guloader | hxxps://bazaar[.]abuse[.]ch/

System Information Discovery

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	vpnkit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	InstallsNew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	vpnkitsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	vpnkit.exe

Executes dropped EXE 23 IoCs

pid	Process
876	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
4172	Setup_Latest+++.exe
1512	vpnkitsetup.exe
5552	vpnkit.exe
5536	vpnkit.exe
7108	vpnkit.exe
5592	vpnkit.exe
6104	vpnkit.exe
7476	vpnkit.exe
6188	vpnkit.exe
6652	vpnkit.exe
7300	vpnkit.exe
5660	SetupNew.exe
4932	InstallsNew.exe
6740	srvrast.exe
1080	InstallsNew.exe
7584	LauncherPC.exe
3708	Set-up32Х64bit.exe
1032	conhost.exe
6044	svchost.exe
5124	service.exe
5672	ntlhost.exe
5172	ApplicationSetupFile14.1.exe

Loads dropped DLL 26 IoCs

pid	Process
876	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
5552	vpnkit.exe
5536	vpnkit.exe
7108	vpnkit.exe
5592	vpnkit.exe
6104	vpnkit.exe
7108	vpnkit.exe
7108	vpnkit.exe
7108	vpnkit.exe
7476	vpnkit.exe
6188	vpnkit.exe
6188	vpnkit.exe
6188	vpnkit.exe
6188	vpnkit.exe
6652	vpnkit.exe
7300	vpnkit.exe
7584	LauncherPC.exe
7584	LauncherPC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vpnkit = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\topvpn\\vpnkit.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shell Extension = "C:\\ProgramData\\service.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	InstallsNew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	InstallsNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	InstallsNew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	InstallsNew.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
876	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 876 set thread context of 2752	876	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe	108
PID 5660 set thread context of 5724	5660	SetupNew.exe	211
PID 3708 set thread context of 1792	3708	Set-up32Х64bit.exe	307
PID 5172 set thread context of 1676	5172	ApplicationSetupFile14.1.exe	359

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4888	4172	WerFault.exe	126
1384	5172	WerFault.exe	357

NSIS installer 8 IoCs

installer

resource	yara_rule
behavioral1/files/0x000400000001629b-557.dat	nsis_installer_1
behavioral1/files/0x000400000001629b-557.dat	nsis_installer_2
behavioral1/files/0x000400000001629b-558.dat	nsis_installer_1
behavioral1/files/0x000400000001629b-558.dat	nsis_installer_2
behavioral1/files/0x000400000001629b-691.dat	nsis_installer_1
behavioral1/files/0x000400000001629b-691.dat	nsis_installer_2
behavioral1/files/0x0006000000023843-5166.dat	nsis_installer_1
behavioral1/files/0x0006000000023843-5166.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallsNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LauncherPC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LauncherPC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	InstallsNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	InstallsNew.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
7884	schtasks.exe
5944	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3100	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
5928	tasklist.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2350	Go-http-client/1.1

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
6904	reg.exe
7496	reg.exe
7460	reg.exe

NTFS ADS 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PaSS-1122-For-Open-Archive.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MeSoftwares.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\vpnkitsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\topvpn-updater\installer.exe\:Zone.Identifier:$DATA	vpnkitsetup.exe
File created	C:\Users\Admin\Downloads\PassWord_10101_For_Open_Archive.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\2O23-F1LES-S0ft.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MeSoftwares(1).rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1.rar:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6704	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7060	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
2752	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
1512	vpnkitsetup.exe
1512	vpnkitsetup.exe
5928	tasklist.exe
5928	tasklist.exe
6104	vpnkit.exe
6104	vpnkit.exe
5592	vpnkit.exe
5592	vpnkit.exe
6652	vpnkit.exe
6652	vpnkit.exe
7300	vpnkit.exe
7300	vpnkit.exe
4932	InstallsNew.exe
4932	InstallsNew.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe
7584	LauncherPC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5720	OpenWith.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
876	1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	5040	7zG.exe
Token: 35	5040	7zG.exe
Token: SeSecurityPrivilege	5040	7zG.exe
Token: SeSecurityPrivilege	5040	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	2352	7zG.exe
Token: 35	2352	7zG.exe
Token: SeSecurityPrivilege	2352	7zG.exe
Token: SeSecurityPrivilege	2352	7zG.exe
Token: SeRestorePrivilege	508	7zG.exe
Token: 35	508	7zG.exe
Token: SeSecurityPrivilege	508	7zG.exe
Token: SeSecurityPrivilege	508	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	5928	tasklist.exe
Token: SeSecurityPrivilege	1512	vpnkitsetup.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	6164	7zG.exe
Token: 35	6164	7zG.exe
Token: SeSecurityPrivilege	6164	7zG.exe
Token: SeSecurityPrivilege	6164	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	8012	7zG.exe
Token: 35	8012	7zG.exe
Token: SeSecurityPrivilege	8012	7zG.exe
Token: SeSecurityPrivilege	8012	7zG.exe
Token: SeRestorePrivilege	7556	7zG.exe
Token: 35	7556	7zG.exe
Token: SeSecurityPrivilege	7556	7zG.exe
Token: SeSecurityPrivilege	7556	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	6952	taskmgr.exe
Token: SeSystemProfilePrivilege	6952	taskmgr.exe
Token: SeCreateGlobalPrivilege	6952	taskmgr.exe
Token: 33	6952	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6952	taskmgr.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	7664	7zG.exe
Token: 35	7664	7zG.exe
Token: SeSecurityPrivilege	7664	7zG.exe
Token: SeSecurityPrivilege	7664	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: 33	5104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5104	AUDIODG.EXE
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	6396	7zG.exe
Token: 35	6396	7zG.exe
Token: SeSecurityPrivilege	6396	7zG.exe
Token: SeSecurityPrivilege	6396	7zG.exe
Token: SeDebugPrivilege	4948	firefox.exe
Token: SeRestorePrivilege	7100	7zG.exe
Token: 35	7100	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
5040	7zG.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
2352	7zG.exe
508	7zG.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
6164	7zG.exe
8012	7zG.exe
7556	7zG.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
5552	vpnkit.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe
6952	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe
5720	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 448 wrote to memory of 4948	448	firefox.exe	85
PID 4948 wrote to memory of 1908	4948	firefox.exe	86
PID 4948 wrote to memory of 1908	4948	firefox.exe	86
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 2312	4948	firefox.exe	87
PID 4948 wrote to memory of 4056	4948	firefox.exe	88
PID 4948 wrote to memory of 4056	4948	firefox.exe	88
PID 4948 wrote to memory of 4056	4948	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://bazaar.abuse.ch/
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://bazaar.abuse.ch/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.0.1259657922\861764013" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73087d83-6a64-4158-a574-70f255c52734} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 1916 2a0deb19558 gpu
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.1.90532464\1927428608" -parentBuildID 20221007134813 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70485d92-6a9d-4f92-b249-d2149e64c00f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2424 2a0d0b71358 socket
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.2.75057801\1374645269" -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3304 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba6dc9a-fdcc-42be-b4c7-4b87a04e23bc} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3068 2a0dda93f58 tab
    3⤵
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.3.2071306245\467641258" -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc27fb9-bf9d-4c50-9c67-9b934c2e120e} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3848 2a0d0b5b858 tab
    3⤵
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.4.1019010144\1857559581" -childID 3 -isForBrowser -prefsHandle 4788 -prefMapHandle 4784 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {639ae62c-33c6-4aa2-abb9-cc77e8ebaadb} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 4808 2a0e48e9058 tab
    3⤵
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.5.594157295\856749530" -childID 4 -isForBrowser -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9027562b-0ace-4585-a078-b94c97f3c94b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5060 2a0e506df58 tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.6.1846585210\142626496" -childID 5 -isForBrowser -prefsHandle 5084 -prefMapHandle 5140 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fedad1c8-90e2-41d7-8ea0-7f92070153ff} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5232 2a0e50ce858 tab
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.7.1591944470\2142151175" -childID 6 -isForBrowser -prefsHandle 5640 -prefMapHandle 5532 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {852cb409-7d75-43ee-ad66-659dd8e92c65} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5648 2a0e5010258 tab
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.8.1589707516\1897379074" -childID 7 -isForBrowser -prefsHandle 4268 -prefMapHandle 5220 -prefsLen 27290 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96ac6d5f-015d-4049-a47a-7e41508029db} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5872 2a0e4803858 tab
    3⤵
    PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.9.766562223\24773015" -childID 8 -isForBrowser -prefsHandle 5936 -prefMapHandle 5940 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2eab6fc-86a1-411b-8204-12c0d227677a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5256 2a0e1b33558 tab
    3⤵
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.10.1382467947\246065481" -childID 9 -isForBrowser -prefsHandle 6168 -prefMapHandle 6180 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef73b918-9496-49f5-9d11-5d218e1bfdca} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5940 2a0e67c3258 tab
    3⤵
    PID:624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.11.684364097\225112987" -parentBuildID 20221007134813 -prefsHandle 6500 -prefMapHandle 6504 -prefsLen 27299 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1164b0a4-420b-4ee7-a2a1-dda33081aa9a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6580 2a0e67c3558 rdd
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.13.1247923049\412358728" -childID 11 -isForBrowser -prefsHandle 6880 -prefMapHandle 6884 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6392098-6211-4138-b839-e9e44023294f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6872 2a0e53f9958 tab
    3⤵
    PID:724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.12.1416041850\1587440397" -childID 10 -isForBrowser -prefsHandle 6748 -prefMapHandle 6744 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c64bb7b-c2d7-4a4f-817d-2d77a38cbc8c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5972 2a0e4803858 tab
    3⤵
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.14.1926922896\1319649944" -childID 12 -isForBrowser -prefsHandle 3260 -prefMapHandle 3032 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b71c0c9-014a-463a-9d08-7fa9cb224518} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7112 2a0e7d3e858 tab
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.15.1062089279\1068015541" -childID 13 -isForBrowser -prefsHandle 6008 -prefMapHandle 7112 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95301f28-d4e8-47e9-a98d-be368cf80384} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6548 2a0e7d3f458 tab
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.16.63242715\1322286783" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5748 -prefMapHandle 5788 -prefsLen 27299 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {876ea68a-97f7-4cc7-bbc5-7a666497563e} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5724 2a0e6836b58 utility
    3⤵
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.17.1683774795\65697478" -childID 14 -isForBrowser -prefsHandle 4264 -prefMapHandle 5792 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {794c2a65-36d6-4bfe-9dcc-61659afb7d19} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6332 2a0e6980e58 tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.18.2001418928\570840125" -childID 15 -isForBrowser -prefsHandle 3984 -prefMapHandle 6104 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b14cc51-b379-4451-afac-cab8658b9e2c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6756 2a0d0b68758 tab
    3⤵
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.19.37029595\493431733" -childID 16 -isForBrowser -prefsHandle 4372 -prefMapHandle 6256 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e966826-7bbf-497c-9023-8affe3f9e7bc} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6120 2a0e8d25a58 tab
    3⤵
    PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.20.1029760532\1793075244" -childID 17 -isForBrowser -prefsHandle 6084 -prefMapHandle 5932 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52fcd83e-b2b4-4310-bcfc-e25d8f82c3e3} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 4264 2a0e5215858 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.21.1215218466\1600670675" -childID 18 -isForBrowser -prefsHandle 7084 -prefMapHandle 6752 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c55d831-a363-4ea3-984f-b5d4ff3c4f87} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6084 2a0e506be58 tab
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.22.1879300290\235061868" -childID 19 -isForBrowser -prefsHandle 7364 -prefMapHandle 7348 -prefsLen 27299 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9db517a0-d7ed-44d1-b77a-f7baeeaefeca} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7320 2a0e7125d58 tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.23.1164888900\1320292405" -parentBuildID 20221007134813 -prefsHandle 2728 -prefMapHandle 6716 -prefsLen 27317 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f06d7a5-738c-46bc-a9be-af4dc10ee297} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2088 2a0d0b2f958 gpu
    3⤵
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.26.2080266024\2113832709" -childID 22 -isForBrowser -prefsHandle 11120 -prefMapHandle 11116 -prefsLen 28255 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cf34dba-728d-47fd-b27f-468076059044} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6408 2a0e2aed558 tab
    3⤵
    PID:4104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.25.1574061845\1641289620" -childID 21 -isForBrowser -prefsHandle 7132 -prefMapHandle 6428 -prefsLen 28255 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3954e67-f5ad-4b00-b586-88f92b6b8fac} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11280 2a0e2aec058 tab
    3⤵
    PID:1884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.24.8912206\131150422" -childID 20 -isForBrowser -prefsHandle 7180 -prefMapHandle 6548 -prefsLen 28255 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcb83104-89a0-4459-ad73-7dff8ae821d6} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6844 2a0e2aeb758 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.27.546542675\56798679" -childID 23 -isForBrowser -prefsHandle 11356 -prefMapHandle 1644 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17c22f48-8ec1-4339-8be3-4c5b61919696} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6872 2a0e36a9258 tab
    3⤵
    PID:3324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.28.2030025136\1905886393" -childID 24 -isForBrowser -prefsHandle 11288 -prefMapHandle 11084 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c640b7f-2425-492e-8a62-ab23be0b8c76} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11080 2a0e1a16358 tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.29.2102998134\1243518499" -childID 25 -isForBrowser -prefsHandle 10536 -prefMapHandle 10540 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21a2c57f-4cd6-46c1-9106-38c3233106de} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3676 2a0e8e5fd58 tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.31.2004246484\1897306862" -childID 27 -isForBrowser -prefsHandle 10564 -prefMapHandle 10312 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c32750c-211c-40e0-bbb6-0abc5c3bb715} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10424 2a0e3639058 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.30.2046057543\626723833" -childID 26 -isForBrowser -prefsHandle 10300 -prefMapHandle 10304 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d702df16-3faa-4798-8a64-7fa60476936f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10292 2a0e363a858 tab
    3⤵
    PID:844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.32.1163437592\1669834563" -childID 28 -isForBrowser -prefsHandle 6880 -prefMapHandle 6120 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3db5a1e2-01e5-4ede-9cf5-5d688ee96873} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11108 2a0dd492858 tab
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.33.979882659\747162290" -childID 29 -isForBrowser -prefsHandle 7432 -prefMapHandle 7444 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26fd3cc7-c563-4a42-8094-08115793556f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7408 2a0d0b63558 tab
    3⤵
    PID:5008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.34.236701814\1713537311" -childID 30 -isForBrowser -prefsHandle 3580 -prefMapHandle 10444 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d738fffc-6ef9-4887-b1ce-32d054d614ce} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10728 2a0e3638758 tab
    3⤵
    PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.35.1658751308\1014038895" -childID 31 -isForBrowser -prefsHandle 6500 -prefMapHandle 6364 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed88f8d1-cd98-4ad7-a39e-91d297d7d872} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3132 2a0dd422358 tab
    3⤵
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.36.442986618\939134378" -childID 32 -isForBrowser -prefsHandle 10604 -prefMapHandle 7188 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6253ee22-ca0e-4d61-a6c5-c3c0cf415336} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10536 2a0e3c6c958 tab
    3⤵
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.37.1522829948\1790070439" -childID 33 -isForBrowser -prefsHandle 4916 -prefMapHandle 11292 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96a05670-1316-4861-bf9b-65ab475718f8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 1288 2a0e5293b58 tab
    3⤵
    PID:2472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.38.1387919121\1155998422" -childID 34 -isForBrowser -prefsHandle 10200 -prefMapHandle 10188 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea432d6e-1b76-411f-90e6-e65af2256887} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7408 2a0e86a0758 tab
    3⤵
    PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.40.986839362\1952215497" -childID 36 -isForBrowser -prefsHandle 10736 -prefMapHandle 10744 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {448ca80d-06ca-426a-acf5-dd2122131665} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11056 2a0e8a6d458 tab
    3⤵
    PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.39.467015637\1036475789" -childID 35 -isForBrowser -prefsHandle 5900 -prefMapHandle 10480 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53f4628e-fe52-4148-badf-1cda615b4a99} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10232 2a0e7cba058 tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.42.670915824\2112571180" -childID 38 -isForBrowser -prefsHandle 6944 -prefMapHandle 6840 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79a18c30-a55c-42fc-b24e-2095a58a4cc3} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6952 2a0e8785258 tab
    3⤵
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.41.1665479865\1712997060" -childID 37 -isForBrowser -prefsHandle 6776 -prefMapHandle 5684 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0f1a360-a252-4a21-b300-6a43f2615ece} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6188 2a0e871f858 tab
    3⤵
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.44.103903458\1259325209" -childID 40 -isForBrowser -prefsHandle 11384 -prefMapHandle 6228 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0080e05-9bac-49bf-ab1e-7c578e78f0c8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11380 2a0dd420b58 tab
    3⤵
    PID:5724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.43.1317019288\1056836387" -childID 39 -isForBrowser -prefsHandle 5740 -prefMapHandle 6312 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {104502c0-e981-418b-89c8-197aaedb299c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6840 2a0dd421458 tab
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.46.839998404\987569646" -childID 42 -isForBrowser -prefsHandle 10348 -prefMapHandle 3896 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9875aad5-5f93-4a43-9a69-035dce7e54d9} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6912 2a0e48ac758 tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.45.1258970750\1837875835" -childID 41 -isForBrowser -prefsHandle 5816 -prefMapHandle 6240 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {621c4cef-98a8-42c4-9908-d5af553f4ecb} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9988 2a0e36a6558 tab
    3⤵
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.47.1525675760\330135272" -childID 43 -isForBrowser -prefsHandle 11104 -prefMapHandle 5896 -prefsLen 29363 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a90ae9f-fd3a-41a2-8b20-0ad4770f802c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7076 2a0d0b30258 tab
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.48.810556354\2147855" -childID 44 -isForBrowser -prefsHandle 11436 -prefMapHandle 9948 -prefsLen 30486 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {702f7993-29fd-4604-9713-ee4a49bdf84b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11108 2a0e86a1658 tab
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.49.270498570\346654369" -childID 45 -isForBrowser -prefsHandle 9868 -prefMapHandle 7340 -prefsLen 30486 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e3af434-2e4e-49b3-b952-1d425e0e0697} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10472 2a0e9741f58 tab
    3⤵
    PID:7712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.50.1749190647\173521967" -childID 46 -isForBrowser -prefsHandle 9532 -prefMapHandle 10132 -prefsLen 30486 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d1d2f29-3c85-42b0-b4d5-e1e7b6ece60e} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3376 2a0e5830758 tab
    3⤵
    PID:6716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.51.1850936254\1924162297" -childID 47 -isForBrowser -prefsHandle 7252 -prefMapHandle 3940 -prefsLen 30486 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05d36c07-0280-41e2-ad64-2114de82969c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10516 2a0dd4c1258 tab
    3⤵
    PID:7924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.52.1777183651\601770348" -childID 48 -isForBrowser -prefsHandle 10412 -prefMapHandle 2848 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c2f6071-1e97-4aec-92b2-875ab3489199} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10548 2a0e3c6db58 tab
    3⤵
    PID:6612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.53.1714003580\2101987894" -childID 49 -isForBrowser -prefsHandle 9136 -prefMapHandle 9140 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94a862a2-d333-40ec-92f6-3b4b8369cb05} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9128 2a0e5296b58 tab
    3⤵
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.55.65255501\1355387464" -childID 51 -isForBrowser -prefsHandle 9712 -prefMapHandle 5656 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a668dad2-83a3-4110-9d70-1802658f2ba5} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9356 2a0e67c5f58 tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.54.491224130\233891938" -childID 50 -isForBrowser -prefsHandle 10828 -prefMapHandle 3516 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d05ef8c2-f296-4d93-a31b-485832fef069} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9452 2a0e5831058 tab
    3⤵
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.56.175190213\980729561" -childID 52 -isForBrowser -prefsHandle 9028 -prefMapHandle 10784 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81dc422a-cd04-4f2a-be08-bc9fe83d0a32} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8996 2a0e6c10458 tab
    3⤵
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.57.387115790\1914668868" -childID 53 -isForBrowser -prefsHandle 10780 -prefMapHandle 10200 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80208e0e-2c34-4b54-9fb6-2fae8294752a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9312 2a0e7126f58 tab
    3⤵
    PID:7412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.58.1246958949\1053957181" -childID 54 -isForBrowser -prefsHandle 6952 -prefMapHandle 5252 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a349a0e6-f1d3-4184-8b8d-b42d12c893e4} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6812 2a0e7127e58 tab
    3⤵
    PID:7408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.59.1848421384\612518553" -childID 55 -isForBrowser -prefsHandle 9652 -prefMapHandle 9692 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f87bf821-f255-44c4-9030-9acb459d52c4} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9040 2a0deb18958 tab
    3⤵
    PID:7436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.60.1876284340\739931944" -childID 56 -isForBrowser -prefsHandle 8932 -prefMapHandle 8928 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b35181c-63d6-415c-b47b-0b6114352cf3} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5784 2a0d0b69358 tab
    3⤵
    PID:7484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.61.1432918622\351269912" -childID 57 -isForBrowser -prefsHandle 8980 -prefMapHandle 10088 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fa773b6-cc09-4fcc-bf32-720ab7893cd1} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9652 2a0e36a8c58 tab
    3⤵
    PID:7704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.62.1210557513\865080195" -childID 58 -isForBrowser -prefsHandle 9108 -prefMapHandle 9120 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c7d366e-17bc-4838-92fb-641162980af1} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9908 2a0e7126358 tab
    3⤵
    PID:7832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.64.937734746\254919794" -childID 60 -isForBrowser -prefsHandle 10024 -prefMapHandle 11180 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e565cd-97be-4642-86f9-e6af09de7a34} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2692 2a0e7d70258 tab
    3⤵
    PID:7760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.63.1768395144\575813589" -childID 59 -isForBrowser -prefsHandle 5556 -prefMapHandle 9176 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {358f464e-02f0-4f90-b668-f9f1b0d8b428} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10356 2a0e7d6ed58 tab
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.66.1918174393\1650401093" -childID 62 -isForBrowser -prefsHandle 10052 -prefMapHandle 7532 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80d22555-2158-4392-987c-51227dab364c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7088 2a0e85aa158 tab
    3⤵
    PID:6492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.65.1694888236\277994648" -childID 61 -isForBrowser -prefsHandle 10140 -prefMapHandle 9720 -prefsLen 30495 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a9b84e-a9f8-4b0a-8c73-42f9ac780cb1} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9224 2a0e85ab058 tab
    3⤵
    PID:6296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.67.803716450\1552646023" -childID 63 -isForBrowser -prefsHandle 7104 -prefMapHandle 10904 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9678d69c-deee-43d8-9dcb-2deef0232f61} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6812 2a0e871f558 tab
    3⤵
    PID:4600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.69.2137768652\1634706103" -childID 65 -isForBrowser -prefsHandle 10052 -prefMapHandle 11356 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {258fd748-48c7-41de-9544-90829040398b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9828 2a0e7785f58 tab
    3⤵
    PID:6232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.68.112465152\47017615" -childID 64 -isForBrowser -prefsHandle 9880 -prefMapHandle 3520 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d1000b7-690d-4aad-aff7-defa96ae5615} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11356 2a0e7e44d58 tab
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.70.1363647241\1269236781" -childID 66 -isForBrowser -prefsHandle 9180 -prefMapHandle 9448 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9fc8e89-e96c-4bdb-bef0-9f8baf784ece} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3984 2a0e8a6c258 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.72.533969146\847586847" -childID 68 -isForBrowser -prefsHandle 9096 -prefMapHandle 9240 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dc66b54-c100-49aa-8433-430cef2a6439} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10936 2a0e8a6e058 tab
    3⤵
    PID:7972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.71.133784273\273888273" -childID 67 -isForBrowser -prefsHandle 9388 -prefMapHandle 7500 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa5d9db4-54e4-4bee-9907-6bfce8db7b53} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2764 2a0e871f558 tab
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.73.892929001\1932075985" -childID 69 -isForBrowser -prefsHandle 8840 -prefMapHandle 10892 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16c77574-f10b-4474-8100-632004782983} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11104 2a0e6834d58 tab
    3⤵
    PID:7340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.74.1856001334\990210676" -childID 70 -isForBrowser -prefsHandle 10392 -prefMapHandle 10516 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f998b7-8429-41fc-b6fb-e5ae2eb94bf9} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9444 2a0e6a56258 tab
    3⤵
    PID:6812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.75.1182306878\2002940143" -childID 71 -isForBrowser -prefsHandle 4648 -prefMapHandle 5556 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de1713b-5b98-458a-96d6-f3e1ee3cd336} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9092 2a0e8d25458 tab
    3⤵
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.76.1489990671\1610827639" -childID 72 -isForBrowser -prefsHandle 8644 -prefMapHandle 9852 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc83e241-8c63-4ff1-b711-82c01ac8fb73} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 4324 2a0e67c5f58 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.77.1942470359\802542092" -childID 73 -isForBrowser -prefsHandle 8788 -prefMapHandle 9144 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a232f87-ff44-4fb1-b590-92d92e7d495b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6696 2a0e6834d58 tab
    3⤵
    PID:8000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.78.1750391026\439159753" -childID 74 -isForBrowser -prefsHandle 8700 -prefMapHandle 11268 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8740671a-322d-449f-a2e8-e2e96a550bd8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10428 2a0e8d25158 tab
    3⤵
    PID:7000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.79.1523860683\1229292368" -childID 75 -isForBrowser -prefsHandle 9792 -prefMapHandle 10776 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1571fbd-0a6c-414d-a4d3-b3dea7570191} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9136 2a0e9396958 tab
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.80.1714156774\1994405085" -childID 76 -isForBrowser -prefsHandle 9884 -prefMapHandle 9788 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68614dcd-5afb-4899-9040-2b01e99f3360} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2876 2a0e9741358 tab
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.81.22690695\1648175495" -childID 77 -isForBrowser -prefsHandle 3524 -prefMapHandle 11192 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {564a28bb-12e1-47a6-b9ea-7c8052e351e7} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9840 2a0e9b73558 tab
    3⤵
    PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.82.716368340\1209276249" -childID 78 -isForBrowser -prefsHandle 9140 -prefMapHandle 10736 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0855931b-32fb-4278-a908-9c2c83a8796d} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11244 2a0e9397258 tab
    3⤵
    PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.83.800348643\1572789135" -childID 79 -isForBrowser -prefsHandle 11068 -prefMapHandle 6924 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f91de8ad-e900-4d5c-9992-50b266d1d696} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11316 2a0e985c858 tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.84.1376942885\638787179" -childID 80 -isForBrowser -prefsHandle 11196 -prefMapHandle 6848 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78725f04-fa90-44bd-9a0b-ca3700849b66} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8932 2a0e7dd1a58 tab
    3⤵
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.85.1983321715\1765050797" -childID 81 -isForBrowser -prefsHandle 6524 -prefMapHandle 11236 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3ab1031-cd29-4a88-b4cb-f1b9d71179e7} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9332 2a0e1a17558 tab
    3⤵
    PID:7788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.87.102270032\2036244858" -childID 83 -isForBrowser -prefsHandle 6008 -prefMapHandle 9112 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ae5595a-99a1-42ab-b5b6-593dde0a4641} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8984 2a0e83f9758 tab
    3⤵
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.86.336504708\819083022" -childID 82 -isForBrowser -prefsHandle 10364 -prefMapHandle 10148 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04137598-a530-4eb3-9c5b-1e78781b0b53} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8988 2a0e7125a58 tab
    3⤵
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.88.702668025\646189102" -childID 84 -isForBrowser -prefsHandle 10940 -prefMapHandle 9948 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a311546a-a450-4574-895b-f8d51f82acab} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 3356 2a0e9951758 tab
    3⤵
    PID:7188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.90.436685692\975425349" -childID 86 -isForBrowser -prefsHandle 6904 -prefMapHandle 9044 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e4ef060-da9a-4016-8875-a7958a520c89} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7052 2a0ead98b58 tab
    3⤵
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.89.1732955019\686184548" -childID 85 -isForBrowser -prefsHandle 8960 -prefMapHandle 9240 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc176835-42c2-4a09-9f30-287be7401569} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8980 2a0ead97c58 tab
    3⤵
    PID:6164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.91.1734849972\1235844526" -childID 87 -isForBrowser -prefsHandle 8780 -prefMapHandle 9736 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c950666-2dea-4255-a624-6209178ae4b2} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9436 2a0e193ef58 tab
    3⤵
    PID:6308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.92.1497871274\564625645" -childID 88 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5e17993-fe9b-4db5-8576-c4f11671d42a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5280 2a0ec33e258 tab
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.94.359311758\1502346576" -childID 90 -isForBrowser -prefsHandle 9640 -prefMapHandle 6944 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0157ad3e-ada9-491e-9c49-c2f66672c26d} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10116 2a0ec35f558 tab
    3⤵
    PID:6480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.93.183883464\2097971060" -childID 89 -isForBrowser -prefsHandle 9320 -prefMapHandle 9092 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a36c27d-6f48-433a-8025-8008d4b85093} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8524 2a0e9ef8958 tab
    3⤵
    PID:7980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.95.1354423803\685916409" -childID 91 -isForBrowser -prefsHandle 4736 -prefMapHandle 5464 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {164cf330-20d4-42d2-8637-dec2a089e07a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5284 2a0ec33e258 tab
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.96.2032256250\1382779810" -childID 92 -isForBrowser -prefsHandle 9260 -prefMapHandle 9736 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f10f363-51e5-447e-a532-0e94e0a5d7e2} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11060 2a0ea669b58 tab
    3⤵
    PID:7856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.97.652886289\20760765" -childID 93 -isForBrowser -prefsHandle 9336 -prefMapHandle 4736 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f19a7553-d875-44da-a48c-f109861aae92} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5336 2a0e8239258 tab
    3⤵
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.98.343279070\195595267" -childID 94 -isForBrowser -prefsHandle 10892 -prefMapHandle 4644 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3f274cb-7f36-4404-9dfe-d2920a8214d8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7396 2a0ec516b58 tab
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.101.629956660\1983627046" -childID 97 -isForBrowser -prefsHandle 8292 -prefMapHandle 6972 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9012a91f-b1e2-4644-9b37-f0c5bc6aed9b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8276 2a0ecf2f558 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.100.1626551566\69991242" -childID 96 -isForBrowser -prefsHandle 10312 -prefMapHandle 5956 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b72497f-8175-40f9-9d11-f030f15ca803} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8580 2a0ecb83f58 tab
    3⤵
    PID:8016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.99.400823672\1900300799" -childID 95 -isForBrowser -prefsHandle 1348 -prefMapHandle 11172 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec56d4d5-94de-4177-8126-688a1f1276b9} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10920 2a0ecb83c58 tab
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.102.633572602\954534565" -childID 98 -isForBrowser -prefsHandle 10168 -prefMapHandle 5476 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a557cd43-0f4b-4db0-95ef-74f6c1c89798} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6356 2a0ec647258 tab
    3⤵
    PID:7760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.103.1096001812\1232078691" -childID 99 -isForBrowser -prefsHandle 5976 -prefMapHandle 9332 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {122793ee-ae86-42e2-a96f-7bdc4abc6a35} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8344 2a0ecc5fc58 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.104.580135773\698163639" -childID 100 -isForBrowser -prefsHandle 4444 -prefMapHandle 9096 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b0a8d23-fd85-4bea-9c01-5f462409eee0} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8984 2a0ecc60e58 tab
    3⤵
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.105.1344044987\1064373847" -childID 101 -isForBrowser -prefsHandle 7296 -prefMapHandle 3280 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac459d3f-4ee6-4202-8ec5-10a0ac25a001} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5336 2a0eccfdf58 tab
    3⤵
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.108.384059891\563781440" -childID 104 -isForBrowser -prefsHandle 11060 -prefMapHandle 9308 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eacc780b-06a1-4471-afce-fc8f43f826aa} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5556 2a0ee619958 tab
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.107.1494160971\544043531" -childID 103 -isForBrowser -prefsHandle 8224 -prefMapHandle 8228 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b4d76e-0b8d-4586-9bfe-96b6830720d4} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11172 2a0ee617b58 tab
    3⤵
    PID:7540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.106.1672059387\1005579032" -childID 102 -isForBrowser -prefsHandle 6704 -prefMapHandle 9300 -prefsLen 30504 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c565974-fa46-4f77-bf90-960c5352e656} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9052 2a0ee619058 tab
    3⤵
    PID:6716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.110.614319671\1901763070" -childID 106 -isForBrowser -prefsHandle 6520 -prefMapHandle 6268 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f329b8f7-a016-4767-8761-cd31dcb8560a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5348 2a0eecea858 tab
    3⤵
    PID:6380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.109.506575842\371049038" -childID 105 -isForBrowser -prefsHandle 7872 -prefMapHandle 5764 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cf8bad4-7b97-4c96-b779-cfa538c28f40} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7924 2a0eecebd58 tab
    3⤵
    PID:7868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.112.1754857133\1257741299" -childID 108 -isForBrowser -prefsHandle 5536 -prefMapHandle 11376 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ba4322a-4b6d-4593-9d60-f2b3c96e093d} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7380 2a0d0b68458 tab
    3⤵
    PID:7412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.111.248652084\94132117" -childID 107 -isForBrowser -prefsHandle 5348 -prefMapHandle 6268 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3478d84a-c5ef-4276-996e-2f4a19d43ece} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10884 2a0dd48fe58 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.113.431497071\1223551246" -childID 109 -isForBrowser -prefsHandle 8504 -prefMapHandle 6972 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59e263fc-043c-49b2-987a-0d2b30849ac7} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8288 2a0dd536b58 tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.114.538535543\442768775" -childID 110 -isForBrowser -prefsHandle 9476 -prefMapHandle 10760 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cceb9b3e-a119-464e-8454-6d495fbbbe90} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8696 2a0d0b6be58 tab
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.115.271324208\1321684462" -childID 111 -isForBrowser -prefsHandle 9576 -prefMapHandle 5720 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {713f4a87-11d7-4b87-b20b-56c51d77ce18} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 4652 2a0d0b65f58 tab
    3⤵
    PID:7396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.116.565232883\149893709" -childID 112 -isForBrowser -prefsHandle 3380 -prefMapHandle 9556 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4cb6d28-808e-440e-981b-b90f1872fd1f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9488 2a0e3639c58 tab
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.117.1127720254\1171714981" -childID 113 -isForBrowser -prefsHandle 9556 -prefMapHandle 9488 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {136c87d5-bd21-4b08-9197-ba62e5d8d605} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8660 2a0d0b30e58 tab
    3⤵
    PID:6636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.118.894403823\1264686444" -childID 114 -isForBrowser -prefsHandle 4384 -prefMapHandle 10880 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acbba853-12b7-471e-8247-b07d45457bb9} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9724 2a0dd491358 tab
    3⤵
    PID:7560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.119.1119987813\1392625042" -childID 115 -isForBrowser -prefsHandle 10472 -prefMapHandle 7316 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40ea15dc-289e-48ad-9f2c-8fb88594420b} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9368 2a0e1f2b658 tab
    3⤵
    PID:5448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.120.1489653527\915577707" -childID 116 -isForBrowser -prefsHandle 9952 -prefMapHandle 11348 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25b6dbc9-8a2f-417e-ab6b-5375e31707a3} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9740 2a0e3e29b58 tab
    3⤵
    PID:7612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.121.1887306225\128156548" -childID 117 -isForBrowser -prefsHandle 8716 -prefMapHandle 7300 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {979163d5-e3be-465f-acc3-692556899262} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11244 2a0d0b5e258 tab
    3⤵
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.122.45835928\77346560" -childID 118 -isForBrowser -prefsHandle 7256 -prefMapHandle 7204 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eead2841-06fb-48cc-a07b-19b16d907c5a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11020 2a0e67c4458 tab
    3⤵
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.123.2084453071\1450187622" -childID 119 -isForBrowser -prefsHandle 7128 -prefMapHandle 9584 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dfce81d-5293-4696-9cca-b0f832af38bb} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 5692 2a0e3c6ae58 tab
    3⤵
    PID:7020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.124.1880425033\992569502" -childID 120 -isForBrowser -prefsHandle 11164 -prefMapHandle 8672 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c6d8c6c-1e88-4e6a-9e86-ffb5d61e5adc} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7888 2a0e48ae258 tab
    3⤵
    PID:7092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.126.581540429\1747622542" -childID 122 -isForBrowser -prefsHandle 7428 -prefMapHandle 10944 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d917261-ec32-4c60-acfa-c8f78e084cb6} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10404 2a0e7126c58 tab
    3⤵
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.125.1782634629\1950080390" -childID 121 -isForBrowser -prefsHandle 11212 -prefMapHandle 5460 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {898403ba-89b2-4909-8d26-069f8e775fa8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8508 2a0e7126658 tab
    3⤵
    PID:7804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.127.1054112114\423972955" -childID 123 -isForBrowser -prefsHandle 8968 -prefMapHandle 5644 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e2ecc1-1c65-4d19-89cb-38a84e8f7a7c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 11168 2a0e2aed258 tab
    3⤵
    PID:7404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.128.1495772368\1811919143" -childID 124 -isForBrowser -prefsHandle 7068 -prefMapHandle 9244 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c79627b9-d587-4590-be34-ed5f5f464a84} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6740 2a0e2c8b358 tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.129.650875021\259479961" -childID 125 -isForBrowser -prefsHandle 6952 -prefMapHandle 3896 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b91a14c-71aa-4a41-bea9-fc2f7b369051} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6696 2a0e48a3558 tab
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.130.1959738913\1515422630" -childID 126 -isForBrowser -prefsHandle 5732 -prefMapHandle 10028 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfe14553-b8a4-4951-b74d-65d014025c88} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7892 2a0e3572858 tab
    3⤵
    PID:7160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.131.2142237863\396160265" -childID 127 -isForBrowser -prefsHandle 9360 -prefMapHandle 9204 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf25ab91-7bf7-47a9-b9e7-9826a2b120d7} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9188 2a0e3572e58 tab
    3⤵
    PID:6344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.132.1692428100\1791909454" -childID 128 -isForBrowser -prefsHandle 11336 -prefMapHandle 9476 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96be451a-b6e3-470a-a231-4cd7c5f3fd04} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10352 2a0e2c8b658 tab
    3⤵
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.133.1506872050\1708196352" -childID 129 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4276d276-8505-41d2-a5e3-fddb1ceee40c} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 2596 2a0e5217058 tab
    3⤵
    PID:7552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.135.985603227\25414481" -childID 131 -isForBrowser -prefsHandle 6708 -prefMapHandle 10564 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6efcdbc4-5297-4f84-aedc-72a364b1c54a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 1644 2a0e6b2bb58 tab
    3⤵
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.134.2140680168\899195712" -childID 130 -isForBrowser -prefsHandle 11112 -prefMapHandle 6528 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {526065b1-be2c-4639-ac9c-1d2ec5f0e171} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8484 2a0dcf44258 tab
    3⤵
    PID:8048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.136.474837217\117516744" -childID 132 -isForBrowser -prefsHandle 10360 -prefMapHandle 9488 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba04c009-fdfe-4562-a605-c1d2a2fe9cee} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6272 2a0e7dd1a58 tab
    3⤵
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.137.1112958273\1674880847" -childID 133 -isForBrowser -prefsHandle 4564 -prefMapHandle 10208 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57f18004-6e6e-4e67-9c94-a90899dea7f8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9572 2a0e9035c58 tab
    3⤵
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.138.960866102\960658756" -childID 134 -isForBrowser -prefsHandle 9004 -prefMapHandle 8852 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3df0acd3-a755-4da0-b5c8-ed73e4613b6f} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10964 2a0e9607c58 tab
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.139.367990436\2142627415" -childID 135 -isForBrowser -prefsHandle 4384 -prefMapHandle 7280 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8542d5ba-cd89-42eb-a6c0-c10c7f6748f1} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 4720 2a0e7988558 tab
    3⤵
    PID:7996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.140.354480177\1212284905" -childID 136 -isForBrowser -prefsHandle 2180 -prefMapHandle 6124 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5a12bf2-df88-48be-ac3e-e2166eee8b1e} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 7200 2a0e6b2b258 tab
    3⤵
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.143.981840515\969910790" -childID 139 -isForBrowser -prefsHandle 9260 -prefMapHandle 9308 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49925a06-85af-4e1a-91df-38d286ecb1f7} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8600 2a0eeb3b058 tab
    3⤵
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.142.1682309783\1587660841" -childID 138 -isForBrowser -prefsHandle 8760 -prefMapHandle 5592 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c5acfe-54dd-458e-b285-6a63725bcf3a} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 8268 2a0eeb3ce58 tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.141.1538409049\1054780707" -childID 137 -isForBrowser -prefsHandle 9940 -prefMapHandle 9948 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89ed27d0-53cb-4a5d-bb6d-4d382354f854} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 9532 2a0eeb3c858 tab
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.145.1892144181\1061200520" -childID 141 -isForBrowser -prefsHandle 9440 -prefMapHandle 9012 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b5c1099-8648-4aa3-8391-6ef0591fa23e} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 10860 2a0e2714158 tab
    3⤵
    PID:7852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.144.724620658\2037397088" -childID 140 -isForBrowser -prefsHandle 8000 -prefMapHandle 9492 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aa52463-3809-4f5b-81f9-3c9389a1d250} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6860 2a0e1f2ce58 tab
    3⤵
    PID:6508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4948.146.697172863\1809024034" -childID 142 -isForBrowser -prefsHandle 9984 -prefMapHandle 10200 -prefsLen 30560 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3705b44-152b-4944-ab2a-95c498d825b8} 4948 "\\.\pipe\gecko-crash-server-pipe.4948" 6884 2a0e50d0c58 tab
    3⤵
    PID:7120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f\" -spe -an -ai#7zMap70:190:7zEvent15426
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5040

C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
"C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe"
1⤵
- Checks QEMU agent file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:876
- C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe
  "C:\Users\Admin\Downloads\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f\1766dfe858c3998d114269e8436b100b14eb9b63df0dbbde472a6e3b8f6a585f.exe"
  2⤵
  - Checks QEMU agent file
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PaSS-1122-For-Open-Archive\" -spe -an -ai#7zMap8521:114:7zEvent17753
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2352

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PaSS-1122-For-Open-Archive\App-Satup+++\" -spe -an -ai#7zMap245:140:7zEvent21521
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:508

C:\Users\Admin\Downloads\PaSS-1122-For-Open-Archive\App-Satup+++\Setup_Latest+++.exe
"C:\Users\Admin\Downloads\PaSS-1122-For-Open-Archive\App-Satup+++\Setup_Latest+++.exe"
1⤵
- Executes dropped EXE
PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 520
  2⤵
  - Program crash
  PID:4888

C:\Users\Admin\Downloads\vpnkitsetup.exe
"C:\Users\Admin\Downloads\vpnkitsetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq vpnkit.exe" | find "vpnkit.exe"
  2⤵
  PID:5860
- - C:\Windows\SysWOW64\find.exe
    find "vpnkit.exe"
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq vpnkit.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
  "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    PID:6748
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      PID:6820
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v vpnkit
    3⤵
    - Modifies registry key
    PID:6904
- - C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
    "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=gpu-process --field-trial-handle=1968,3440487367485418192,75596003025076196,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1976 --ignored=" --type=renderer " /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7108
- - C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
    "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=renderer --field-trial-handle=1968,3440487367485418192,75596003025076196,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\topvpn\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:6104
- - C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
    "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=utility --field-trial-handle=1968,3440487367485418192,75596003025076196,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2468 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5592
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v vpnkit /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:7496
- - C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
    "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=renderer --field-trial-handle=1968,3440487367485418192,75596003025076196,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\topvpn\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7476
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe QUERY HKCU\Software\VPNKit /v id
    3⤵
    - Modifies registry key
    PID:7460

C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
"C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:7004
- - C:\Windows\SysWOW64\chcp.com
    chcp
    3⤵
    PID:7096
- C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
  "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=gpu-process --field-trial-handle=2116,4700679153493641125,284244996225057144,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2124 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6188
- C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
  "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=utility --field-trial-handle=2116,4700679153493641125,284244996225057144,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:6652
- C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe
  "C:\Users\Admin\AppData\Local\Programs\topvpn\vpnkit.exe" --type=gpu-process --field-trial-handle=2116,4700679153493641125,284244996225057144,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:7300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PassWord_10101_For_Open_Archive\" -spe -an -ai#7zMap20044:124:7zEvent26054
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6164

C:\Users\Admin\Downloads\PassWord_10101_For_Open_Archive\SetupNew.exe
"C:\Users\Admin\Downloads\PassWord_10101_For_Open_Archive\SetupNew.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\foe"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\foe\foe.exe'" /f
  2⤵
  PID:5780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Local\Temp\foe\foe.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:7884
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\Downloads\PassWord_10101_For_Open_Archive\SetupNew.exe" "C:\Users\Admin\AppData\Local\Temp\foe\foe.exe"
  2⤵
  PID:5740

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\" -spe -an -ai#7zMap30138:130:7zEvent12018
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:8012

C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\InstallsNew.exe
"C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\InstallsNew.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn \SC5\DHD58 /tr """"C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.exe""" """C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.chm"""" /st 00:01 /du 9330:32 /sc once /ri 1 /f
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \SC5\DHD58 /tr """"C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.exe""" """C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.chm"""" /st 00:01 /du 9330:32 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout -t 4 && del "C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\InstallsNew.exe"
  2⤵
  PID:6316
- - C:\Windows\SysWOW64\timeout.exe
    timeout -t 4
    3⤵
    - Delays execution with timeout.exe
    PID:3100

C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.exe
C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.exe "C:\Users\Admin\AppData\Roaming\7CBC507363CD53FD\srvrast.chm"
1⤵
- Executes dropped EXE
PID:6740

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\ActivationCode.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5720
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode.rar"
  2⤵
  - Checks processor information in registry
  PID:4148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\" -spe -an -ai#7zMap19272:130:7zEvent3348
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7556

C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\InstallsNew.exe
"C:\Users\Admin\Downloads\New_Version_Setup_2023_is_PassCode\InstallsNew.exe"
1⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1080

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6952

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\2O23-F1LES-S0ft\" -spe -an -ai#7zMap23222:92:7zEvent15529
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7664

C:\Users\Admin\Downloads\2O23-F1LES-S0ft\LauncherPC.exe
"C:\Users\Admin\Downloads\2O23-F1LES-S0ft\LauncherPC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:7584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MeSoftwares\" -spe -an -ai#7zMap9098:84:7zEvent29970
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6396

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MeSoftwares\" -spe -an -ai#7zMap30366:84:7zEvent19146
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7100

C:\Users\Admin\Downloads\MeSoftwares\Set-up32Х64bit.exe
"C:\Users\Admin\Downloads\MeSoftwares\Set-up32Х64bit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\conhost.exe
    "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1032
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Executes dropped EXE
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:6044
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c (ping 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\svchost.exe") & (start "" "C:\ProgramData\service.exe")
      4⤵
      PID:3844
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:7060
    - - C:\ProgramData\service.exe
        
        "C:\ProgramData\service.exe"
        5⤵
        Executes dropped EXE
        
        PID:5124

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:7828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1\" -spe -an -ai#7zMap18018:134:7zEvent25271
1⤵
PID:7720

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1\" -spe -an -ai#7zMap21681:134:7zEvent3612
1⤵
PID:2192

C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1\ApplicationSetupFile14.1.exe
"C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1\ApplicationSetupFile14.1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 148
  2⤵
  - Program crash
  PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5172 -ip 5172
1⤵
PID:6248

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Passw_items_АpplicationSetupFilе14.1\Readmе.txt
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery