Analysis
- user interaction
yes - max time kernel
1799s - max time network
1809s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
25/04/2026, 00:52
General
- Target https://www.youtube.com/watch?v=E5j63Y9frhc
- Sample260425-a77l2sat3v
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 56 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/watch?v=E5j63Y9frhc1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbe6ecc188,0x7ffbe6ecc194,0x7ffbe6ecc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,12560069015381290116,14929474041525731831,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6472975944453530504,4862811442337833951,262144 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,7931484360299314369,16597325506915992493,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,8746055048527154732,18016901188771892796,2097152 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,11444902128485411264,13538232575602518989,2097152 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,9005532583486618105,14718129477831125930,2097152 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4792,i,7989774767468348062,12223016176839549588,2097152 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9106850249666748672,17022302744339111618,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,8552883037733815194,2399792435794060902,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,13867539289882705482,233406121018132767,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,6325215614227465251,6739279188707148473,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1823426596535554117,18011265208283438349,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,12353688488479841109,197297919338884593,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,12353688488479841109,197297919338884593,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,15558916228449603401,13012852218735751074,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,18096005853547454064,14238559201297536579,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,8982359859139345004,2898425040688625568,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,5019876144775922089,3241568393074829508,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,6225511753971959997,1939748307896717821,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9063673415322734507,14761681019586365915,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,6346424602807424444,2530917506188275199,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5559849452643121325,15449161825554377346,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13317718989747230964,2846895110970401036,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6244,i,16076256097108627010,8805441257512696852,262144 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,16033968030962528753,17365205006160447393,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,18010442722844206515,2486463452675260771,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17667502194226504887,12005529824938398599,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,6833835849664956441,18008012558799323632,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1512,i,17501326709649109063,9211270053165332987,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,9606095023015460968,3940637549520901023,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=996,i,7210394006563604082,14275700718665442629,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8210600157699564580,16227744341866107410,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6281720676965565728,9740249844595938392,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,15656803810668255511,17880241025885685335,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,4724530494475676293,9830361051183258665,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,8746305004433687122,5961033665947017707,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1970411861932821293,14980023867196601677,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,6763922704783761600,4964373992088890654,524288 --field-trial-handle=2028,i,2459180750961517256,4529217409749885916,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbd4eec728,0x7ffbd4eec734,0x7ffbd4eec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,10212430561838384475,697335234501200429,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2136 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17096788183240278597,12765077671456950888,262144 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2224 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,5693178624571392608,8930732588261631281,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,421634710995657085,4864917414268865260,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,2998558565521799188,9385995362706342858,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,5838417588025173940,16750370783948075885,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,13744947147628490246,23667751505296748,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,637608548365262177,14460289938280076192,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3252,i,14635371434213772094,7053506761363760435,2097152 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,12018538638380253410,750101726672491245,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5204 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,4157070416396380914,10176282197681525649,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,13759644484074248708,12720385781499775903,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6324 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,940322242523464712,1213348225983673589,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6348 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,17992506134162689679,2932440601983930510,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,13301633893972674335,14682790456342295932,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5416,i,2715933456570536405,6965116046033876351,262144 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,12301884493585808990,14773097494441430642,524288 --field-trial-handle=2228,i,10141571033749348677,16339986944451639689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4860 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {6ce30b96-14c6-4930-8d8f-b28bff103461} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {ae83d318-1c2c-4210-8d10-48bd83dc420c} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27276 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {3b3d7f4f-14f3-44a9-8544-8d014cc49767} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27276 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {4645b644-3677-49f7-96f0-2a5a8f58dfc3} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 34775 -prefMapHandle 2964 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3020 -initialChannelId {423ad885-9497-49a6-b90e-697612d96f26} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4892 -prefsLen 35012 -prefMapHandle 4888 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {f41a431b-e936-4af9-b791-f17829b17a77} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4892 -prefsLen 32900 -prefMapHandle 4968 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {289498eb-aa05-4d26-b703-846f26a1877d} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32952 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {ff4b3cbd-ae37-4cf5-84e3-7794646cd27f} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32952 -prefMapHandle 5364 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {8435d094-97e9-4789-bb7f-e0d3eba84624} -parentPid 3068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1920 -prefsLen 23514 -prefMapHandle 1924 -prefMapSize 266331 -ipcHandle 1992 -initialChannelId {c28a25ba-ab5b-4634-ab65-2b95ee21f3f2} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2260 -prefsLen 23514 -prefMapHandle 2264 -prefMapSize 266331 -ipcHandle 2272 -initialChannelId {6e0e7106-1684-44e0-835e-2f905b173f11} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 29043 -prefMapHandle 3736 -prefMapSize 266331 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {a5158bab-bd88-4b6f-a0f8-b0da5f8d1ef7} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 29878 -prefMapHandle 4092 -prefMapSize 266331 -ipcHandle 4160 -initialChannelId {8a2a9f29-bf0d-4d0c-9fb0-af596e9f9ecb} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2624 -prefsLen 30144 -prefMapHandle 4048 -prefMapSize 266331 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2888 -initialChannelId {1f9f6f7a-710f-41e7-9182-e910660a4afc} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4532 -prefsLen 30538 -prefMapHandle 4536 -prefMapSize 266331 -jsInitHandle 4540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4548 -initialChannelId {7f6b869f-94b7-4dbb-a53f-1b5540e9d572} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5432 -prefsLen 40128 -prefMapHandle 5436 -prefMapSize 266331 -ipcHandle 5444 -initialChannelId {d4db7abc-8216-4ed4-b374-25e4b75e7602} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3960 -prefsLen 38720 -prefMapHandle 3964 -prefMapSize 266331 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {6bce3309-e0f8-44ad-b1a8-a04e83e5c758} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 38720 -prefMapHandle 5760 -prefMapSize 266331 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {1fb475e5-e619-4c4e-8448-611daff786b8} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 38720 -prefMapHandle 4124 -prefMapSize 266331 -jsInitHandle 4104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4304 -initialChannelId {23eefe1c-fb7b-4ae9-9dc5-19b18880feba} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6364 -prefsLen 39066 -prefMapHandle 6368 -prefMapSize 266331 -jsInitHandle 6372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6376 -initialChannelId {6b0868e3-d1e7-4182-a095-472afef86068} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6536 -prefsLen 41154 -prefMapHandle 6532 -prefMapSize 266331 -ipcHandle 6524 -initialChannelId {af1fbe19-e718-40c5-b9e9-8647f770acaa} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6756 -prefsLen 39066 -prefMapHandle 6760 -prefMapSize 266331 -jsInitHandle 6764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {36cae1f4-c904-49c6-862f-25874218d095} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 3576 -prefsLen 41154 -prefMapHandle 5764 -prefMapSize 266331 -ipcHandle 6760 -initialChannelId {bd90e924-a656-4541-b7f6-bd9f272f00a5} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 39066 -prefMapHandle 4880 -prefMapSize 266331 -jsInitHandle 3556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {8d72e7fc-67e8-471f-9447-0d349ce56e38} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab5⤵
- Checks processor information in registry
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
keys.json
manifest.json
manifest.json
manifest.json
update-config.json
BrowsingTopicsState
f_000007
f_000008
f_000009
f_00000c
f_00000e
f_00000f
f_000010
f_000013
f_000014
f_000015
f_000018
f_000022
f_000025
the-real-index
the-real-index
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe59e99b.TMP
index.txt
index.txt
index.txt
index.txt
index.txt~RFe598fd2.TMP
the-real-index
the-real-index~RFe59de9e.TMP
512.png
512.png
Local State
Local State
Local State
Local State
Local State
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00007a
f_000087
f_00008f
the-real-index
the-real-index~RFe58d0c8.TMP
SiteList-Enterprise.json
HubApps
000011.ldb
000012.log
000014.ldb
CURRENT
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
index
the-real-index
the-real-index~RFe58d0a9.TMP
the-real-index
the-real-index~RFe58dcee.TMP
the-real-index
the-real-index~RFe586165.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe58491a.TMP
the-real-index
the-real-index~RFe5cd2b9.TMP
index.txt
67a473248953641b_0
67a473248953641b_1
fa813c9ad67834ac_0
fa813c9ad67834ac_1
the-real-index
the-real-index~RFe58c407.TMP
sync_diagnostic.log
MANIFEST-000001
domain_actions.dll
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
activity-stream.contile.json
activity-stream.discovery_stream.json
17078
187B79B3A61C9A42842FB84747186F05F9D07C80
387C6164270F4D32992C586A0F7C128096C61B64
3C4DC3F10C0ABAF0BA9299D9352685C25F27EB92
53CF23FB80666D2B5FACFEFD6FFD88E5664584DB
59A6D78223A019882E7D41614775E4D8287DCACD
82AEE0F47EBAE2369230161051AED65A05AB0B0B
9888C11D220C88D99DF9F951FB55244C41C6103F
B9678083A75994C708F4BA08BB3F10B86AFCC076
BD3296B6A1EC98394349980CC25BEBF71E5D2138
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
D870BC29499D013374B2B79BBD965F892C3599F3
F5FAA72241E37A8B75A0BAED30F7143DBB51A9E8
FA25A815D9CB1458CE00D2777C5BBD5EC90BCFF1
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
asrouter.ftl
remote-settings-startup-bundle-
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
addonStartup.json.lz4
containers.json
cookies.sqlite
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
7a50067f-035c-49ce-a90b-abe9169653a4
d7da1a7d-8856-441e-8af2-34f3ccf4480d
extension-preferences.json
extensions.json
favicons.sqlite
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
handlers.json
key4.db
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
sessionCheckpoints.json
sessionCheckpoints.json.tmp
previous.jsonlz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
shield-preference-experiments.json
{c9ee58a0-548a-4b3a-a635-d0d348f4b685}.final
3438743090yCt7G%cCf7C%oencf8ieg.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
webappsstore.sqlite
AlternateServices.bin
SiteSecurityServiceState.bin
bounce-tracking-protection.sqlite
compatibility.ini
content-prefs.sqlite
data.safe.bin
data.safe.tmp
data.safe.tmp
events
events
061a6472-77ec-4809-899a-a7296752512a
0ba6e378-4e6a-478e-b7d2-3520b3a3b3cb
7d479f0d-31e1-4b75-a3cd-924cac7e7e6c
93ea4b9a-c35e-4690-93ec-f255096e8ec6
dd1a8ad6-a8bb-470c-879b-f12a14cb44bb
domain_to_categories.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
protections.sqlite
sessionCheckpoints.json
upgrade.jsonlz4-20250130195129
sessionstore.jsonlz4
storage.sqlite
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
recovery.jsonlz4
2823318777ntouromlalnodry--naod.sqlite-shm
2918063365piupsah.sqlite