Analysis
- user interaction
yes - max time kernel
1312s - max time network
1530s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/09/2026, 01:58
General
- Target https://annas-archive.gl/search?q=9781337696609&check=1
- Sample260901-cdxwvsvtht
Score
7/10
Malware Config
Signatures
- A potential corporate email address has been identified in the URL 8 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Detected potential entity reuse from brand GOOGLE. 1 IoCs
- Drops file in System32 directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 20 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://annas-archive.gl/search?q=9781337696609&check=11⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2961c728,0x7fff2961c734,0x7fff2961c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,17000349623895301405,8462906663172882055,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:112⤵
- A potential corporate email address has been identified in the URL
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,11820343420744471914,14332224164410661988,262144 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,4292391830980974601,9339003498399642718,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,5432883145326299039,6877716906281733866,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,17092462835944560856,12879340139342847633,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,4253449254749194641,5019884383588353584,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,5410650286410164456,8346115974689790029,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4148,i,9127861217387730290,3471149644871895215,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,151430755974362976,16404722692073932719,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,430240765912176929,10320303443871670318,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,8738735560390466455,11131430158731032013,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,2873662732094030683,3820109032227688618,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4344,i,3228589609463698587,4762214595873948308,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3140,i,4900262415988404464,3123456699169310091,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3116,i,6008413434935781836,9263345128240187080,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5824,i,8343659944903757003,18135802341027962073,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4380,i,5130653201453501265,8831914747015059165,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6324,i,9843375489130461896,10046444910456210805,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6440,i,15537074809657877686,2048873105694343232,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6348,i,7154247988040594556,12173690386919698441,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5936,i,5878640985556340021,14852368803629712629,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3572,i,1004545698782778804,841678651666901872,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6604,i,5098360093620397063,12418011851670164423,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6676,i,10601191984263064130,5406942229636939164,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6932,i,6387347667508826255,8501543195358849339,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6068,i,11730019415139766691,6581839185019831740,262144 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6740,i,9702443174480392892,13639771370039533956,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7136,i,8144358720354047343,5689708174874169184,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6748,i,15874737779311923648,13340878255973611263,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4364,i,9452946359385424676,12128541915406399530,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7060,i,1437372402537483040,14651317046807232192,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6988,i,11622562519394566487,16008902121514049443,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4600,i,6085674950091823922,5097789988783624246,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6912,i,4087933727152367497,1820554486254712361,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7204,i,6157931220001434247,1975523355172695133,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3528,i,13492441957558799990,13172556511010610644,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,2882940637474521828,7250159558105239872,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6312,i,15488468996323078085,12244735740066318655,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7288,i,11315107382493747813,12782200265278184521,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7804,i,439867976225629327,11993854337883835605,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7752 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7836,i,15704670735348648268,14096399647311299338,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7936,i,15598084375810532702,11442473558748945510,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7704 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7012,i,11634036383931004896,2009323646021781167,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6272,i,5806151124285202782,6754497171609181598,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7780 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6356,i,8279406778221486654,9290665153628783856,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7084,i,4648300940278886604,1388004136745173007,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,17215395986101773323,8227739961216718678,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,12773569766554639244,10657877099095178295,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8220,i,6419836114804892272,12714051820955897807,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6480,i,18294524755211954494,10982334876052302107,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=5824,i,15300401127295872002,8378143213109055995,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6424 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6296,i,6964786820624622521,15483931991601626338,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=8460,i,7504988126948933350,13675929565097405020,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=1912,i,2640340638655707407,1905028460691404249,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7236,i,12147298716200653233,8177831409079672270,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8368 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=4576,i,3113390203645771100,1800919764364201802,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=3668,i,16840215494242823768,11778917563981349975,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=3624,i,12335572457317761311,2034613868319654186,2097152 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7780,i,4337760112267256131,7205469033329932109,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8264 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4380,i,3968107411297853403,5796770289459427630,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8036 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8636,i,2601261210040708270,7272464316599631770,524288 --field-trial-handle=1244,i,15958404310612952648,7999619868513593674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8604 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Gardner's Art Through the Ages_ A Global History, Volume II, -- Helen Gardner; Fred S Kleiner -- Cengage Learning EMEA (UK & Europe), [N_p_], 2018 -- isbn13 9781337630702 -- 2df7a3e8c6f46294c7f3e984a3096ea3 -- Anna.pdf"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Gardner's Art Through the Ages_ A Global History, Volume II, -- Helen Gardner; Fred S Kleiner -- Cengage Learning EMEA (UK & Europe), [N_p_], 2018 -- isbn13 9781337630702 -- 2df7a3e8c6f46294c7f3e984a3096ea3 -- Anna.pdf"2⤵
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {c6982ee2-9b4f-4b47-aeca-224d59b6234c} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {7b2556c0-92ac-44a3-9aa7-0b35c3d27b63} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3556 -prefsLen 27274 -prefMapHandle 3560 -prefMapSize 270279 -jsInitHandle 3564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3572 -initialChannelId {afabf715-7bed-4091-a0c1-13c55badf31b} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3720 -prefsLen 27274 -prefMapHandle 3724 -prefMapSize 270279 -ipcHandle 3792 -initialChannelId {3a7b7309-6c5b-415b-8ebe-1c5c3526787f} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4444 -prefsLen 34773 -prefMapHandle 4448 -prefMapSize 270279 -jsInitHandle 4452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {b408b57f-1d87-43df-89ae-936fbc6843b6} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2492 -prefsLen 35010 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {55a0c827-c8f7-4439-83c7-3b33a8db4298} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4892 -prefsLen 32952 -prefMapHandle 4156 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4468 -initialChannelId {62c7dfc8-cda2-49d3-a46b-bb8608f36d17} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {154658fb-f9f9-481f-821d-7d86113a66db} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32952 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {fa8e7b5b-8476-460f-8686-9c86f8d31eef} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Gardner's Art Through the Ages_ A Global History, Volume II, -- Helen Gardner; Fred S Kleiner -- Cengage Learning EMEA (UK & Europe), [N_p_], 2018 -- isbn13 9781337630702 -- 2df7a3e8c6f46294c7f3e984a3096ea3 -- Anna.pdf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fff0d8ec188,0x7fff0d8ec194,0x7fff0d8ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,6804187412323486552,18154931666236087940,262144 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,2822082857283655460,17673768832655008874,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,9214317176739278514,3525908923370260627,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,10116844936506866835,11665429838417905254,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5887800598218365918,159670523373496473,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,10428076638545641127,261581959939214898,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,9648605659988357752,18386316811485204375,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4600,i,235690351551540828,14884661128351845999,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4584,i,9476343619574837042,3057279799095611974,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5464,i,1204971801649856460,9257074417186645359,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,10458730990838215885,14541255349252066947,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5788,i,8657689752783994780,13648198200275006355,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:152⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,18433562418927531839,14703869952331590737,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,6026490030842890575,11625395663048944607,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4002125244870757774,3614101189094176614,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4002125244870757774,3614101189094176614,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11278256524614417510,2366048943798677671,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:142⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,11462120639670196421,11916070088496369802,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16143829626369979091,9919482403331330676,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,9528039994542818882,2855062518872103764,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,16026274943395484249,5977731556848176962,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,3391272922121686380,9461540436467884250,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4772,i,9258657596604097381,6827171292672184497,2097152 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,6302896961863679250,1813358821024777244,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,12562619278933581885,9801956543303367959,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,1937516329764799511,12445866051518872666,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,4002292751215422490,7394321884780765268,65536 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintingService --lang=en-US --service-sandbox-type=pdf_conversion --disable-win32k-lockdown --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,3408348623689268349,4070746895652865387,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,11455822140285792979,12124640438471274492,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7300,i,12266875968088078232,14867538993939574569,262144 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,3639902070774523726,7928310768641431679,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,5053074137088327485,11189917134205860867,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,15296335458989852138,18016883364623281149,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,17812132031295501582,13689787914365373604,524288 --field-trial-handle=2040,i,12175477970090017325,12069029997738739621,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00000c
f_00000f
f_000012
f_000013
f_000014
f_00001a
f_000022
f_00005a
f_00005b
f_00005c
f_00005d
f_00007b
f_00007c
f_000089
f_00008a
f_00008c
f_00008d
f_00008e
f_00008f
f_000091
f_000093
f_000094
f_0000a1
f_0000a3
f_0000cd
f_0000ce
f_0000d0
f_0000d3
f_0000d4
f_0000d5
f_0000d6
f_0000de
f_0000df
e980c6bcd5d294e7_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
History
LOG
LOG.old
LOG.old
000003.log
LOG
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old
LOG.old~RFe5dc47b.TMP
Login Data
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe587a2c.TMP
281fb6088c3cfbb2_0
the-real-index
Web Data
index.txt
index.txt
index.txt
index.txt~RFe5a9701.TMP
index.txt
index.txt~RFe5b73c5.TMP
000001.dbtmp
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
91028c61-0732-4dae-a15b-6d325ab71104.tmp
blocklist
settings.dat
settings.dat
LOG.old
MANIFEST-000001
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe6ed198.TMP
index.txt
sync_diagnostic.log
c3d678e9-b6e3-4955-a059-caa62dc50526.tmp
Local State
Local State
Local State
Local State
Local State
Local State
0d1a49fe-4eb1-4278-9a3a-4b214264c9d9.tmp
activity-stream.contile.json
5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
www.bing[1].xml
64e438c3-a2aa-40dd-9bdd-f3c827462947.tmp
fefd8fc5-dc15-4fcc-990e-e45cc4831b92.tmp
content_new.js
3d31eaf2-9dbd-414b-801d-de102129fde2.tmp
tmpaddon
tmpaddon
default.dic
08L850XMN3V2WV4SQJG4.temp
6824f4a902c78fbd.customDestinations-ms
compatibility.ini
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
0c2a8436-ca06-47e2-afec-41bb70558540
325a2b9f-2306-4c09-9316-4f3ffd8c2986
aa682f78-9357-41ac-8c8c-3563116cb5fc
b41bf1d9-c6e8-490b-b923-8388060cc795
b66c73cc-ea3e-4c26-81b5-3de824ea13b2
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
Gardner's Art Through the Ages_ A Global History, Volume II, -- Helen Gardner; Fred S Kleiner -- Cengage Learning EMEA (UK & Europe), [N_p_], 2018 -- isbn13 9781337630702 -- 2df7a3e8c6f46294c7f3e984a3096ea3 -- Anna.pdf:Zone.Identifier
b4d08507-e2ba-4fff-8231-724eaf1d96da.tmp
memory/7612-5699-0x00000178A1720000-0x00000178A1820000-memory.dmp
memory/7612-5706-0x00000178B24E0000-0x00000178B25E0000-memory.dmp
memory/7612-5726-0x00000178D35E0000-0x00000178D36E0000-memory.dmp
memory/7612-5762-0x00000178D5240000-0x00000178D5260000-memory.dmp
memory/7612-5760-0x00000179D5720000-0x00000179D5820000-memory.dmp
memory/7612-5759-0x00000179D5640000-0x00000179D5660000-memory.dmp
memory/7612-5848-0x00000179D74A0000-0x00000179D75A0000-memory.dmp
memory/7860-5114-0x000001E9F9100000-0x000001E9F912C000-memory.dmp
memory/7860-5116-0x000001E9FB6E0000-0x000001E9FB6E8000-memory.dmp
memory/7860-5115-0x000001E9FB6B0000-0x000001E9FB6BA000-memory.dmp
memory/7860-5118-0x000001E9FBAB0000-0x000001E9FBB58000-memory.dmp
memory/7860-5119-0x000001E9FB760000-0x000001E9FB782000-memory.dmp
memory/7860-5125-0x000001E9FB740000-0x000001E9FB754000-memory.dmp