115ceee009e27b1ce12ff2b893e1bd08e3e9690c6ca79e1313784ccd0a74e06e

Modify Registry

Processes:

instup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgNetHub\ImagePath = "system32\\drivers\\avgNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSP\ImagePath = "system32\\drivers\\avgSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArDisk\ImagePath = "system32\\drivers\\avgArDisk.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgKbd\ImagePath = "system32\\drivers\\avgKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRvrt\ImagePath = "system32\\drivers\\avgRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbuniv\ImagePath = "system32\\drivers\\avgbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgStm\ImagePath = "system32\\drivers\\avgStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsh\ImagePath = "system32\\drivers\\avgbidsh.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgVmm\ImagePath = "system32\\drivers\\avgVmm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsdriver\ImagePath = "system32\\drivers\\avgbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSnx\ImagePath = "system32\\drivers\\avgSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArPot\ImagePath = "system32\\drivers\\avgArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRdr\ImagePath = "system32\\drivers\\avgRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgElam\ImagePath = "system32\\drivers\\avgElam.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgMonFlt\ImagePath = "system32\\drivers\\avgMonFlt.sys"	instup.exe

Executes dropped EXE 37 IoCs

Processes:

avg_antivirus_free_setup(1).exeavg_antivirus_free_setup(1).exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeavBugReport.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeSetupInf.exeoverseer.exeengsup.exewsc_proxy.exewsc_proxy.exeengsup.exeHousecallLauncher64.exesetup.exehcpackage64.exe.tmppatch64.exehousecall.bin

pid	process
8020	avg_antivirus_free_setup(1).exe
7076	avg_antivirus_free_setup(1).exe
6868	avg_antivirus_free_setup_x64.exe
7440	instup.exe
6280	instup.exe
5724	aswOfferTool.exe
5712	aswOfferTool.exe
7668	aswOfferTool.exe
7748	aswOfferTool.exe
8008	aswOfferTool.exe
7220	aswOfferTool.exe
5232	aswOfferTool.exe
7540	aswOfferTool.exe
7228	sbr.exe
13968	SetupInf.exe
14212	SetupInf.exe
7576	SetupInf.exe
10512	SetupInf.exe
8220	SetupInf.exe
8456	AvEmUpdate.exe
10484	AvEmUpdate.exe
10904	avBugReport.exe
11520	RegSvr.exe
12112	RegSvr.exe
11920	RegSvr.exe
12272	RegSvr.exe
8472	SetupInf.exe
8908	overseer.exe
8356	engsup.exe
14004	wsc_proxy.exe
10188	wsc_proxy.exe
11120	engsup.exe
8556	HousecallLauncher64.exe
8632	setup.exe
11480	hcpackage64.exe.tmp
12676	patch64.exe
3048	housecall.bin

Loads dropped DLL 64 IoCs

Processes:

avg_antivirus_free_setup(1).exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeengsup.exewsc_proxy.exewsc_proxy.exeengsup.exesetup.exe

pid	process
7076	avg_antivirus_free_setup(1).exe
7440	instup.exe
7440	instup.exe
7440	instup.exe
7440	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
7668	aswOfferTool.exe
8008	aswOfferTool.exe
5232	aswOfferTool.exe
7540	aswOfferTool.exe
10484	AvEmUpdate.exe
10484	AvEmUpdate.exe
10484	AvEmUpdate.exe
10484	AvEmUpdate.exe
11520	RegSvr.exe
12112	RegSvr.exe
11920	RegSvr.exe
11920	RegSvr.exe
11920	RegSvr.exe
11920	RegSvr.exe
11920	RegSvr.exe
12272	RegSvr.exe
12272	RegSvr.exe
12272	RegSvr.exe
12272	RegSvr.exe
12272	RegSvr.exe
12272	RegSvr.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
8356	engsup.exe
2484
6280	instup.exe
14004	wsc_proxy.exe
10188	wsc_proxy.exe
14004	wsc_proxy.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
11120	engsup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

RegSvr.exeinstup.exeRegSvr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\asOutExt.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\AVG\\Antivirus\\ashShell.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\AVG\\Antivirus\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ThreadingModel = "Apartment"	RegSvr.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

instup.exewsc_proxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

instup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 24 IoCs

Security Software Discovery

T1063

Processes:

SetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeRegSvr.exeavg_antivirus_free_setup_x64.exeinstup.exeengsup.exewsc_proxy.exeinstup.exeSetupInf.exeAvEmUpdate.exeSetupInf.exeRegSvr.exeRegSvr.exeengsup.exeSetupInf.exeRegSvr.exewsc_proxy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2897 api64.ipify.org
2898 api64.ipify.org
2943 api64.ipify.org
2892 api64.ipify.org
2896 api64.ipify.org

flow	ioc
2897	api64.ipify.org
2898	api64.ipify.org
2943	api64.ipify.org
2892	api64.ipify.org
2896	api64.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 19 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

instup.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeRegSvr.exeSetupInf.exewsc_proxy.exeAvEmUpdate.exeavBugReport.exeoverseer.exeavg_antivirus_free_setup(1).exeinstup.exeRegSvr.exeRegSvr.exeavg_antivirus_free_setup_x64.exeRegSvr.exewsc_proxy.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup(1).exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe

Drops file in System32 directory 3 IoCs

Processes:

instup.exeSetupInf.exe

description	ioc	process
File created	C:\Windows\system32\asw5e00e7bff2669b18.tmp	instup.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe
File opened for modification	C:\Windows\system32\asw5e00e7bff2669b18.tmp	instup.exe

Drops file in Program Files directory 64 IoCs

Processes:

instup.exesetup.exehcpackage64.exe.tmpengsup.exe

description	ioc	process
File opened for modification	C:\Program Files\AVG\Antivirus\avg.vc140.crt	instup.exe
File created	C:\Program Files\Trend Micro\HCBackup\hcversion64.xml.tmp	setup.exe
File created	C:\Program Files\Trend Micro\HouseCall\interface\lib\jqgrid\jquery.jqGrid.min.js	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswbe8f530a03e0ddd4.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\RescueDisk\asw4f08260e7003b4ef.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\db_fn.nmp.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\OpenSSL.txt.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\prod-pgm.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\asw40bd519ec7f4b1bf.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Inf\x64\avgMonFlt.sys.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.sum	instup.exe
File created	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw3d6c7d7cb643aa9b.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswfe5241c5db1fcea5.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\asw21a0c9790448a657.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\asw172f5898090034a6.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\xxHash.txt.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\aswdae82081736350e6.tmp	instup.exe
File created	C:\Program Files\Trend Micro\HouseCall\interface\css\datatable_act_icons.css	hcpackage64.exe.tmp
File created	C:\Program Files\AVG\Antivirus\Licenses\asw7d4d7c44353fe6d4.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\RegSvr.exe	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Certificates\avast.der	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Inf\x86\avgNdisFlt.sys	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Inf\aswHwid.inf	instup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\images\[email protected]	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_gen_tools_x64-8dd.vpx	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040199\asw95ea71fd12585dc6.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\db_w6c.map	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswremoval.dll.sum	instup.exe
File created	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\aswf24950a960eac1d1.tmp	instup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\lib\jqgrid\i18n\grid.locale-bg1251.js	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\Trend Micro\HouseCall\tscdll64.dll	setup.exe
File created	C:\Program Files\Trend Micro\HCBackup\temp_bf_1100000000_2147430218_1680448642.retry	setup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\asw60f9b09999a65b80.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\asw78bf35626aefc0f0.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\asw9e7e9c72f8a31793.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswsecapi.dll.sum	instup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\images\bg_inputbox_l.png	hcpackage64.exe.tmp
File created	C:\Program Files\Trend Micro\HouseCall\interface\images\Thumbs.db	hcpackage64.exe.tmp
File created	C:\Program Files\Trend Micro\HouseCall\plugin\downloader.plugin.dll	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\asw7de93568c76d85a7.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\asw206ed88e8316440d.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\asw9b0c973206203db2.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\db_fn.nmp	instup.exe
File created	C:\Program Files\Trend Micro\HouseCall\IncompatibilityAction.xml	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\Trend Micro\HouseCall\HouseCallX_x64\MustFBExts.conf	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040199\aswa941432d57ba4297.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\asw47edebbb90852c53.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\uiLangRes.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\lexbor.txt	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\ais_cmp_secdns_hlp-*.vpx	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040199\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll	engsup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\images\bg_step.png	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\lib\jqgrid\i18n\grid.locale-bg.js	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswff2e1313a43692bc.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\1033\asw155bb9edd1b589e7.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswAv.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\custody.dll	instup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\tray\ui\jquery	hcpackage64.exe.tmp
File created	C:\Program Files\Trend Micro\7zSC61474C0\AU\AU_Data\AU_Temp\8632_10192\AU_Down\pattern\tmwlchk_192800.zip	setup.exe
File opened for modification	C:\Program Files\Trend Micro\HouseCall\interface\images\img_hclogo_96.png	hcpackage64.exe.tmp
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\aswe4f096341e95e625.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\sbr.exe.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswWrcIEBroker32.dll	instup.exe

Drops file in Windows directory 2 IoCs

Processes:

instup.exe

description	ioc	process
File created	C:\Windows\ELAMBKUP\asw1569f22399aebb85.tmp	instup.exe
File opened for modification	C:\Windows\ELAMBKUP\asw1569f22399aebb85.tmp	instup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8476 7868 WerFault.exe firefox.exe

pid	pid_target	process	target process
8476	7868	WerFault.exe	firefox.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

instup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	instup.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RegSvr.exeRegSvr.exewsc_proxy.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeinstup.exeAvEmUpdate.exeAvEmUpdate.exeSetupInf.exefirefox.exewsc_proxy.exeengsup.exefirefox.exeRegSvr.exefirefox.exeSetupInf.exeinstup.exeRegSvr.exeavg_antivirus_free_setup_x64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

instup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

Processes:

RegSvr.exeiexplore.exeIEXPLORE.EXERegSvr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a97000000000200000000001066000000010000200000006a85569f3a704a291e659099e9ed4424ace4e2e68d1b43b8800a308be440490a000000000e8000000002000020000000fba71954809621cf8272fae17e9f7e64a7ef7b9e6ee0117f998eb7aeecf9150720000000d6a9da5d2485210b5af33ec48004fed0b6ffc7bce49b26999e9eafdb2161fbbf40000000d816b40cd727316b8f009d387496e4d824385abdef78d361c43e8f86880c730371c64e72f69e9f74a3cd1d405ab933b3ae7ae6338b7f525c23142fccbbe6ab4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a970000000002000000000010660000000100002000000091b81d8fb24008d9596c2ad12b3021d5b5184fc1eb1fbf5d476b62f00472e721000000000e8000000002000020000000826457fd479715172378a252f2b5c9df7e2f4d368899f4b49337bcf60faaa4992000000075333130cd1db42207ed58c5b839c9dcdd509255f68a1a6657da67272f853997400000008561cf3a69e6b529043d1b239ab49e723ca1107ce49751c5e976bee2783999be7efa7b5418ae39ee24f37cbc981d34e00f250e161ec4346a0504d269d71da2d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31024500"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2707463603"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203867a47465d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2707463603"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31024500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CC7FCE57-D167-11ED-ABF7-62507EA95193} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05957a47465d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe

Modifies registry class 64 IoCs

Processes:

instup.exeinstup.exeavg_antivirus_free_setup_x64.execrashreporter.exeRegSvr.exeRegSvr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Windows\\system32\\drivers\\avgbloga.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\avgsysa.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\mirror"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\x86\\avgMonVD.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Replacing files"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-libraryloader-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File downloaded: ais_gen_tools-8dd.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "13"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: aswInfTg.htm"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\ = "AVG config file"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "99"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "73"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "80"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: config.def"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: LUA.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\aswidplog.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\Inf\\aswHwid.cat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: avgidsh"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	avg_antivirus_free_setup_x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Applications	crashreporter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDDBDEA4-5C07-453F-BE8C-81D738984381}\1.0\0	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: HTMLayout.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: ais_dll_eng"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\aswavdetectionx.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\AVG\\Antivirus\\log\\*.log.3"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "23"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "92"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: aswClnTg.htm"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: OpenSans-Bold.ttf"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\aswWrcIELoader32.exe"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\00avg	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Checking install conditions"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: browser_pass.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: serialization.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\opm.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\ais_gen_openssl-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\Version\ = "1.0"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: aswW8ntf.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: algo64.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "30"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\ashTaskEx.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_str.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-crt-stdio-l1-1-0.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "36"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\ashShA64.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "55"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: servers.def"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "File extracted: part-prg_ais-17020cc9.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: prod-pgm.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: dnddetection.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Creating directory: C:\\ProgramData\\AVG\\Antivirus\\log\\.private\\.lock"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\x86\\gaming_mode_ui.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\aswRegSvr.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\part-vps_win32-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "30"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\Inf\\x64\\avgbloga.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\RescueDisk\\Base.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\snxhk64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Common Files\\AV\\AVG Antivirus\\userdata.cab"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Installing kernel driver: avgStm"	instup.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	setup.exe

NTFS ADS 4 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_antivirus_free_setup(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\HousecallLauncher64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

avg_antivirus_free_setup_x64.exeinstup.exefirefox.exesetup.exe

pid	process
6868	avg_antivirus_free_setup_x64.exe
6868	avg_antivirus_free_setup_x64.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe
8632	setup.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exe7zG.exeOpenWith.exe

pid process

5596 OpenWith.exe
2496 7zG.exe
5572 OpenWith.exe
Suspicious behavior: LoadsDriver 13 IoCs

Processes:

pid process

652
652
652
652
652
652
652
652
652
652
652
652
652

pid	process
5596	OpenWith.exe
2496	7zG.exe
5572	OpenWith.exe

pid	process
652
652
652
652
652
652
652
652
652
652
652
652
652

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeAUDIODG.EXE7zG.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exe

description	pid	process
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: 33	5400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5400	AUDIODG.EXE
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeRestorePrivilege	2496	7zG.exe
Token: 35	2496	7zG.exe
Token: SeSecurityPrivilege	2496	7zG.exe
Token: SeSecurityPrivilege	2496	7zG.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: 32	6868	avg_antivirus_free_setup_x64.exe
Token: SeDebugPrivilege	7440	instup.exe
Token: 32	7440	instup.exe
Token: 32	6280	instup.exe
Token: SeDebugPrivilege	6280	instup.exe
Token: SeDebugPrivilege	7748	aswOfferTool.exe
Token: SeImpersonatePrivilege	7748	aswOfferTool.exe
Token: SeDebugPrivilege	7220	aswOfferTool.exe
Token: SeImpersonatePrivilege	7220	aswOfferTool.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe
Token: 35	6280	instup.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

firefox.exe7zG.exeiexplore.exeinstup.exefirefox.exe

pid	process
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
2496	7zG.exe
5412	iexplore.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
6280	instup.exe
6280	instup.exe
6280	instup.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe

Suspicious use of SendNotifyMessage 17 IoCs

Processes:

firefox.exeinstup.exefirefox.exe

pid	process
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
6280	instup.exe
6280	instup.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe
8624	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

firefox.exeOpenWith.exeOpenWith.exeiexplore.exeIEXPLORE.EXEavg_antivirus_free_setup(1).exeavg_antivirus_free_setup(1).exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exe

pid	process
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
5596	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5572	OpenWith.exe
5412	iexplore.exe
5412	iexplore.exe
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
8020	avg_antivirus_free_setup(1).exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
7076	avg_antivirus_free_setup(1).exe
6868	avg_antivirus_free_setup_x64.exe
7440	instup.exe
7440	instup.exe
6280	instup.exe
6280	instup.exe
5724	aswOfferTool.exe
5712	aswOfferTool.exe
7668	aswOfferTool.exe
7748	aswOfferTool.exe
7220	aswOfferTool.exe
7540	aswOfferTool.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 2772 wrote to memory of 4236	2772	firefox.exe	firefox.exe
PID 4236 wrote to memory of 2980	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 2980	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3456	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3392	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3392	4236	firefox.exe	firefox.exe
PID 4236 wrote to memory of 3392	4236	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
PID:1512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.0.144007790\19562755" -parentBuildID 20221007134813 -prefsHandle 1812 -prefMapHandle 1804 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceb2968a-072d-4170-b8fc-4036ec496069} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 1892 146715a7958 gpu
3⤵
PID:2980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.1.240448014\290264347" -parentBuildID 20221007134813 -prefsHandle 2296 -prefMapHandle 2292 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc0b75d-1c53-4637-9a12-567812a40860} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 2308 14663570758 socket
3⤵
PID:3456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.2.1470088377\1598915011" -childID 1 -isForBrowser -prefsHandle 2772 -prefMapHandle 3112 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c5d96aa-727a-484a-ab09-09139cfe35f8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 3028 14674130258 tab
3⤵
PID:3392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.3.843736445\12064566" -childID 2 -isForBrowser -prefsHandle 3240 -prefMapHandle 2944 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5d1f31b-8435-4085-93cf-10279171eaee} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 2428 14672ba9458 tab
3⤵
PID:5012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.4.304656087\1051402789" -childID 3 -isForBrowser -prefsHandle 4076 -prefMapHandle 4024 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a74511-b7c5-4d43-8cdc-10890e9c94c8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 4088 14663562558 tab
3⤵
PID:1320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.5.711494508\1445816735" -childID 4 -isForBrowser -prefsHandle 5208 -prefMapHandle 5204 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebcd5c4f-f460-4c48-91b5-7db1338348de} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 2840 14673674258 tab
3⤵
PID:4320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.7.886900365\342230776" -childID 6 -isForBrowser -prefsHandle 5396 -prefMapHandle 5400 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {295f21f4-7d5b-485a-b823-bfbd7cd53ac6} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 5480 14673676658 tab
3⤵
PID:3196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.6.643455446\563531545" -childID 5 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f1653b6-b25b-43f7-82ec-87bd8d099361} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 3056 14673676058 tab
3⤵
PID:4160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.8.925469664\67208805" -childID 7 -isForBrowser -prefsHandle 3512 -prefMapHandle 5752 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7f15b99-3c3a-4775-bcee-97ab604792cb} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 3580 1466355bb58 tab
3⤵
PID:4724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.9.592210567\1201059842" -childID 8 -isForBrowser -prefsHandle 3352 -prefMapHandle 4528 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73e79dd0-61f2-4baf-80d4-13019a82c8d6} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 4500 14674fb1058 tab
3⤵
PID:4980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.10.1463773497\608060175" -childID 9 -isForBrowser -prefsHandle 5700 -prefMapHandle 5752 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf0daea-3bf5-4687-b5ef-93d2719ef6a7} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 4028 14678d68058 tab
3⤵
PID:1548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.11.1109471224\820227771" -childID 10 -isForBrowser -prefsHandle 5572 -prefMapHandle 5564 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96c23650-4d4b-4339-b97b-3f3b14371849} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 5560 1466352e458 tab
3⤵
PID:3728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.12.2020033804\1800651204" -childID 11 -isForBrowser -prefsHandle 6200 -prefMapHandle 6204 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750a4b92-c2f6-4129-b9a9-4c0d24aaea39} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6192 1466355c158 tab
3⤵
PID:5012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.13.1106242064\1310233413" -childID 12 -isForBrowser -prefsHandle 10420 -prefMapHandle 6100 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fce309a-108b-42e2-8062-ebf18e8cc639} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10396 14672dba458 tab
3⤵
PID:4576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.14.1638393487\1317060623" -childID 13 -isForBrowser -prefsHandle 4920 -prefMapHandle 10480 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e435c991-181d-4202-b22e-27daafdac3d4} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6372 14678db5858 tab
3⤵
PID:5116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.15.535864181\81524653" -childID 14 -isForBrowser -prefsHandle 6096 -prefMapHandle 5504 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7515f968-73c7-4ce9-8fd2-ef6a85fa3fd2} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6392 14663569c58 tab
3⤵
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.16.1713310005\928897360" -childID 15 -isForBrowser -prefsHandle 5312 -prefMapHandle 4860 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f167fee3-b075-4069-b960-33233c7e861b} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6532 14663569f58 tab
3⤵
PID:980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.17.1547794134\774515592" -childID 16 -isForBrowser -prefsHandle 6120 -prefMapHandle 4916 -prefsLen 27527 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2a6feee-9481-4490-a92d-6262d6eef188} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7604 1467ab72258 tab
3⤵
PID:1092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.18.46650268\374479805" -childID 17 -isForBrowser -prefsHandle 7584 -prefMapHandle 10128 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3569c520-80dc-4e25-9449-ad5ba8895e28} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 3456 146792c2b58 tab
3⤵
PID:2008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.19.1176963172\331208697" -childID 18 -isForBrowser -prefsHandle 10468 -prefMapHandle 7740 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7d8d68b-87da-47d6-9426-49917da4163c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10512 14674fb2858 tab
3⤵
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.20.1120455546\45211946" -childID 19 -isForBrowser -prefsHandle 5576 -prefMapHandle 5256 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {954f4807-2649-4f36-8889-23571100127e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6460 14678611958 tab
3⤵
PID:1944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.21.406958469\1782355185" -childID 20 -isForBrowser -prefsHandle 10480 -prefMapHandle 6120 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5230870b-6837-4dce-b310-2b7b37413303} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9944 14663566258 tab
3⤵
PID:3220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.22.172518264\1131624177" -childID 21 -isForBrowser -prefsHandle 10480 -prefMapHandle 10144 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72d48cbf-7f6d-4211-a295-b8e9d2db846a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9944 1467e4f4e58 tab
3⤵
PID:4460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.23.1602955089\1149038118" -childID 22 -isForBrowser -prefsHandle 7496 -prefMapHandle 9828 -prefsLen 27663 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d00cbc4-61fa-4633-9249-ec981b37f701} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7296 1467d6e8458 tab
3⤵
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.24.1631086404\235461325" -childID 23 -isForBrowser -prefsHandle 9260 -prefMapHandle 9628 -prefsLen 27703 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f3d998d-ccbe-44e5-abf8-275b60df2c21} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9264 14675cf4058 tab
3⤵
PID:1504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.25.798179046\1805875834" -childID 24 -isForBrowser -prefsHandle 9916 -prefMapHandle 9920 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {520435c2-8a77-4535-a25f-b471c5990c8d} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10256 14677fec858 tab
3⤵
PID:1052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.26.1893062305\316232117" -childID 25 -isForBrowser -prefsHandle 9308 -prefMapHandle 9840 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {515a9b13-40ab-4611-80df-acd3f257b66e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 5624 146792c2e58 tab
3⤵
PID:3416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.27.60500393\455822535" -childID 26 -isForBrowser -prefsHandle 9636 -prefMapHandle 7308 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96b6bd59-76ef-4ec0-9056-6f9597c9f8f6} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9772 14672d4db58 tab
3⤵
PID:1908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.28.937884989\688801249" -childID 27 -isForBrowser -prefsHandle 9028 -prefMapHandle 9860 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {401afecd-bf40-43c6-82a8-562d222ea160} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9016 1467ae84b58 tab
3⤵
PID:4376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.29.977821833\636660041" -childID 28 -isForBrowser -prefsHandle 8992 -prefMapHandle 9008 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43392c14-7abd-4b4a-bd28-58e41d52f18f} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8980 1467aea7b58 tab
3⤵
PID:3880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.30.1070570343\1614912252" -childID 29 -isForBrowser -prefsHandle 8792 -prefMapHandle 8788 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58275d2d-025a-467b-91f7-06027e6f62f9} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8800 1467bd2ec58 tab
3⤵
PID:432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.31.1864039535\1801602148" -childID 30 -isForBrowser -prefsHandle 8588 -prefMapHandle 8584 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ef3e123-d1c3-4a76-9f55-dd7651224c08} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9480 1467c875558 tab
3⤵
PID:2204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.32.985907390\1800326781" -childID 31 -isForBrowser -prefsHandle 8528 -prefMapHandle 8524 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {978b2d2c-45f4-435f-baa9-8f2c33ff8f08} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8500 1467ca5e158 tab
3⤵
PID:1204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.34.1265475899\1856738318" -childID 33 -isForBrowser -prefsHandle 8624 -prefMapHandle 8636 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7691c31d-d816-43be-a0a5-3a0daf73196a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8928 14677971558 tab
3⤵
PID:4872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.33.967371260\1818913548" -childID 32 -isForBrowser -prefsHandle 8860 -prefMapHandle 8852 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4273eb5f-a430-4f70-ac2e-c2df3554da6e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8620 14677974858 tab
3⤵
PID:1016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.35.1845019548\1264958615" -childID 34 -isForBrowser -prefsHandle 8256 -prefMapHandle 8252 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2d682c-ade6-494e-8687-3ab1e124bf09} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8600 14679321c58 tab
3⤵
PID:1244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.36.1863006672\1603792374" -childID 35 -isForBrowser -prefsHandle 5884 -prefMapHandle 6488 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {132b215f-36d3-4563-b618-4b6d1cf340c0} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6492 14675cf9b58 tab
3⤵
PID:2012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.37.220719406\958938781" -childID 36 -isForBrowser -prefsHandle 10036 -prefMapHandle 9128 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b19583-008d-4f0d-9f46-0a07b5ab9ee6} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9628 146763d6558 tab
3⤵
PID:2808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.38.259901723\537179736" -parentBuildID 20221007134813 -prefsHandle 9940 -prefMapHandle 10380 -prefsLen 27712 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8ad194c-eca1-4b5a-9fce-9e1d5ba3500e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9856 146715a7358 rdd
3⤵
PID:2280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.39.1420952772\867258977" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8608 -prefMapHandle 9640 -prefsLen 27712 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfe80a16-8a86-4de9-a2d1-f8533678d1fa} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6120 14676d8c158 utility
3⤵
PID:5008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.40.285651993\1906471860" -childID 37 -isForBrowser -prefsHandle 9776 -prefMapHandle 9904 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd95046c-413e-4fd3-98a2-11688e6f3aa4} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9728 14672ba9158 tab
3⤵
PID:5220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.41.789999080\475271528" -childID 38 -isForBrowser -prefsHandle 9764 -prefMapHandle 9788 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bddcb5c9-c6ff-4ea7-90fa-e14cba22a0be} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7300 14672dbc558 tab
3⤵
PID:5232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.42.1994295540\1403550665" -childID 39 -isForBrowser -prefsHandle 3444 -prefMapHandle 5892 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a997a05-4d50-4e97-aa6e-c844bffb8115} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9796 14677bd3b58 tab
3⤵
PID:5504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.43.732019718\551207163" -childID 40 -isForBrowser -prefsHandle 10128 -prefMapHandle 9860 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {996592c0-0090-4fa1-8d11-1997b7f376ab} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 5568 14678d2d758 tab
3⤵
PID:5844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.44.1889009449\506232819" -childID 41 -isForBrowser -prefsHandle 7364 -prefMapHandle 6084 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfb63a1f-9fa6-44c4-9dc5-861d2ac55d40} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8212 14677bd2b58 tab
3⤵
PID:6128

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.45.1862252534\368525874" -childID 42 -isForBrowser -prefsHandle 7260 -prefMapHandle 8608 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a734dec5-d21a-457d-aed9-ccd9535c1462} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7952 1467e27c158 tab
3⤵
PID:6088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.46.1725861043\1967630697" -childID 43 -isForBrowser -prefsHandle 6012 -prefMapHandle 9264 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01b36511-4cb5-4926-83fa-4148a06a6e89} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7304 1467e648258 tab
3⤵
PID:4836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.47.1402029317\1934597127" -childID 44 -isForBrowser -prefsHandle 6844 -prefMapHandle 6884 -prefsLen 27712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfca0b57-df03-46b7-a42b-7e5e421691e5} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7072 14663530b58 tab
3⤵
PID:1244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.48.116770775\1551372288" -childID 45 -isForBrowser -prefsHandle 7272 -prefMapHandle 9068 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5beb5675-9bcd-473c-975f-20b97c53ae12} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7392 14672d4ab58 tab
3⤵
PID:3792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.49.1778170742\374824351" -childID 46 -isForBrowser -prefsHandle 7992 -prefMapHandle 7988 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69de1475-9d3c-41e3-a1e3-41128a36ff37} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7156 1466356c458 tab
3⤵
PID:5876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.50.422343571\969135471" -childID 47 -isForBrowser -prefsHandle 6084 -prefMapHandle 7240 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c19fa7c4-922d-42da-a76b-5750a5f74bec} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7244 14672dba158 tab
3⤵
PID:6096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.51.1045315999\981476910" -childID 48 -isForBrowser -prefsHandle 9088 -prefMapHandle 9776 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a39623c-144b-4d2b-aaa6-8064378cdbdf} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6484 14672d4de58 tab
3⤵
PID:4572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.52.999051096\1547128798" -childID 49 -isForBrowser -prefsHandle 7404 -prefMapHandle 5128 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97809d33-7f78-4885-947b-aff7fa60c674} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 2792 14675cf3158 tab
3⤵
PID:2012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.53.1004222991\13051423" -childID 50 -isForBrowser -prefsHandle 6632 -prefMapHandle 6628 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bc616d4-03cb-4457-b099-f4b326d1189a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8672 14676d8cd58 tab
3⤵
PID:5300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.54.1034528659\189825805" -childID 51 -isForBrowser -prefsHandle 9652 -prefMapHandle 10608 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bdb868b-8338-4e8e-9f95-b24f7f343b6c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7304 146792c1058 tab
3⤵
PID:5380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.55.1954554076\97012788" -childID 52 -isForBrowser -prefsHandle 8616 -prefMapHandle 8524 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b57ee1bb-7011-4104-a584-4df2fb3c91f8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7208 14672dba758 tab
3⤵
PID:1416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.56.255824288\745978732" -childID 53 -isForBrowser -prefsHandle 10768 -prefMapHandle 10756 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cff5c07-a76f-4079-aa55-432576bc9e86} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10776 1467e575d58 tab
3⤵
PID:636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.57.744205176\763369789" -childID 54 -isForBrowser -prefsHandle 6584 -prefMapHandle 1284 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b6c42a1-dead-4eaf-823d-c955e060ffb7} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6224 1467eb1bc58 tab
3⤵
PID:5752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.58.682415372\978283749" -childID 55 -isForBrowser -prefsHandle 10968 -prefMapHandle 10540 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15d0b84e-c70a-4468-8e84-3e6561f0b239} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8500 1467472dc58 tab
3⤵
PID:1908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.59.635264306\380364778" -childID 56 -isForBrowser -prefsHandle 6936 -prefMapHandle 10688 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db7aedb9-3f51-4a81-80c0-ecfeb41591d1} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6932 146794c2058 tab
3⤵
PID:5744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.60.1326921832\281775147" -childID 57 -isForBrowser -prefsHandle 6908 -prefMapHandle 6936 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0dfec4-792e-428b-b0d5-29032fdbff0f} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10576 14675cf8658 tab
3⤵
PID:2972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.61.1379298844\1674034960" -childID 58 -isForBrowser -prefsHandle 6908 -prefMapHandle 8664 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b87c0253-1b28-4553-9b0d-5bd26cbbb4b7} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8248 14663560d58 tab
3⤵
PID:1544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.62.719644630\1239379171" -childID 59 -isForBrowser -prefsHandle 9880 -prefMapHandle 8720 -prefsLen 27721 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c6b8904-4cbd-4bfb-94f0-7ce256c41b03} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8984 14674fafb58 tab
3⤵
PID:5832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.63.1126099306\1251990193" -childID 60 -isForBrowser -prefsHandle 11200 -prefMapHandle 10580 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {628342fd-f397-47f9-b598-6dea50e3f875} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6580 1467d880058 tab
3⤵
PID:5152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.64.1679043806\391050959" -childID 61 -isForBrowser -prefsHandle 9744 -prefMapHandle 7056 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ddf11ca-10cf-43c2-9084-9338845839ac} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7996 1467ed0ae58 tab
3⤵
PID:5716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.65.1245019640\1294875753" -childID 62 -isForBrowser -prefsHandle 11176 -prefMapHandle 8564 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ce36b9e-c525-40ce-ac8f-8042b04aad2c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11188 1468288c458 tab
3⤵
PID:6264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.66.1453799374\367989379" -childID 63 -isForBrowser -prefsHandle 6984 -prefMapHandle 8744 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1230580f-b58d-4350-9de6-eebb626f4d01} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7476 14682a0bb58 tab
3⤵
PID:6272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.67.1206132817\925574464" -childID 64 -isForBrowser -prefsHandle 11728 -prefMapHandle 11724 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5126d630-0990-4921-b52f-0308ba77b92f} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10736 1467d880c58 tab
3⤵
PID:6652

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.68.545562649\1937426104" -childID 65 -isForBrowser -prefsHandle 8172 -prefMapHandle 6836 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {161e0769-43ef-494d-8389-7e82f662daec} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8524 1467426c258 tab
3⤵
PID:6884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.69.1327418301\1464169928" -childID 66 -isForBrowser -prefsHandle 11488 -prefMapHandle 11476 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e11d79f4-2404-4c89-a8ac-398ba7254edf} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7996 14678c68958 tab
3⤵
PID:6220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.70.1083066482\54644079" -childID 67 -isForBrowser -prefsHandle 7604 -prefMapHandle 7268 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e74eb734-7477-4e01-82be-37db9fca405c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10720 14678d68358 tab
3⤵
PID:5540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.71.1320613957\409208669" -childID 68 -isForBrowser -prefsHandle 6684 -prefMapHandle 10660 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1171f679-8ced-4460-a357-e2d938c72e06} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10644 1467ab73758 tab
3⤵
PID:6980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.72.1888509249\241987908" -childID 69 -isForBrowser -prefsHandle 11768 -prefMapHandle 11764 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb10b275-4530-44e1-9791-f9c3cf29b089} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11756 1467ab75858 tab
3⤵
PID:7136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.73.1594916470\1413658534" -childID 70 -isForBrowser -prefsHandle 11764 -prefMapHandle 11768 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47ff5d3b-9f02-4340-a1b5-f85c65824f18} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9868 1467bd2d158 tab
3⤵
PID:3868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.74.491670152\1703979747" -childID 71 -isForBrowser -prefsHandle 6268 -prefMapHandle 7012 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f29f1139-0fd0-4fd1-a821-6c2c5238510a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 6740 14677006e58 tab
3⤵
PID:6864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.76.1360193424\341984306" -childID 73 -isForBrowser -prefsHandle 11104 -prefMapHandle 11100 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {767f8bf2-93aa-4d66-bab4-be362b56db96} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11080 1467b095658 tab
3⤵
PID:6636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.75.144845430\995504465" -childID 72 -isForBrowser -prefsHandle 11136 -prefMapHandle 11148 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63014aef-7741-4efc-a8cf-fc1e3ec64e2e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11016 1467af06558 tab
3⤵
PID:7040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.77.1341313067\855530300" -childID 74 -isForBrowser -prefsHandle 12248 -prefMapHandle 12252 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa3eb623-7e97-4e6a-a730-562739848363} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11224 1467c875b58 tab
3⤵
PID:5756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.78.1698156646\1975976681" -childID 75 -isForBrowser -prefsHandle 12404 -prefMapHandle 12400 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29c3defc-b5d2-46f4-a4c5-e4a58a391d09} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12412 1467dfea258 tab
3⤵
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.79.133549884\440173887" -childID 76 -isForBrowser -prefsHandle 11380 -prefMapHandle 7036 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86050cc7-3b2f-4c85-a3ab-ac0414386064} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10372 14678375b58 tab
3⤵
PID:6688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.80.1524574132\670559888" -childID 77 -isForBrowser -prefsHandle 12356 -prefMapHandle 11708 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e856870d-8049-4b8c-b71a-570aae38784f} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11828 1467e38eb58 tab
3⤵
PID:3712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.81.372546631\821045506" -childID 78 -isForBrowser -prefsHandle 11272 -prefMapHandle 12596 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db933408-3527-406a-bea1-19e3c07f2483} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12356 1467e4f4258 tab
3⤵
PID:5872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.82.1175067016\1155765154" -childID 79 -isForBrowser -prefsHandle 12092 -prefMapHandle 10776 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b57ac46e-f475-4ea0-a0be-d72cb3618569} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12564 1467a09f558 tab
3⤵
PID:6616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.83.388670404\830243087" -childID 80 -isForBrowser -prefsHandle 7024 -prefMapHandle 11328 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a380e6a1-9da7-4278-81ea-a65fee458c91} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11488 14677973f58 tab
3⤵
PID:4720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.84.408910929\1532257620" -childID 81 -isForBrowser -prefsHandle 12548 -prefMapHandle 8652 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67fdb5ae-1e2d-48c7-b4ea-be92c678ebe8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12248 1466356eb58 tab
3⤵
PID:7092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.85.1606344029\1825009140" -childID 82 -isForBrowser -prefsHandle 12264 -prefMapHandle 11744 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91be1bdf-aad9-4f4d-8405-a0524049665b} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11368 1467a0a2258 tab
3⤵
PID:6868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.86.1501635782\964185024" -childID 83 -isForBrowser -prefsHandle 11548 -prefMapHandle 11784 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94e1ef4a-5ec5-4381-8410-7cac1407e0e9} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12356 1467aa71558 tab
3⤵
PID:6852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.87.130574558\17245665" -childID 84 -isForBrowser -prefsHandle 10708 -prefMapHandle 12592 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {681ce4be-4ee0-40a1-8b6d-4f4f4a7c040f} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12352 14663569958 tab
3⤵
PID:5596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.88.1099907030\1378570294" -childID 85 -isForBrowser -prefsHandle 12972 -prefMapHandle 12968 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92a8e862-8b99-4531-b986-dbbc23527682} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12592 1467d776e58 tab
3⤵
PID:5964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.89.484893926\1852620162" -childID 86 -isForBrowser -prefsHandle 11380 -prefMapHandle 6808 -prefsLen 29778 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c98f09c-46d1-4073-83ba-5a9e5022f2e8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8644 1466356eb58 tab
3⤵
PID:7528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.90.1882154266\1435187202" -childID 87 -isForBrowser -prefsHandle 10776 -prefMapHandle 7268 -prefsLen 30110 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74153c7b-16c4-4bb2-9828-c6b8b2e87c19} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11572 1467ae85a58 tab
3⤵
PID:7228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.91.444705969\451707075" -childID 88 -isForBrowser -prefsHandle 12820 -prefMapHandle 13212 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50ae25da-e647-49fa-9f3a-16ab69465536} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12248 1467dfc0a58 tab
3⤵
PID:7832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.92.1457382316\2132831446" -childID 89 -isForBrowser -prefsHandle 11048 -prefMapHandle 11084 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6966bd4d-477d-4cbc-bb3b-2120f77a3da0} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10752 14677feb958 tab
3⤵
PID:3952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.93.1886586467\1439802415" -childID 90 -isForBrowser -prefsHandle 7056 -prefMapHandle 12820 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5964be85-cbd0-4de2-bee1-5ce0cbca4afc} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12248 1467aa71b58 tab
3⤵
PID:6640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.94.382896784\1365946560" -childID 91 -isForBrowser -prefsHandle 11084 -prefMapHandle 11572 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c9df733-83eb-4025-8a95-3982ad6ca056} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11200 1467c7a5e58 tab
3⤵
PID:8180

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.95.965583358\642459242" -childID 92 -isForBrowser -prefsHandle 13140 -prefMapHandle 12612 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1077c403-c1ca-4d85-b662-ff9c20e7841c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12600 1466356f258 tab
3⤵
PID:6620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.96.826732996\882579974" -childID 93 -isForBrowser -prefsHandle 7316 -prefMapHandle 7548 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16049c45-0878-44c6-838f-9ae3649bb11c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9968 1467af06558 tab
3⤵
PID:2916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.97.1791731467\559442636" -childID 94 -isForBrowser -prefsHandle 7256 -prefMapHandle 11120 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7438285d-7fa9-4ad7-85b4-c19b9b4939e5} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8932 1467ec14258 tab
3⤵
PID:7784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.99.1481476907\499418449" -childID 96 -isForBrowser -prefsHandle 11796 -prefMapHandle 12868 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {616a5663-a4b6-4da5-8939-5bbd40828d9a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9576 146828c1b58 tab
3⤵
PID:8104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.98.1170689335\1885488060" -childID 95 -isForBrowser -prefsHandle 11920 -prefMapHandle 12964 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d08811a-3a80-49ad-89d9-6af918e5d7ab} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7468 146828c1e58 tab
3⤵
PID:7192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.100.1801102232\100233731" -childID 97 -isForBrowser -prefsHandle 12376 -prefMapHandle 12244 -prefsLen 30322 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0b22b86-4347-4818-babb-f1d027b110e4} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12396 1467c852258 tab
3⤵
PID:6628

C:\Users\Admin\Downloads\avg_antivirus_free_setup(1).exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup(1).exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.101.1306550297\1772469910" -childID 98 -isForBrowser -prefsHandle 11524 -prefMapHandle 8924 -prefsLen 30378 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26f6f6ea-2ba9-4d51-96fd-cf4d52ee3ccb} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11288 14663572858 tab
3⤵
PID:3664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.102.144307921\1973618842" -childID 99 -isForBrowser -prefsHandle 13820 -prefMapHandle 13824 -prefsLen 30378 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68e318ec-c3b9-4711-8470-3a004f9c02f7} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 13808 1467b987558 tab
3⤵
PID:6188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.103.293080259\381472987" -childID 100 -isForBrowser -prefsHandle 13876 -prefMapHandle 11920 -prefsLen 30378 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5512abe8-a65c-4a2f-bb6a-906f48661c72} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 13072 1467d3d1358 tab
3⤵
PID:8188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.104.583913802\170081576" -childID 101 -isForBrowser -prefsHandle 12868 -prefMapHandle 11164 -prefsLen 30378 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e82af35d-3bf5-40dc-bed9-0ffbf1fc276c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 13784 1467b986c58 tab
3⤵
PID:7868

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7868 -s 1212
4⤵
- Program crash
PID:8476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.105.1723622547\1453090504" -childID 102 -isForBrowser -prefsHandle 10996 -prefMapHandle 12788 -prefsLen 30378 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3967c5da-44aa-4465-b79a-b869d0c30a30} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11544 1467e2e6558 tab
3⤵
PID:7092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.106.1924057388\1371030789" -childID 103 -isForBrowser -prefsHandle 11736 -prefMapHandle 7044 -prefsLen 30595 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce45a80b-5ef8-4959-ac43-28e8ebc4a30e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12420 14676d8b258 tab
3⤵
PID:12940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.107.604165707\1979377655" -childID 104 -isForBrowser -prefsHandle 11040 -prefMapHandle 12084 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7932461-cbce-4a5d-81e1-7f3c4fa416ee} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11248 14677bd6558 tab
3⤵
PID:10896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.108.967586144\339061449" -childID 105 -isForBrowser -prefsHandle 11920 -prefMapHandle 7124 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2b61a92-7049-46bb-9f54-b577cc8bab27} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12304 14674fb1358 tab
3⤵
PID:11236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.109.425454793\1551605913" -childID 106 -isForBrowser -prefsHandle 13820 -prefMapHandle 13784 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89918841-7b99-493e-a781-7498ddc8f329} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7212 14678db7958 tab
3⤵
PID:6704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.110.1773807702\1628852314" -childID 107 -isForBrowser -prefsHandle 12464 -prefMapHandle 12468 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6088417-433e-414d-a45f-50c0e87d3c05} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11008 1467b987858 tab
3⤵
PID:7032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.111.1391082054\852675567" -childID 108 -isForBrowser -prefsHandle 14224 -prefMapHandle 14244 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad5e5121-5058-4013-bfaa-b6d3da410d80} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 14288 1467dfc1958 tab
3⤵
PID:10680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.112.391332163\1990266265" -childID 109 -isForBrowser -prefsHandle 7132 -prefMapHandle 4272 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cefd5ad-c5d3-4764-8fe4-538bc6ea66d3} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 4292 1467e648258 tab
3⤵
PID:8960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.113.883951746\642034024" -childID 110 -isForBrowser -prefsHandle 14248 -prefMapHandle 8984 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63a7eea1-c047-47fe-a9d4-f85be11d1678} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7652 14683c74358 tab
3⤵
PID:13952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.114.434317350\493882287" -childID 111 -isForBrowser -prefsHandle 6204 -prefMapHandle 7972 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6347048f-78e6-4dd3-867c-c2f0e747529a} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12256 146801fbb58 tab
3⤵
PID:8596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.115.1246013108\758881301" -childID 112 -isForBrowser -prefsHandle 13764 -prefMapHandle 12304 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6021273f-6867-4e05-9fba-454fbdff4f60} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 14284 14681520458 tab
3⤵
PID:8496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.116.15798026\1897061584" -childID 113 -isForBrowser -prefsHandle 6528 -prefMapHandle 7816 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a1eab2d-5487-4422-918d-39151f610ad4} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 10988 146819e7c58 tab
3⤵
PID:11316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.117.1589710649\97026810" -childID 114 -isForBrowser -prefsHandle 12648 -prefMapHandle 12396 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fbe73e1-f026-4322-b0dd-82b003da182e} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12360 1468264d758 tab
3⤵
PID:13156

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
"C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\52409802-9b94-4cf8-8e90-669a443acc06.dmp"
3⤵
PID:14068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.118.412819042\496911645" -childID 115 -isForBrowser -prefsHandle 11844 -prefMapHandle 11280 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61088a75-7a3d-45b0-ad97-930fe85bd110} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12608 146812eea58 tab
3⤵
PID:7756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.119.965397816\750637612" -childID 116 -isForBrowser -prefsHandle 12352 -prefMapHandle 9128 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba592cad-ec27-48ac-92b7-4c628a2d5925} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12120 146753dd058 tab
3⤵
PID:5940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.120.343676520\1478441448" -childID 117 -isForBrowser -prefsHandle 6776 -prefMapHandle 12236 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b068dd63-3ec1-4d2f-9579-cde71de131a8} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11704 14682a0ca58 tab
3⤵
PID:13680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.121.1441214862\404669046" -childID 118 -isForBrowser -prefsHandle 13744 -prefMapHandle 13904 -prefsLen 30604 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c28b56a-d2fd-4c5b-87f3-f7c8bd2fece1} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7116 1467c9d0958 tab
3⤵
PID:11240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.122.1396047345\1609486375" -childID 119 -isForBrowser -prefsHandle 13600 -prefMapHandle 10688 -prefsLen 30703 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13ca2c19-5ae2-423f-ba2e-a37aef0b1db3} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 14060 1467ae85758 tab
3⤵
PID:8644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.123.1541214858\1515745711" -parentBuildID 20221007134813 -prefsHandle 2068 -prefMapHandle 2596 -prefsLen 30703 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5d89919-7d68-45aa-98d6-0c6dc945c3c4} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 14620 1466355d958 gpu
3⤵
PID:9488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.124.1900477303\1704618605" -childID 120 -isForBrowser -prefsHandle 13952 -prefMapHandle 11132 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6097e55d-b0ba-467b-9f46-99a1f16bf674} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 11096 1467c875858 tab
3⤵
PID:12080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.125.449056014\540756831" -childID 121 -isForBrowser -prefsHandle 6980 -prefMapHandle 7132 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {868aec1c-0e9d-44fc-ac77-934680bbae86} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 7932 1467d773558 tab
3⤵
PID:6240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.126.853728604\116480138" -childID 122 -isForBrowser -prefsHandle 13760 -prefMapHandle 11544 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd4f1920-f9da-45fd-b71a-f2e61849e88c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12784 1467dfc1658 tab
3⤵
PID:6320

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.127.1291663342\1134267319" -childID 123 -isForBrowser -prefsHandle 10376 -prefMapHandle 11100 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e23aa33e-6a8d-4c39-939c-e43f73c70d3b} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 9288 1467e64a658 tab
3⤵
PID:11528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.128.531987551\638441678" -childID 124 -isForBrowser -prefsHandle 11832 -prefMapHandle 14076 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c371f19-0ab6-4e0f-b4cd-8626d35ff81c} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 14748 1468028e258 tab
3⤵
PID:3256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.129.207307732\731604657" -childID 125 -isForBrowser -prefsHandle 14708 -prefMapHandle 14712 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd92d440-6a9e-43a0-97b4-40efba620d0d} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 13428 1468028e858 tab
3⤵
PID:8256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.130.1561755335\1092934883" -childID 126 -isForBrowser -prefsHandle 12836 -prefMapHandle 12252 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be84205-48df-4ff6-a7e8-59006e1d0a2b} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 8784 1468028f758 tab
3⤵
PID:12640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.131.513375545\329374847" -childID 127 -isForBrowser -prefsHandle 14224 -prefMapHandle 14604 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43fbc1a4-2b95-425b-bead-c229667e7975} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 12780 1468151f558 tab
3⤵
PID:13144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.132.940618629\622985186" -childID 128 -isForBrowser -prefsHandle 14780 -prefMapHandle 14876 -prefsLen 30712 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {900164b9-b23d-4133-b882-09e2b4b54bc3} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 15432 14682e0ae58 tab
3⤵
PID:10024

C:\Program Files\Mozilla Firefox\crashreporter.exe
"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\minidumps\5eea6d32-0535-48ae-8e4c-d256e16847c3.dmp"
3⤵
- Modifies registry class
PID:2868

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
"C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\minidumps\5eea6d32-0535-48ae-8e4c-d256e16847c3.dmp"
4⤵
PID:3032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
4⤵
PID:10800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
5⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.0.984975876\1333389761" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20890 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {725bb732-8352-412d-8cad-fd9d44821d60} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 1796 200fd5ea758 gpu
6⤵
PID:11108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.1.2030665518\344568482" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2140 -prefsLen 20890 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9683243-8bc7-4484-aa4d-6a11ddf078f1} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 2164 200fe706558 socket
6⤵
PID:8364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.2.430334034\820775047" -childID 1 -isForBrowser -prefsHandle 2688 -prefMapHandle 2964 -prefsLen 21569 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d9c29f9-4de7-42ed-a2c3-50c826a4ff6e} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 2876 2008209bb58 tab
6⤵
PID:10396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.3.2035160317\1969510067" -childID 2 -isForBrowser -prefsHandle 3552 -prefMapHandle 3548 -prefsLen 27070 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127474a1-3202-4f7e-840d-db29a291985a} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 3560 200831bc958 tab
6⤵
PID:11736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.4.759119277\1687782986" -childID 3 -isForBrowser -prefsHandle 4208 -prefMapHandle 4284 -prefsLen 27129 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06f7ccb-6281-409d-944f-3d550891c73f} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 4464 20084752e58 tab
6⤵
PID:14128

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.5.1859367672\563131209" -childID 4 -isForBrowser -prefsHandle 5352 -prefMapHandle 5348 -prefsLen 27250 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {043fd140-2f66-4889-b4ef-62bae550505e} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 5364 200868c6658 tab
6⤵
PID:8764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.6.920374316\131376323" -childID 5 -isForBrowser -prefsHandle 4604 -prefMapHandle 5548 -prefsLen 27250 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a17280d8-aa0f-4c68-b7a0-2308be6962c8} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 4464 20086883658 tab
6⤵
PID:7676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.7.1480000990\813075735" -childID 6 -isForBrowser -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27250 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3467f39-e4af-473d-9c56-c37d8ca5559a} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 5700 2008705fa58 tab
6⤵
PID:5152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.8.801403277\1396883317" -childID 7 -isForBrowser -prefsHandle 5956 -prefMapHandle 5872 -prefsLen 27250 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c662b614-306c-44d7-b0dc-e14d618bd7e0} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 5964 2008705fd58 tab
6⤵
PID:10492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.9.412910359\1696235454" -childID 8 -isForBrowser -prefsHandle 5904 -prefMapHandle 5908 -prefsLen 27250 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69e4297d-5127-4f3e-9638-012fb5819d4e} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 5712 20085520858 tab
6⤵
PID:7800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.10.1369088905\1436456287" -childID 9 -isForBrowser -prefsHandle 4968 -prefMapHandle 5016 -prefsLen 27728 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fce56d66-62bf-4c7e-af12-5a4e4f86a0fd} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 4700 200f0c5b558 tab
6⤵
PID:5424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8624.11.1319382412\546866680" -childID 10 -isForBrowser -prefsHandle 4236 -prefMapHandle 6184 -prefsLen 27864 -prefMapSize 232711 -jsInitHandle 1208 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5300179e-184d-4294-963b-9a858742b2a8} 8624 "\\.\pipe\gecko-crash-server-pipe.8624" 5776 200875f1558 tab
6⤵
PID:11952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5596

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Grandia.Ep0_5-up.USA(1).zip\" -ad -an -ai#7zMap29690:118:7zEvent32113
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Grandia.Ep0_5-up.USA(1).zip.part"
2⤵
PID:5764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Grandia.Ep0_5-up.USA(1).zip.part
3⤵
- Checks processor information in registry
PID:5876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5412

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5412 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Users\Admin\Downloads\avg_antivirus_free_setup(1).exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup(1).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:7076

C:\Windows\Temp\asw.78f10bf85d84e037\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.78f10bf85d84e037\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_003_999_a7d_m:dlid_FREEGSR-FAD /ga_clientid:362943c6-1887-4409-a2e5-e2596c0256e3 /edat_dir:C:\Windows\Temp\asw.78f10bf85d84e037
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6868

C:\Windows\Temp\asw.1342bf079e708898\instup.exe
"C:\Windows\Temp\asw.1342bf079e708898\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.1342bf079e708898 /edition:15 /prod:ais /guid:8d59e8ed-ee5e-422b-83df-faf1a96a0756 /ga_clientid:362943c6-1887-4409-a2e5-e2596c0256e3 /cookie:mmm_bav_003_999_a7d_m:dlid_FREEGSR-FAD /ga_clientid:362943c6-1887-4409-a2e5-e2596c0256e3 /edat_dir:C:\Windows\Temp\asw.78f10bf85d84e037
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7440

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\instup.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.1342bf079e708898 /edition:15 /prod:ais /guid:8d59e8ed-ee5e-422b-83df-faf1a96a0756 /ga_clientid:362943c6-1887-4409-a2e5-e2596c0256e3 /cookie:mmm_bav_003_999_a7d_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.78f10bf85d84e037 /online_installer
4⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6280

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" -checkGToolbar -elevated
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" /check_secure_browser
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5712

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" -checkChrome -elevated
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:7668

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7748

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8008

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7220

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5232

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\aswOfferTool.exe" -checkChrome -elevated
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:7540

C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\sbr.exe
"C:\Windows\Temp\asw.1342bf079e708898\New_17020cc9\sbr.exe" 6280 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
5⤵
- Executes dropped EXE
PID:7228

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:13968

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:14212

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:7576

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:10512

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /elaminst C:\Windows\system32\drivers\avgElam.sys
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:8220

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:8456

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer1
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:10484

C:\Program Files\AVG\Antivirus\avBugReport.exe
"C:\Program Files\AVG\Antivirus\avBugReport.exe" --send "dumps|report" --silent --path "C:\ProgramData\AVG\Antivirus" --logpath "C:\ProgramData\AVG\Antivirus\log" --guid 8d59e8ed-ee5e-422b-83df-faf1a96a0756
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:10904

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:11520

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:12112

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:11920

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:12272

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\setup\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E731805758E58411CF990D777C923498ABBE964B
5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
PID:8472

C:\Program Files\Common Files\AVG\Overseer\overseer.exe
"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:8908

C:\Program Files\AVG\Antivirus\defs\23040199\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\23040199\engsup.exe" /prepare_definitions_folder
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
PID:8356

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:14004

C:\Program Files\AVG\Antivirus\defs\23040199\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\23040199\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:11120

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /runassvc /rpcserver
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:10188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 7868 -ip 7868
1⤵
PID:12248

C:\Users\Admin\Downloads\HousecallLauncher64.exe
"C:\Users\Admin\Downloads\HousecallLauncher64.exe"
1⤵
- Executes dropped EXE
PID:8556

C:\Program Files\Trend Micro\7zSC61474C0\setup.exe
.\setup.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:8632

C:\Program Files\Trend Micro\HCBackup\hcpackage64.exe.tmp
exe.exe -y
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:11480

C:\Program Files\Trend Micro\7zSC61474C0\AU\patch64.exe
"C:\Program Files\Trend Micro\7zSC61474C0\AU\patch64.exe" "C:\Program Files\Trend Micro\7zSC61474C0\AU\AU_Data\AU_Temp\8632_10192" 0
3⤵
- Executes dropped EXE
PID:12676

C:\Program Files\Trend Micro\HouseCall\housecall.bin
"housecall.bin" A9D9B4E4 906681DD
3⤵
- Executes dropped EXE
PID:3048

C:\Program Files\Trend Micro\HouseCall\HouseCallX_x64\HouseCallX.exe
"C:\Program Files\Trend Micro\HouseCall\HouseCallX_x64\HouseCallX.exe" /FMTIME=4320
4⤵
PID:7136

C:\Program Files\Trend Micro\HouseCall\TisEzIns.exe
"C:\Program Files\Trend Micro\HouseCall\TisEzIns.exe" /b /u "http://gr.trendmicro.com/GREntry/NonPayment?Target=PROMOTE&PID=HC10&FunID=HouseCallTAVPackage&Locale=EN-US" /f "C:\Program Files\Trend Micro\HouseCall\setup-TAV.exe"
4⤵
PID:3972

C:\Program Files\Trend Micro\HouseCall\CleanerOne\CleanerOneChecker.exe
CleanerOneChecker.exe
4⤵
PID:8928

C:\Program Files\Trend Micro\HouseCall\TisEzIns.exe
"C:\Program Files\Trend Micro\HouseCall\TisEzIns.exe" /b /u "https://gr.trendmicro.com/GREntry/NonPayment?Target=cleaneronesite&OS=&SP=&PID=CW10&FunID=Download&VID=COPA0003&Locale=" /f "C:\Program Files\Trend Micro\HouseCall\setup-CleanerOne.exe"
4⤵
PID:7700

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
PID:10532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:5620

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
PID:5412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Security Software Discovery

T1063

Query Registry

System Information Discovery