Overview

overview

6

Static

static

3

ctw.dll

windows11-21h2-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    285s
  • max time network
    287s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 21:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ctw.dll
  • Size 47.9MB
  • Sample260601-z6mypafv21
  • SHA256 1b7ebcc70592b8cde79fbd22c12585d2398bf5638b2a24df129655056099cf3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ctw.dll,#1
    1⤵
      PID:2172
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffe5f92c188,0x7ffe5f92c194,0x7ffe5f92c1a0
        2⤵
          PID:5504
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,4219513726781346132,11983706888820559288,524288 --field-trial-handle=2176,i,16256170508009673434,18340662006211208360,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
          2⤵
          • System Time Discovery
          PID:4808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,14583155324614389829,8417257984085765202,262144 --field-trial-handle=2176,i,16256170508009673434,18340662006211208360,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
          2⤵
            PID:664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5475679448574064299,3133131169100915634,524288 --field-trial-handle=2176,i,16256170508009673434,18340662006211208360,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
            2⤵
              PID:4784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12342860955468877743,3403677622552588204,2097152 --field-trial-handle=2176,i,16256170508009673434,18340662006211208360,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
              2⤵
                PID:840
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2030635008357623298,4923086252855708451,2097152 --field-trial-handle=2176,i,16256170508009673434,18340662006211208360,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                2⤵
                  PID:5332
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                  2⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5448
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe5f92c188,0x7ffe5f92c194,0x7ffe5f92c1a0
                    3⤵
                      PID:4580
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,13556314587060596942,9169070573134335337,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
                      3⤵
                      • System Time Discovery
                      PID:1536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,242088723225507867,9944061653719259448,262144 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
                      3⤵
                        PID:4832
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,13989089690171777740,13430737525594673309,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
                        3⤵
                          PID:4976
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,5196859657567465530,5518025697153164741,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                          3⤵
                            PID:904
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,5196859657567465530,5518025697153164741,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                            3⤵
                              PID:4268
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,3810922361427705675,13076370632134354306,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                              3⤵
                                PID:2296
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,18040001629928735284,6244349085818818253,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                                3⤵
                                  PID:3724
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,4694742353570897953,15419169628370160341,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                                  3⤵
                                    PID:1064
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,6385034555430625210,13842494331419636257,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=1604 /prefetch:14
                                    3⤵
                                      PID:4608
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,11451093051321533829,11376159808904748100,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                                      3⤵
                                        PID:448
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,17632788095102895834,15082506911973997164,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                        3⤵
                                          PID:2364
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,9054207128075888777,5681456764925614649,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                          3⤵
                                            PID:3360
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4984,i,13005684348015206415,10364748503844680147,262144 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:10
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3304
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5148,i,975191094971682229,12429564936736832715,2097152 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
                                            3⤵
                                              PID:4760
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5256,i,10394349675061955275,15767461308579834365,2097152 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
                                              3⤵
                                                PID:444
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6810748687758965514,11470139863572657624,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
                                                3⤵
                                                  PID:6180
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,15462033766442399863,16243590886297854219,524288 --field-trial-handle=2052,i,17278422044027237965,4943753284071894065,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
                                                  3⤵
                                                    PID:6536
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                    3⤵
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies registry class
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:5212
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffe5f92c188,0x7ffe5f92c194,0x7ffe5f92c1a0
                                                      4⤵
                                                        PID:3312
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,378104148076894561,389145181191395347,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
                                                        4⤵
                                                        • System Time Discovery
                                                        PID:5980
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,3597788184602763371,15197953437456766898,262144 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
                                                        4⤵
                                                          PID:6732
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,18057776409025184629,7597809738352138562,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
                                                          4⤵
                                                            PID:4604
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,12786608855519223510,12077011829090824097,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
                                                            4⤵
                                                              PID:6724
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,12786608855519223510,12077011829090824097,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
                                                              4⤵
                                                                PID:784
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,13198860117013891972,5771793114523150557,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                4⤵
                                                                  PID:3028
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,16907780477815475704,13374203655569472630,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:14
                                                                  4⤵
                                                                    PID:412
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,13127566868769392047,10757688888400517462,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
                                                                    4⤵
                                                                      PID:4244
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4904,i,1485880315698517879,18028303976406565326,2097152 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
                                                                      4⤵
                                                                        PID:2016
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4892,i,14463995255369905227,15949789950793200327,2097152 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
                                                                        4⤵
                                                                          PID:1804
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,7664493390531852520,8560124329498637152,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
                                                                          4⤵
                                                                            PID:3648
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,17212183295356508594,11360752044117674499,524288 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                                                                            4⤵
                                                                              PID:5156
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5820,i,9503556186846776267,16663898411213038527,2097152 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
                                                                              4⤵
                                                                                PID:5452
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6088,i,6570450739753126078,15140707486334065325,2097152 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
                                                                                4⤵
                                                                                  PID:6944
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5860,i,15018696128362973246,6716131264940652353,2097152 --field-trial-handle=2656,i,17719004143651586231,8403520052993709682,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
                                                                                  4⤵
                                                                                    PID:6936
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                    4⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Modifies registry class
                                                                                    PID:5836
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe5f92c188,0x7ffe5f92c194,0x7ffe5f92c1a0
                                                                                      5⤵
                                                                                        PID:6396
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,13910607193312852252,16463181093289037131,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
                                                                                        5⤵
                                                                                        • System Time Discovery
                                                                                        PID:2252
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,16432094969249648974,13218133788478111860,262144 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
                                                                                        5⤵
                                                                                          PID:1136
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,13304371015442118670,7191091260289514730,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
                                                                                          5⤵
                                                                                            PID:5800
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,2151237299345058763,12412861129068813194,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
                                                                                            5⤵
                                                                                              PID:1004
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,2151237299345058763,12412861129068813194,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
                                                                                              5⤵
                                                                                                PID:1800
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,4942007932815998714,16743673085575370924,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:5948
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,2550374051114348190,17145660412945633584,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:3024
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,9741979569278979696,3524636473648993613,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                                                                                                    5⤵
                                                                                                      PID:2788
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,7222560066934243658,16976756580276628014,524288 --field-trial-handle=2072,i,18062656150631452549,1739327415908767097,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
                                                                                                      5⤵
                                                                                                        PID:1116
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:5132
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                  1⤵
                                                                                                    PID:5888
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:4240
                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                      1⤵
                                                                                                        PID:3856
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                        1⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5276
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                          2⤵
                                                                                                          • Checks processor information in registry
                                                                                                          • Modifies registry class
                                                                                                          • NTFS ADS
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3500
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {13dfc4e9-f825-4bca-b5f1-f88d9ef2fa9d} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                            3⤵
                                                                                                              PID:1884
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {7e2faa87-b731-4ed9-9f3d-22ca43f43761} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:5668
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {1c96a98c-b6c5-4e10-a3a6-62046515301c} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:6020
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {0ee61e2c-b8da-40ad-8993-56c73e36171a} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                              3⤵
                                                                                                                PID:3180
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4584 -prefsLen 34773 -prefMapHandle 4588 -prefMapSize 270279 -jsInitHandle 4592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3136 -initialChannelId {916c7a8c-8985-4d4b-8bb0-1d43be5cb12d} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                3⤵
                                                                                                                • Checks processor information in registry
                                                                                                                PID:4760
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4892 -prefsLen 34822 -prefMapHandle 4896 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {7ab488f4-d3ea-462b-bf24-561e9822473c} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                3⤵
                                                                                                                  PID:5948
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 33031 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {7ee77684-13f4-430b-9ee3-c1a1d2e92f0c} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:5420
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 33031 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {9ff211b8-f6d5-4e61-8ac1-ac52d6e7c8c8} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:8
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 33031 -prefMapHandle 6068 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {57164325-411d-4155-80fc-bd876530ed97} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:2508
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3436 -prefsLen 33071 -prefMapHandle 940 -prefMapSize 270279 -jsInitHandle 1276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1284 -initialChannelId {69dce7a9-1311-4bf3-9a0b-87126957fd52} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:4484
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6892 -prefsLen 33071 -prefMapHandle 6896 -prefMapSize 270279 -jsInitHandle 6900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6908 -initialChannelId {f58963cf-787e-4b5e-b77d-350543724fbe} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:1240
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7100 -prefsLen 33071 -prefMapHandle 7104 -prefMapSize 270279 -jsInitHandle 7108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7116 -initialChannelId {eedee66e-b646-4c38-9318-c1421edea50f} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:2744
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6644 -prefsLen 35181 -prefMapHandle 6648 -prefMapSize 270279 -ipcHandle 6592 -initialChannelId {4ad750cc-3fd9-470b-88cc-cc68491b655d} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:1920
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7092 -prefsLen 35181 -prefMapHandle 7028 -prefMapSize 270279 -ipcHandle 7388 -initialChannelId {dfceadc8-692c-4fb9-a344-9bf0953cc6e6} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:4648
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 33071 -prefMapHandle 5964 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6104 -initialChannelId {6566ab7f-e28f-403d-a5ed-7fc686fb5308} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:3608
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7516 -prefsLen 33071 -prefMapHandle 7520 -prefMapSize 270279 -jsInitHandle 7524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6180 -initialChannelId {33affdaf-3ce9-45a1-be9e-3a45ebaa98d4} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:4668
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2844 -prefsLen 33071 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6380 -initialChannelId {6b1e1f54-c705-431e-a3fe-bfa283504b3d} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:6736
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7036 -prefsLen 33261 -prefMapHandle 7524 -prefMapSize 270279 -jsInitHandle 5944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2844 -initialChannelId {25f3d612-fe11-4916-8740-dfb09433d254} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:7012
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7676 -prefsLen 33261 -prefMapHandle 7680 -prefMapSize 270279 -jsInitHandle 7684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7632 -initialChannelId {80c90835-8fea-4cf7-ade9-cb20e6ff48dc} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:7020
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172 -prefsLen 36757 -prefMapHandle 4896 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4548 -initialChannelId {a3a8bdce-0907-4fa8-ab80-a3b90208927d} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:2304
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6528 -prefsLen 36757 -prefMapHandle 6088 -prefMapSize 270279 -jsInitHandle 6140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {0e903eb2-7589-4867-8c38-6e6a376a794e} -parentPid 3500 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3500" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
                                                                                                                  3⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:7148
                                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5468
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?launchContext1=Microsoft.Windows.Search_cw5n1h2txyewy&url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dnotepad%26form%3DWNSHVR%26qs%3DEP%26cvid%3D22d97b9c02cd49f6912565833da0f1b3%26pq%3Dnotepad%26cc%3DUS%26setlang%3Den-US%26nclid%3D24DCECE20C4EF7E84E022FAB726D8552%26ts%3D1780348985171%26nclidts%3D1780348985%26tsms%3D171%26wsso%3DModerate%26PC%3DWSBQUF2
                                                                                                              1⤵
                                                                                                                PID:1272
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:6692
                                                                                                                • C:\Users\Admin\Downloads\x64\ProcessHacker.exe
                                                                                                                  "C:\Users\Admin\Downloads\x64\ProcessHacker.exe"
                                                                                                                  1⤵
                                                                                                                  • Enumerates connected drives
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:652
                                                                                                                • C:\Users\Admin\Downloads\x64\kprocesshacker.sys
                                                                                                                  C:\Users\Admin\Downloads\x64\kprocesshacker.sys
                                                                                                                  1⤵
                                                                                                                    PID:4756
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?launchContext1=Microsoft.Windows.Search_cw5n1h2txyewy&url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dnotepad%252b%252b%26filters%3Dufn%253a%2522Notepad%252b%252b%2522%2Bsid%253a%25220ad0f2fd-e465-95ec-15f9-a5c5a03fb776%2522%26asbe%3DFT%26form%3DWSBEDG%26qs%3DMB%26cvid%3Db7b94a1ed5fe4ab4916b711324ebcd89%26pq%3Dnotepad%26cc%3DUS%26setlang%3Den-US%26nclid%3D24DCECE20C4EF7E84E022FAB726D8552%26ts%3D1780349025094%26nclidts%3D1780349025%26tsms%3D094%26wsso%3DModerate%26PC%3DWSBQUF2
                                                                                                                    1⤵
                                                                                                                      PID:4120
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                      1⤵
                                                                                                                        PID:2432
                                                                                                                      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                                                                        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\OptimizeSearch.odt"
                                                                                                                        1⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:3016

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 2bc2505df2366fdc0f9f45c73f9137a2af372321a595ea375c0f1ae1fb9a55b0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 cc331ddbc3357f49196bd68c61bf8f99c64607c7e02efbbd0deb833835ed3577
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 cf9f149b0f60a8e384d0822baafe8b8a0edecdf4543cbfe31d2908386f76a4aa
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            BrowsingTopicsState
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                            • Size 649B
                                                                                                                            • SHA256 8f4e819990b2ef4f89f6eb9c670af5772f284353640804aa9b7df97ca1377354
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data_0
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
                                                                                                                            • Size 44KB
                                                                                                                            • SHA256 fd9caca41dac8fe9e3f3ffdec6e6d3a91968aa037ee6732f04fe9484f5d83845
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 b7e2cd3ca3bc7793415ce6a499a9c10c03d94e25c45e3a822bacf212223e7269
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data_3
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
                                                                                                                            • Size 8.0MB
                                                                                                                            • SHA256 310311666bfaf3abb7b6adef5a0ffc1d7b01ed7e666af34a5a385ea0d1e575fc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            f_00008d
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
                                                                                                                            • Size 38KB
                                                                                                                            • SHA256 ea953fedbf7cc5c24655aa64b62ce4daf2b4c0bf933bba74c1877d513ce74840
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 05bf71f3db25a486f8c7571a8812dc518ce2977ce044daacaacfcd34f2cc0100
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 89059cd290ffce0eb0352612ab7e8ba6e47993b22f6b1fa678e4ef93825e590e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            the-real-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 cff3ae401a8c47c141c32a1d4f8f0edcbfd5d99574f218c42bf8db50f2ca5fe9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
                                                                                                                            • Size 343B
                                                                                                                            • SHA256 3b20b02dbe4c82a1fa1d54a840eab427ba688aa6c9a0c720aa6d59e53211f261
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                                                                                            • Size 319B
                                                                                                                            • SHA256 84f0cd987babf089546e92ce2f6dbf35e5e3e3ac18015f420561f4b654661a48
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            HubApps
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                            • Size 106KB
                                                                                                                            • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                            • Size 334B
                                                                                                                            • SHA256 eb57057f9bbf131229923fe0e6e0ef35240da22a1e23025d604ac1d5e828c72d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            7380bb72-37e7-4192-8bd7-64f6aa0d6d74.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7380bb72-37e7-4192-8bd7-64f6aa0d6d74.tmp
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 4789f33de758a59ee0ae6bd30b0c9605315ed30819dcb2feec8e4dfc0970e5ff
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Cookies
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                                                                                                            • Size 20KB
                                                                                                                            • SHA256 7f219023e96e23bd91f0b9ef7d87b62ec8f5ab4e330a1780e15efd39ca1eb39e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Cookies-journal
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 a1b8ede7c6c28c25393b89549986f535a2a6e7e1cfa82ff8ce78f96b20238343
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 53e7397cb71cf2765c8bf56cf41159656aa7f59595e3550f69e77c7e66db07d9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 09d8dec480f14b1168303a6dcc7364883e357c7c27fca2e550e2a7c5a9966f3a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 6db670da3a00c0235df19255deec57f5139c49d5fafa830d66010383788f12ca
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SCT Auditing Pending Reports
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Sdch Dictionaries
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            TransportSecurity
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 0bc2595b30c63e569d1044ecda1d5698d0d7dd790cf25a0779cab6a3590a6fca
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            TransportSecurity
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                            • Size 522B
                                                                                                                            • SHA256 3b3f5106fc7cd95cc49fae9575c79f16d50dd7e521f7d0409d9edafd5b6b3b65
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 21KB
                                                                                                                            • SHA256 66182a5549fd74c3446bd1981944694e57a16edc69bb624b71052bbb28a68383
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 20KB
                                                                                                                            • SHA256 f1da036ccbdea830c3fd9fb806f0217c6154a0aa50d709666c029c5a81a9613a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 15KB
                                                                                                                            • SHA256 f3c98857b73a54c15f33256281003a6f043d9bdd2a73d0c40076a10e5cb657c4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 15KB
                                                                                                                            • SHA256 498afa4efeef03f02b170c78479b906df8f6390d3bb08fcfed8670e4547784d6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 36KB
                                                                                                                            • SHA256 fb0a28a3e446db2176b670c9046b995ad0d69096767d51cce1834a4a0dbc8360
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
                                                                                                                            • Size 335B
                                                                                                                            • SHA256 49454e73d8c3a688d0ff0eda66fbf27345e090501a880f1f12a0572e7b8c13a4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            000003.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
                                                                                                                            • Size 716B
                                                                                                                            • SHA256 14e974c7b25f61e1798e4ce71f035ac7c06b6750e713be197c8c3225a9318dc3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
                                                                                                                            • Size 322B
                                                                                                                            • SHA256 5b56bdd728f8d235c888fcb50af1dc7ddc7380aef9a7eb216ff1784dc078690e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Session_13424822460226046
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13424822460226046
                                                                                                                            • Size 392B
                                                                                                                            • SHA256 0e165825731ea19e26d58b3c8d026317118cfd719c72b31eb7e2405e4f97b6fb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                                                            • Size 347B
                                                                                                                            • SHA256 ed4c366f1d35253671c33a12cdccf0569da86b5cdb43e40cad3b6dfc6744c37c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                            • Size 326B
                                                                                                                            • SHA256 72a724c29fbb89bb11f0d7d4a64033e50d7b3609490c43cceaf3b142fda024f5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 26KB
                                                                                                                            • SHA256 5f66ad9a8670fa7c1fe03669a2175abf9db4282f8ba15b8292c678cc2f04e46e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Web Data
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                                            • Size 224KB
                                                                                                                            • SHA256 22605bc20c1a86786756f9e2a8e3d35ca806306a755b6938a747546c7d14ea56
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            default_cloud_config.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            load_statistics.db
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                                                                                            • Size 120KB
                                                                                                                            • SHA256 78091e0851292d83e8da9a662fd2ed8dfa4bb4e4961e44a870091545db295e65
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            000003.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 4d09ef78b1b43a410e46312ac523bf78d9e5321175a1446d455601d0e07210f8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
                                                                                                                            • Size 322B
                                                                                                                            • SHA256 ebc1887b9e8068fbad1c82a1803a3657a5898e20098beb5f723f2eda250796db
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            000003.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 209bddb590b7bb8ffc54c72cc7aa3ce6c607163300e6134e61e9cd482bd05a93
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                                                                                            • Size 340B
                                                                                                                            • SHA256 538dcdfeef954e9fc82c874cf5cf982758db0e59123d242b64272a6cfd639917
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 cea66298cee52ba91b969f46f17c10508eddf95821ac86a656a818f06d7dfcd5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Last Version
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                                            • Size 14B
                                                                                                                            • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 30KB
                                                                                                                            • SHA256 115267087248b539501ec15b6c087102f4ca7c60d4ceb78db08f788c4c21ac1a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 52KB
                                                                                                                            • SHA256 73c3ef0b8253f906ce5d295cbd5488294a2615fdd8ceb874b091aed91cdd04e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 26KB
                                                                                                                            • SHA256 e36bd9b0ad981d84b7f8195f31cabb97209674a173866510fa4e576e9e94368a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 34KB
                                                                                                                            • SHA256 95045038e47a2c238bae720802b29c21d5d8ead962b49f72b76f36d75cce1256
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 31KB
                                                                                                                            • SHA256 f0ca023648471a62b005b4428a3e7d840c7637bf110ab2f990525a4e2ada5b9a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 24KB
                                                                                                                            • SHA256 cfee1374fb7d4e777666cf7e6b1dfd1c063cf7c3286ac77ed7fefcd0bf4b8b26
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 23KB
                                                                                                                            • SHA256 776f39ba78686146faac1387dddb82502ad2aee2c661267edc55ee0565e503ac
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 24KB
                                                                                                                            • SHA256 6243ab4f63fc1dedf33ff2675a9ebb95f8b85c15aaad720fafe5097fea6efd8d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 30KB
                                                                                                                            • SHA256 80a52a603310b31612d6efca5c88c7ddefe9d44eaf29e39584b07a114fc96915
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 52KB
                                                                                                                            • SHA256 03bf658f1310d4e7756f986d90a328a7f03cd9fac2dc81655d2bf7545d7c3d12
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 0e6f757b5eebecc78fc0862a6eaea3d46a76a0c2c065712164abf7a0876d76f2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            typosquatting_list.pb
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
                                                                                                                            • Size 507KB
                                                                                                                            • SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Variations
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                                                                            • Size 86B
                                                                                                                            • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 99eed550224da0ac033a7de3ebc6b465509e6b232fdfe2cfd7f4c71438df5e03
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 6278efbd1ea2a760694d83a82bf9482772b9d4ee00ca57c1ef7e9fd320658bf2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                            • Size 147KB
                                                                                                                            • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                            • Size 132B
                                                                                                                            • SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 489bb79013bf961f616af9b96df77f54dd825988107d501e7941bbb507285186
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            SearchHoverUnifiedTileModelCache.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 41bb41754520c44367bbb0e7e33ca145d0e963be665af4f45e06f4fab662eb3a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            SearchHoverUnifiedTileModelCache.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 c8bc5d3dd15b59560509fe926204c4f3ce1ac7eb357b9cf0318ecc265c2f5f49
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            6c1e18b3-54eb-41e6-bfcf-24a6fbf4e46e.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\6c1e18b3-54eb-41e6-bfcf-24a6fbf4e46e.tmp
                                                                                                                            • Size 1B
                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            iso690.xsl
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\TCDA0D9.tmp\iso690.xsl
                                                                                                                            • Size 263KB
                                                                                                                            • SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            tmpaddon
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            tmpaddon
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                            • Size 502KB
                                                                                                                            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            AlternateServices.bin
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 b0cff5715ddcb44d56ffe04d9660e6fbc95d5dbc5c28ff4033b9b3303211ebb7
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            AlternateServices.bin
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 e8d0e67df1812ea5176f75b75f10a2505486d70fcbfcc0cc75627f414ebcfcc4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            compatibility.ini
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\compatibility.ini
                                                                                                                            • Size 198B
                                                                                                                            • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data.safe.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                            • Size 53KB
                                                                                                                            • SHA256 9ae747f14d222c973444f1ec3971a4a8d6847d456c3952bd77647f1190a8fae6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data.safe.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 7944bd7ed8c50656285befeb70608f3a146512ea9431e1da5aa3316a1f8a2ef5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            data.safe.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 2dad11b1dbcd891f3705f7434319b6cefa8a2fb47c99e4955c5322ec1b544df3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            events
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\events\events
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 8203a3f9bcc8e66cfa8a61c4d395518c392948b23e08103a9a54cdb346a170da
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            events
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\events\events
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 9958c165afbbe5268e8373b94e0f1d6ef0563367971b38c0258fd5f4230c19b5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            0cf105ce-acfd-4cd9-8c74-890fb71dac85
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\0cf105ce-acfd-4cd9-8c74-890fb71dac85
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 1c61909864da7413f527587fb5f4baf7eca71d8b0d2e2bde73abf3ac57e554a7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            1dcb731d-410a-402e-94d1-a2a4fa883e70
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\1dcb731d-410a-402e-94d1-a2a4fa883e70
                                                                                                                            • Size 19KB
                                                                                                                            • SHA256 724ae02ee869b7695a42b747856b8262dc9638ebd6ae3e2ba233718fdf2332cc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2d1d587c-db7b-4980-b18e-534b3e49b186
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\2d1d587c-db7b-4980-b18e-534b3e49b186
                                                                                                                            • Size 886B
                                                                                                                            • SHA256 c5388440b2066379e9899fc89013784fb88a018f3c31d1f8b30324c5a6ad336b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            385fd433-39f2-4b6a-a2fd-7d6b4135448a
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\385fd433-39f2-4b6a-a2fd-7d6b4135448a
                                                                                                                            • Size 883B
                                                                                                                            • SHA256 b86e2d808d6e0277db931b69556b510d9f4de75102cfa5270c4bf81b9f85b5b1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            503af208-a203-4b10-adad-b495ebefbe4c
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\503af208-a203-4b10-adad-b495ebefbe4c
                                                                                                                            • Size 235B
                                                                                                                            • SHA256 5c22f286eb20b92c83111b866bd3e7a363f8ca96599b92f42523156693b1f9d5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            d7802457-03b4-459c-8efa-86d915367fa7
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\d7802457-03b4-459c-8efa-86d915367fa7
                                                                                                                            • Size 235B
                                                                                                                            • SHA256 417481de11a3a7922f7dc693843bb33b28b90a0212c9817ed34c8905b3668efe
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            e8fa3458-9fb9-4940-9cdd-fb2fcbd2c038
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\e8fa3458-9fb9-4940-9cdd-fb2fcbd2c038
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 73c887ef393c5bcb65bfb9187dbaef8e85b0b1bfa7e42241cf0e3e081ec1cd3d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            extensions.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\extensions.json
                                                                                                                            • Size 16KB
                                                                                                                            • SHA256 3db29e15eb7c2c523505b80c8672a8ba43ee3a10d0ba2ec711c3d9b0060377fd
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            gmpopenh264.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                                            • Size 1.1MB
                                                                                                                            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            gmpopenh264.info
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                                            • Size 116B
                                                                                                                            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                                                                            • Size 1002B
                                                                                                                            • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            widevinecdm.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                                                                            • Size 21.6MB
                                                                                                                            • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs-1.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
                                                                                                                            • Size 12KB
                                                                                                                            • SHA256 d2b7fa6f7e3839e76cb8399a1e7ccbe09d8a2b33278ccc2ecf79753952383ebe
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs-1.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 990a008346f53cffebb919567490a721d1361a1d48c98ce600cdb8e16d6eaf09
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs-1.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 63858e8454154b8190be17a63de3d18402ee2f5981bed77b4fddfe2d46729db5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs-1.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 0030ce9fae23328765ad4b7f0838c75a253e6c95493e56f12885081a3811ed27
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 bc4b826e78f82efb6cc428342aab46f044212d5509c2709c15f36db7bc453454
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            prefs.js
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
                                                                                                                            • Size 6KB
                                                                                                                            • SHA256 1dc04a9a69aea5d79078dffc4ad84c22d7fda3dbb1ca230b95a96bc51e327e24
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            recovery.baklz4
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 136d8adf292e7eeea10f7755fa2209e1aca895ba0bfbf189317d59a4b19986f9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            3870112724rsegmnoittet-es.sqlite
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 d57efa1c8ee29a48e4a6b760169859960f8c4fabbb49fa9797b7d5c616d06081
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            processhacker-2.8YBVzh4s.39-bin.zip.part
                                                                                                                            • Path C:\Users\Admin\Downloads\processhacker-2.8YBVzh4s.39-bin.zip.part
                                                                                                                            • Size 3.2MB
                                                                                                                            • SHA256 2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5448_2087847305\manifest.json
                                                                                                                            • Size 118B
                                                                                                                            • SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data.txt
                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5448_588139111\data.txt
                                                                                                                            • Size 146KB
                                                                                                                            • SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5448_588139111\manifest.json
                                                                                                                            • Size 52B
                                                                                                                            • SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LICENSE
                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_858067705\LICENSE
                                                                                                                            • Size 499B
                                                                                                                            • SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            manifest.json
                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_858067705\manifest.json
                                                                                                                            • Size 1001B
                                                                                                                            • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/784-2216-0x0000012380000000-0x0000012381000000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1800-2513-0x000002393DD80000-0x000002393ED80000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2516-0x00007FFE3F8D0000-0x00007FFE3F8E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2515-0x00007FFE3F8D0000-0x00007FFE3F8E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2519-0x00007FFE3EDF0000-0x00007FFE3EE00000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2520-0x00007FFE3EDF0000-0x00007FFE3EE00000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2517-0x00007FFE3F8D0000-0x00007FFE3F8E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2518-0x00007FFE3F8D0000-0x00007FFE3F8E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3016-2514-0x00007FFE3F8D0000-0x00007FFE3F8E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4268-299-0x000001E792970000-0x000001E793970000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4756-2217-0x0000000000010000-0x000000000001B000-memory.dmp
                                                                                                                            Download