2892,i,11463260551376788541,15797300254016274579,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16268932583244633404,1660958086137689436,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,17089889707481929755,7709118015224503734,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8378987050245905658,3040131636868529392,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,3562757029690615631,10841465592705095420,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,18108416590697995462,12439237137808081479,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,7348248249247381745,15431305645393014115,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,1090304987722421959,1819746300462341581,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,16532590140480753750,12710188838016364214,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,18339761025138245316,8529136259390758200,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,17027465052845741165,287713264474239582,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,8236116820695788086,9373756970258169128,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,17996142306596611534,16140083883156365111,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,18415103457388749467,2320743820883515903,524288 --field-trial-handle=2928,i,9091099187956249899,11378027716524932554,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeee38c728,0x7ffeee38c734,0x7ffeee38c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,9520631033069528520,6093502202922810516,262144 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,770286575073937663,2014269888889170132,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2248 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,6543650205993687416,18197769712489289586,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2384 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8409138713421617586,13501801583958630877,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,15334401622463128332,8962138119029115028,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,13081776611632506010,1674629505696623431,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4252 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,16428034428922460767,1462817746951890407,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,547892998544297870,2162710581139070855,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5712,i,4292119610152020662,17991403397468140504,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3464,i,10011119514228699252,299736073825402251,2097152 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,4081777077093891811,6600837469049978028,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,17521079593141116443,29546761202657214,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5892 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,17986310651992809175,14522920312689340644,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6052 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,15994610971747466067,10865752590419239952,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,1360589892944914567,6520472916258105784,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6036 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5660,i,4154476688280776197,14870840728128971059,262144 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5964 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,3610744646326532623,3534351418178111715,524288 --field-trial-handle=1956,i,6383650601184310741,12670227396380819354,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5964 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {7c2a3ef9-cfa8-4584-b02c-adba3a3253b7} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {e5dc9290-8eeb-4918-ae07-fc08ec26a145} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3908 -prefsLen 27323 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3924 -initialChannelId {6801503c-2777-48cc-a681-d708bd851e15} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4116 -prefsLen 27323 -prefMapHandle 4120 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {0bb91403-6dab-4cae-a124-a546a7621933} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 34822 -prefMapHandle 2716 -prefMapSize 270279 -jsInitHandle 2952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3116 -initialChannelId {44a37cec-918a-4466-9fa0-e867be96508e} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4848 -prefsLen 35010 -prefMapHandle 4852 -prefMapSize 270279 -ipcHandle 4860 -initialChannelId {9d940708-249c-4d9c-9218-0a0b234edcfd} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4700 -initialChannelId {afa2c622-0d1b-4ae6-9fcd-7ef9fe34b1f3} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3264 -prefsLen 32952 -prefMapHandle 2952 -prefMapSize 270279 -jsInitHandle 2716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2848 -initialChannelId {f539f639-a3cb-4b62-b331-5a9e50bcbbca} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {61a22978-9cf9-4559-9798-92da65814c39} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1884 -prefsLen 23514 -prefMapHandle 1888 -prefMapSize 266331 -ipcHandle 1948 -initialChannelId {0ecf2de5-2cce-4ec1-a974-c61fe0aff31a} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2236 -prefsLen 23514 -prefMapHandle 2240 -prefMapSize 266331 -ipcHandle 2192 -initialChannelId {19b7cfeb-d7e3-4bd7-9b84-4be0fa9093fa} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 29131 -prefMapHandle 3956 -prefMapSize 266331 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {e88358d3-cdfc-4a18-b379-7a59390b6999} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4144 -prefsLen 30031 -prefMapHandle 4148 -prefMapSize 266331 -ipcHandle 4216 -initialChannelId {8ca7fc88-dda2-4b5e-82a8-93e7799ad48e} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4492 -prefsLen 30142 -prefMapHandle 4496 -prefMapSize 266331 -jsInitHandle 4500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4508 -initialChannelId {2c4eb963-3b1a-4d0c-8bfa-1e41fe10ccc1} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4084 -prefsLen 30443 -prefMapHandle 4736 -prefMapSize 266331 -jsInitHandle 4740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4748 -initialChannelId {d2bdee0e-285b-4e69-909b-3c8fa9336bca} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5400 -prefsLen 40099 -prefMapHandle 5404 -prefMapSize 266331 -ipcHandle 5344 -initialChannelId {f46474c2-72ea-4f40-9ffb-b89b0175c9d6} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6096 -prefsLen 38923 -prefMapHandle 3232 -prefMapSize 266331 -jsInitHandle 4156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2968 -initialChannelId {511a49cd-150e-45f7-8ad4-d8e12599f0da} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3432 -prefsLen 38923 -prefMapHandle 2832 -prefMapSize 266331 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {59dc5e18-9669-485e-b311-6da1894aea96} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 38923 -prefMapHandle 3236 -prefMapSize 266331 -jsInitHandle 4912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {2502d52e-20d5-45f7-953b-aa46299c0a51} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6488 -prefsLen 38923 -prefMapHandle 6492 -prefMapSize 266331 -jsInitHandle 6496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6504 -initialChannelId {7a410e8c-ff6d-464b-bf23-3a2504809812} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6768 -prefsLen 40993 -prefMapHandle 4188 -prefMapSize 266331 -ipcHandle 5212 -initialChannelId {eba0b2bb-f2fc-4b52-9526-94e1fe522386} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6760 -prefsLen 38923 -prefMapHandle 6764 -prefMapSize 266331 -jsInitHandle 6712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7032 -initialChannelId {011cb65b-3f61-42da-9656-00ba61538c2b} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6484 -prefsLen 38923 -prefMapHandle 6792 -prefMapSize 266331 -jsInitHandle 6796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {37cb52f6-3b12-4b70-9c96-89eb95051001} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7520 -prefsLen 40993 -prefMapHandle 7524 -prefMapSize 266331 -ipcHandle 6872 -initialChannelId {e173fc66-e15a-48c6-a732-1b247daf2175} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6284 -prefsLen 43100 -prefMapHandle 1392 -prefMapSize 266331 -jsInitHandle 1396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7044 -initialChannelId {40e1fd66-e37e-44a4-937b-3119dd398055} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3352 -prefsLen 43100 -prefMapHandle 6508 -prefMapSize 266331 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {1cd3581e-dee4-4534-8841-502314363dbf} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7108 -prefsLen 43100 -prefMapHandle 7096 -prefMapSize 266331 -jsInitHandle 7084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7076 -initialChannelId {b77f76a9-8357-4871-8b88-1fd71a648f5a} -parentPid 4000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab5⤵
- Checks processor information in registry
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
update-config.json
BrowsingTopicsState
f_000013
f_000014
f_000015
f_000016
f_000017
f_00001f
f_000031
the-real-index
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe58c678.TMP
index.txt
index.txt
index.txt
index.txt
index.txt~RFe583fc3.TMP
the-real-index
the-real-index~RFe5890a2.TMP
512.png
512.png
Local State
Local State
Local State
Local State
Local State
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_00007f
f_000081
f_000099
the-real-index
the-real-index
the-real-index~RFe583ac2.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
6ba7e10c6ca173be_0
index
the-real-index
the-real-index~RFe589da2.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5841c7.TMP
the-real-index
the-real-index~RFe5c7622.TMP
index.txt
67a473248953641b_0
67a473248953641b_1
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index~RFe58915e.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
OperationConfig
OperationConfig~RFe58c6c6.TMP
office_endpoints_list.json
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5c504a.TMP
safety_tips.pb
typosquatting_list.pb
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
76abf516-c43e-4eec-a93b-61ae7b39e681.tmp
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
activity-stream.contile.json
activity-stream.discovery_stream.json
14543
0EC3D61C7752D7E6FEB0F024D0705578B2F924EF
3F6BAE390F7FB4267066C23DBD35348B57989359
45DD8CFC28CFEE6F725AC77E2E590B383A57C7E4
53CF23FB80666D2B5FACFEFD6FFD88E5664584DB
7B5AED11A01BDA4051395E2BE3099BB7A37B98DC
8D05B3CFD9A9ABCA9FA27D43203E081A929BA074
8D68098930DED29389AF7F3B03F822EAF92175D3
9291CECC132ACAA1C99F8FE9022E0F3387848781
99C69D76B7BFC90670D6A01667C7C261B5DA16C9
BC787EAF611C1E2C89E256438E136B115DF3D7DF
BD9E22C05480E9A14500732FE453E9D6CD80C1DB
BFFE917E39494DD95A2589020FCC469DCD302D0C
CE96671B5E667BB9F17F9591E2DEB2A2BF220790
E67E7EB191F06EAAF45D88B32102CCDC6D5A13A6
rc8+mXaDgK7UcWS32qOfbmcLLDQdCg+9hubmXq709Zk=.ico
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
asrouter.ftl
d53ba7fb-c31a-4a7c-9411-253b60895e16.tmp
f59d7c82-f0f5-449e-9f18-15d3c47a5395.tmp
remote-settings-startup-bundle-
07d015e1-bbed-47f9-8bb6-0e0b8e9e6ac7.tmp
content_new.js
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
SiteSecurityServiceState.bin
addonStartup.json.lz4
bounce-tracking-protection.sqlite
cert9.db
compatibility.ini
content-prefs.sqlite
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
091d554b-0b49-4dc1-9c5f-d60b88e3dc6b
48fbd5b1-5e23-45f0-b998-4b154b8da0f7
847385d5-639a-4716-aa8a-2c8abf0cfa21
bc82a2d2-a8f6-43ff-bba1-1f0fd0798946
d6ca80a8-2651-43ee-b44c-a1d34ab1a55e
domain_to_categories.sqlite
extension-preferences.json
extensions.json
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
protections.sqlite
sessionCheckpoints.json
upgrade.jsonlz4-20250130195129
sessionstore.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
addonStartup.json.lz4
bookmarks-2026-04-21_10_S_CRjW-xUOXFca-GIdg8pBbHUirKqCcPP85F0DgI9LE=.jsonlz4
cert9.db
containers.json
cookies.sqlite
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
ab355a15-314f-445c-b2a0-1e0c6c3ed627
fa18664c-88fe-4264-a6cd-c0c5a9c6b71b
extension-preferences.json
extensions.json
favicons.sqlite
manifest.json
widevinecdm.dll
handlers.json
key4.db
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
search.json.mozlz4
sessionCheckpoints.json
sessionCheckpoints.json.tmp
previous.jsonlz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
shield-preference-experiments.json
{f3ef9991-8ee8-4b73-8fbe-5b8d20abacc7}.final
usage
usage
usage
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
xulstore.json
gmpopenh264.dll
gmpopenh264.info
recovery.jsonlz4
2823318777ntouromlalnodry--naod.sqlite-shm
2918063365piupsah.sqlite
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
Staging
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
edge_checkout_page_validator.js
manifest.json
memory/656-115-0x0000021255A10000-0x0000021255A7F000-memory.dmp
memory/2212-585-0x0000025632090000-0x0000025632408000-memory.dmp
memory/2212-584-0x0000025632090000-0x0000025632408000-memory.dmp
memory/2504-4421-0x000002AEA55C0000-0x000002AEA55E0000-memory.dmp
memory/2504-4423-0x000002AEA5580000-0x000002AEA55A0000-memory.dmp
memory/2504-4445-0x000002AEB7180000-0x000002AEB7280000-memory.dmp
memory/2504-4446-0x000002AEB63A0000-0x000002AEB63C0000-memory.dmp