7267a08112fb350eb8a635fa17ea86e1dbcf7d55d59709cca2417e2c247d9470

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ajFDD3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ajFDD3.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Control Panel\International\Geo\Nation	ajFDD3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe

Executes dropped EXE 16 IoCs

pid	Process
2420	avg_secure_browser_setup.exe
6296	ajFDD3.exe
1384	siinst.exe
2460	siinst.tmp
6216	softinfo.exe
2388	softinfo.exe
2016	siinst.exe
1924	siinst.tmp
4852	softinfo.exe
96	softinfo.exe
3656	softinfo.exe
1584	softinfo.exe
7128	softinfo.exe
1480	softinfo.exe
5700	WeMod-Setup.exe
4460	WeMod-Setup.exe

Loads dropped DLL 62 IoCs

pid	Process
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
2460	siinst.tmp
6216	softinfo.exe
6216	softinfo.exe
6216	softinfo.exe
6216	softinfo.exe
2388	softinfo.exe
2388	softinfo.exe
2388	softinfo.exe
2388	softinfo.exe
2388	softinfo.exe
2388	softinfo.exe
1924	siinst.tmp
4852	softinfo.exe
4852	softinfo.exe
4852	softinfo.exe
4852	softinfo.exe
96	softinfo.exe
96	softinfo.exe
96	softinfo.exe
96	softinfo.exe
96	softinfo.exe
96	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
1584	softinfo.exe
1584	softinfo.exe
1584	softinfo.exe
1584	softinfo.exe
1584	softinfo.exe
1584	softinfo.exe
7128	softinfo.exe
7128	softinfo.exe
7128	softinfo.exe
7128	softinfo.exe
7128	softinfo.exe
7128	softinfo.exe
1480	softinfo.exe
1480	softinfo.exe
1480	softinfo.exe
1480	softinfo.exe
1480	softinfo.exe
1480	softinfo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows\CurrentVersion\Run\Software Informer = "\"C:\\Program Files\\Software Informer\\softinfo.exe\" -autorun"	siinst.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows\CurrentVersion\Run\Software Informer = "\"C:\\Program Files\\Software Informer\\softinfo.exe\" -autorun"	siinst.tmp

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	ajFDD3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\AVAST Software\Avast	ajFDD3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	softinfo.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1489	camo.githubusercontent.com
1491	camo.githubusercontent.com
1492	camo.githubusercontent.com
1496	camo.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ajFDD3.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	softinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	softinfo.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Software Informer\is-SKNRC.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	msiexec.exe
File created	C:\Program Files\Software Informer\Resources\notifications\flat\giveaways\is-KMVKC.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File created	C:\Program Files\Software Informer\Resources\windows\splash\is-57PIT.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File created	C:\Program Files\Software Informer\html5ui\welcome\is-GI6A7.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\Resources\is-O24MB.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\Resources\windows\splash\is-E395V.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File created	C:\Program Files\Software Informer\html5ui\welcome\is-HNKQ4.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\Resources\notifications\flat\articles\is-EVQNH.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	msiexec.exe
File created	C:\Program Files\Software Informer\is-4J66U.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\va.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\be.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File created	C:\Program Files\Software Informer\Resources\notifications\flat\articles\is-VIPQD.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\Resources\controls\buttons\is-SCGBB.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File created	C:\Program Files\Software Informer\Resources\is-TL9RS.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\Resources\notifications\flat\articles\is-38H91.tmp	siinst.tmp
File created	C:\Program Files\Software Informer\is-6SQDC.tmp	siinst.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	msiexec.exe
File created	C:\Program Files\7-Zip\readme.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7556.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000}	msiexec.exe
File created	C:\Windows\Installer\e6673df.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	7zFM.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File created	C:\Windows\Installer\e66742d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\e6673df.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000\LogConf	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	softinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000\Control	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajFDD3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	softinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	softinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	softinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	softinfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	softinfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	softinfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	softinfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2240	schtasks.exe
6436	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\softinfo.exe = "11000"	siinst.tmp
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	siinst.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\softinfo.exe = "11000"	siinst.tmp
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING	siinst.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\softinfo.exe = "11000"	siinst.tmp
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	siinst.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	siinst.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\softinfo.exe = "0"	siinst.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\softinfo.exe = "0"	siinst.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\softinfo.exe = "0"	siinst.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\softinfo.exe = "11000"	siinst.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING	siinst.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\softinfo.exe = "0"	siinst.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	siinst.tmp
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING	siinst.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING	siinst.tmp

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\PackageName = "7z2201-x64(1).msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Program = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Version = "369164288"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\LanguageFiles = "Complete"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\PackageCode = "96F071321C0420722210000020000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420722210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Assignment = "1"	msiexec.exe

NTFS ADS 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\lua-5.4.6(1).tar.gz:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\siinst.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WeMod-Setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64(1).msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\SpaceHub-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\lua-5.4.6.tar.gz:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ddtool_4.6.9_aeriagames.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7076	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe
2420	avg_secure_browser_setup.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
7044	OpenWith.exe
5964	7zFM.exe
5668	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	6296	ajFDD3.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	4280	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeRestorePrivilege	5964	7zFM.exe
Token: 35	5964	7zFM.exe
Token: SeSecurityPrivilege	5964	7zFM.exe
Token: SeSecurityPrivilege	5964	7zFM.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeRestorePrivilege	5668	7zFM.exe
Token: 35	5668	7zFM.exe
Token: SeSecurityPrivilege	5668	7zFM.exe
Token: SeSecurityPrivilege	5668	7zFM.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	2460	siinst.tmp
Token: SeDebugPrivilege	5308	firefox.exe
Token: SeDebugPrivilege	1924	siinst.tmp
Token: SeDebugPrivilege	1924	siinst.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5964	7zFM.exe
5964	7zFM.exe
5964	7zFM.exe
5964	7zFM.exe
5964	7zFM.exe
5668	7zFM.exe
5668	7zFM.exe
5668	7zFM.exe
5668	7zFM.exe
2460	siinst.tmp
2388	softinfo.exe
2388	softinfo.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
1924	siinst.tmp
96	softinfo.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
2388	softinfo.exe
2388	softinfo.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
96	softinfo.exe
96	softinfo.exe
3656	softinfo.exe
3656	softinfo.exe
5308	firefox.exe
5308	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
2420	avg_secure_browser_setup.exe
6296	ajFDD3.exe
6296	ajFDD3.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
7044	OpenWith.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
1968	OpenWith.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
5308	firefox.exe
2388	softinfo.exe
2388	softinfo.exe
5308	firefox.exe
5308	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 504 wrote to memory of 4280	504	firefox.exe	74
PID 4280 wrote to memory of 2264	4280	firefox.exe	75
PID 4280 wrote to memory of 2264	4280	firefox.exe	75
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 772	4280	firefox.exe	76
PID 4280 wrote to memory of 5084	4280	firefox.exe	77
PID 4280 wrote to memory of 5084	4280	firefox.exe	77
PID 4280 wrote to memory of 5084	4280	firefox.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\ва.txt
1⤵
PID:4488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.0.1883246973\548340065" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1732 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2f5f14f-1002-4748-a09f-597e55836ef4} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 1812 16ee54cf458 gpu
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.1.878029043\566653003" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23f7b312-31fe-4ea6-9d01-ebb6fbbac91b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2168 16ed3170458 socket
    3⤵
    - Checks processor information in registry
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.2.843910131\1467557338" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2856 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3468251-1fb1-4e27-9e07-b18256368860} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2960 16ee9697858 tab
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.3.1314170124\452306537" -childID 2 -isForBrowser -prefsHandle 976 -prefMapHandle 972 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e6d8d4b-cca4-4baf-b856-ecfc94f9d280} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2796 16ed3161358 tab
    3⤵
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.4.1397470673\1106505519" -childID 3 -isForBrowser -prefsHandle 4304 -prefMapHandle 4300 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {898d5f83-a3c2-46e8-92be-70a7d69b5c4b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 4316 16eeb6b2058 tab
    3⤵
    PID:1376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.5.1228797695\1200018263" -childID 4 -isForBrowser -prefsHandle 2576 -prefMapHandle 4916 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4e947e5-e0f0-4eb3-9874-d39b4f6536f6} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2588 16ee54d0c58 tab
    3⤵
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.6.1888620086\861872728" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9116598-a1a4-40ae-906d-3a880dabff9c} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5012 16eec664858 tab
    3⤵
    PID:660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.7.988849377\1882636210" -childID 6 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12fd3815-a2d8-4b30-808c-1bb9f705a1ba} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5208 16eec664b58 tab
    3⤵
    PID:516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.8.1996842978\1933891486" -childID 7 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3560e7e-bcd6-47af-baee-e9757370714a} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5668 16eec667e58 tab
    3⤵
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.9.1469530042\725607052" -childID 8 -isForBrowser -prefsHandle 2880 -prefMapHandle 2916 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a765e16b-19b8-4570-ba03-f1c151cffde1} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 1372 16eed850758 tab
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.10.115822882\680815101" -childID 9 -isForBrowser -prefsHandle 4404 -prefMapHandle 5152 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09c3bb8e-5a91-4710-81cf-3cdfd46317e9} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5108 16eeb7d3858 tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.11.1391855460\1576625527" -childID 10 -isForBrowser -prefsHandle 5420 -prefMapHandle 5472 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cea88de-2363-4e9a-9c00-c5e03e55c5a5} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5852 16eed769b58 tab
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.12.1644591448\508218788" -childID 11 -isForBrowser -prefsHandle 4648 -prefMapHandle 5812 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {317b1f36-c150-4772-8e2b-7e6cebe04ec7} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5752 16eed86f758 tab
    3⤵
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.13.1700544867\2010604478" -childID 12 -isForBrowser -prefsHandle 9944 -prefMapHandle 9948 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d5abd17-1352-40e5-9ea6-4c3846f8de32} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2928 16eed851c58 tab
    3⤵
    PID:592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.14.1536339236\1764777130" -childID 13 -isForBrowser -prefsHandle 5428 -prefMapHandle 5396 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d66966a-835e-4424-adfd-3f2981313df7} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5312 16eee7e0b58 tab
    3⤵
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.15.736950894\1482745796" -childID 14 -isForBrowser -prefsHandle 7628 -prefMapHandle 7428 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dead771-921e-42ae-af7e-67ea3e81fca9} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7636 16eef5fcf58 tab
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.16.953810878\272415875" -childID 15 -isForBrowser -prefsHandle 9916 -prefMapHandle 9920 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04cb5068-2701-4f40-884c-7ca1095f381f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9908 16eef7fbf58 tab
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.17.1959700703\1607952934" -childID 16 -isForBrowser -prefsHandle 9592 -prefMapHandle 9620 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd449a7f-cc23-489c-9592-d5dcb6bc5f3f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9760 16ef0193e58 tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.18.755378051\1187045176" -childID 17 -isForBrowser -prefsHandle 7296 -prefMapHandle 7292 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e77bed4-8a9a-4a83-ae2a-64c71ab18210} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7304 16ef0195358 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.19.1974092137\315120124" -childID 18 -isForBrowser -prefsHandle 7096 -prefMapHandle 7092 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e313ec39-fbac-4dc0-89fd-591a720bc50f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2564 16ef0194a58 tab
    3⤵
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.20.794053591\662963296" -childID 19 -isForBrowser -prefsHandle 9352 -prefMapHandle 9356 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99b86120-1c4a-49fd-b72f-dff85c77e9e5} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9344 16eef6d2258 tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.21.1196043531\448593271" -childID 20 -isForBrowser -prefsHandle 7036 -prefMapHandle 7032 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd1f657a-a729-4526-8cf3-3d7ff9ba7c98} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7268 16ef07e6b58 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.22.168025704\2080338484" -childID 21 -isForBrowser -prefsHandle 6808 -prefMapHandle 6804 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9aa773-3e9e-4bbe-a720-0515efafb6bc} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6816 16ef07e6e58 tab
    3⤵
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.23.1854005763\1126172786" -parentBuildID 20221007134813 -prefsHandle 7388 -prefMapHandle 7100 -prefsLen 26817 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {972a3bcd-0981-4a23-8fce-d3cb6e7b53b0} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7312 16eef7fbf58 rdd
    3⤵
    PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.24.1013895961\2134649408" -childID 22 -isForBrowser -prefsHandle 7140 -prefMapHandle 1636 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac45ab73-8fa6-4654-a38b-4542d7dbc3de} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7696 16ed312d258 tab
    3⤵
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.25.205174771\577490233" -childID 23 -isForBrowser -prefsHandle 9728 -prefMapHandle 9744 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7929c634-172a-4888-9420-be50943dd042} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9716 16ef0b41558 tab
    3⤵
    PID:5732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.26.1882256101\810893318" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 26817 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e07edf6-85f3-47fa-b460-eddedb7fe56d} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9772 16ef11aee58 utility
    3⤵
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.27.2107067533\91083422" -childID 24 -isForBrowser -prefsHandle 7452 -prefMapHandle 9580 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {173d9ee4-1767-4c48-90b2-f74f9fbeb3f0} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9712 16ef1520858 tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.28.1073979739\1149606263" -childID 25 -isForBrowser -prefsHandle 2908 -prefMapHandle 3112 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a98f2ca-753b-41f9-856a-213a95fcbc86} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5948 16eed3a1258 tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.29.991963859\1673964886" -childID 26 -isForBrowser -prefsHandle 5880 -prefMapHandle 4444 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {673a3fa0-0267-4014-a1d4-cbc56e56252d} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7412 16eed3a3f58 tab
    3⤵
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.30.2127653640\182761605" -childID 27 -isForBrowser -prefsHandle 2692 -prefMapHandle 2932 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5660851e-0071-486c-b175-d432a89c528b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6256 16ef1812358 tab
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.31.1581137697\110749444" -childID 28 -isForBrowser -prefsHandle 6244 -prefMapHandle 6240 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee7e5e54-a868-46c0-979f-eed7c9ce3ca2} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9052 16ef1812c58 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.32.928643524\242344552" -childID 29 -isForBrowser -prefsHandle 9064 -prefMapHandle 4648 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35693757-678c-4d27-9ef5-e994a0b80865} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6028 16ef0c3a258 tab
    3⤵
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.33.1172937082\1807065348" -childID 30 -isForBrowser -prefsHandle 5736 -prefMapHandle 10148 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f38db487-7abe-4577-9350-d4300b37bdd3} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 4484 16ef1dd1858 tab
    3⤵
    PID:5132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.34.31543661\1296050754" -childID 31 -isForBrowser -prefsHandle 8968 -prefMapHandle 8972 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efc119c9-cbea-4655-b63a-247309d8e9bc} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 10140 16ef1f33058 tab
    3⤵
    PID:5140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.35.291259558\907973340" -childID 32 -isForBrowser -prefsHandle 10216 -prefMapHandle 9008 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0221c908-41de-4304-881c-4805aaf357c6} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 10204 16ef21a8358 tab
    3⤵
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.36.1045976573\751297092" -childID 33 -isForBrowser -prefsHandle 8668 -prefMapHandle 8672 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c709cdd2-81d7-4aab-993e-626291a13c2e} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7160 16ee7ceae58 tab
    3⤵
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.37.1793023260\290923843" -childID 34 -isForBrowser -prefsHandle 8604 -prefMapHandle 8608 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43eac2f5-e949-4d3b-bd49-79e2d9c57161} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5428 16ef21a8c58 tab
    3⤵
    PID:608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.38.1357560024\2118885489" -childID 35 -isForBrowser -prefsHandle 10204 -prefMapHandle 9636 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29593c98-3fe5-4cb6-bd0a-f8e7aec223db} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7424 16ef24a8c58 tab
    3⤵
    PID:3352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.39.1777194987\1498363419" -childID 36 -isForBrowser -prefsHandle 8880 -prefMapHandle 8904 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e46c957-a0f8-415b-bbfe-c8c5565a8ec6} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6880 16ef24a8658 tab
    3⤵
    PID:6272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.40.1785492167\191464918" -childID 37 -isForBrowser -prefsHandle 8796 -prefMapHandle 8812 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {930b0f03-8707-4807-9f67-2ef7e8d7c38b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8784 16eef8c4258 tab
    3⤵
    PID:6280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.41.429118782\168598971" -childID 38 -isForBrowser -prefsHandle 10028 -prefMapHandle 10212 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5dc4bd0-2470-4d74-a32f-2a5c86ef856f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6728 16eef8c4558 tab
    3⤵
    PID:6288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.42.1472970233\1462323471" -childID 39 -isForBrowser -prefsHandle 8848 -prefMapHandle 8768 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {117c6d6d-f968-4465-97b3-d25dee2eeddc} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8832 16ef0cee358 tab
    3⤵
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.43.793412695\1283800308" -childID 40 -isForBrowser -prefsHandle 6204 -prefMapHandle 6220 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0f383c7-7a83-4421-9033-66972eff435f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6192 16ef1ff2858 tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.44.663578684\865535576" -childID 41 -isForBrowser -prefsHandle 7688 -prefMapHandle 6812 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {439c1d6a-699b-42c9-98ca-ddff254aad0c} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5548 16ef1ff1958 tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.45.2014502272\430027349" -childID 42 -isForBrowser -prefsHandle 8632 -prefMapHandle 8164 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cfe770e-32e7-455c-bcb3-deb8f96e71e6} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8144 16ef1ff1658 tab
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.46.876500701\2026815404" -childID 43 -isForBrowser -prefsHandle 10120 -prefMapHandle 8792 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {497fcb77-e04a-4ef6-94f4-cd5c13bfe701} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8184 16ef1dac958 tab
    3⤵
    PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.47.641881282\1568351859" -childID 44 -isForBrowser -prefsHandle 8060 -prefMapHandle 8064 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63849431-5ca4-4102-b0bd-56ad56dbcb0d} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8080 16ef1127e58 tab
    3⤵
    PID:6792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.48.1397850902\1190418045" -childID 45 -isForBrowser -prefsHandle 7272 -prefMapHandle 7792 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d9f4124-f59a-4fd2-b957-a97008f7a6c3} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7808 16ef319e258 tab
    3⤵
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.49.102291796\1887479895" -childID 46 -isForBrowser -prefsHandle 7812 -prefMapHandle 7240 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cff9fb01-e6c4-4655-99a3-7df9e1a6a544} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7832 16ef3186258 tab
    3⤵
    PID:5928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.50.234484690\1433315862" -childID 47 -isForBrowser -prefsHandle 7824 -prefMapHandle 7820 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2932c65a-1aab-477b-8658-d9e17b467512} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7488 16ef3187d58 tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.51.607994288\103865850" -childID 48 -isForBrowser -prefsHandle 9092 -prefMapHandle 10200 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9863affb-53e9-4dfa-baf0-a58e999f757c} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7764 16ef31bb858 tab
    3⤵
    PID:6416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.52.182607371\2019140875" -childID 49 -isForBrowser -prefsHandle 8988 -prefMapHandle 7836 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29ecebc6-8803-4dad-b773-1ea6be7eb141} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5956 16eef5a4e58 tab
    3⤵
    PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.53.18292183\392541169" -childID 50 -isForBrowser -prefsHandle 8020 -prefMapHandle 8024 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39b00163-db9b-41a7-ac47-a69c1972cde8} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9140 16eef5a2458 tab
    3⤵
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.54.309583012\1130823701" -childID 51 -isForBrowser -prefsHandle 10160 -prefMapHandle 5112 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c3c2d0c-ac68-44fc-81ed-0165874450be} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7776 16eefa54f58 tab
    3⤵
    PID:1336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.55.16647690\511786464" -childID 52 -isForBrowser -prefsHandle 8452 -prefMapHandle 8732 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b01cdf9c-495c-43b6-a74d-21d963d9d9bc} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8456 16ef31e1a58 tab
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.56.778644382\1493414445" -childID 53 -isForBrowser -prefsHandle 8108 -prefMapHandle 7260 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e08595ca-9856-4cfd-be5c-6f01a1fffdc2} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6692 16ef2ae8958 tab
    3⤵
    PID:2712
- - C:\Users\Admin\Downloads\avg_secure_browser_setup.exe
    "C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\ajFDD3.exe
      "C:\Users\Admin\AppData\Local\Temp\ajFDD3.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.57.1533834610\1078547231" -childID 54 -isForBrowser -prefsHandle 9096 -prefMapHandle 5788 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3efea03-708e-49eb-b6aa-ae5cccfa3c7b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9784 16eef8cdd58 tab
    3⤵
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.58.417703279\1054737165" -childID 55 -isForBrowser -prefsHandle 9220 -prefMapHandle 8160 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9b19527-233d-4abc-a06b-84147f41db8f} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7972 16ef03ebe58 tab
    3⤵
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.59.1683923573\393819562" -childID 56 -isForBrowser -prefsHandle 8476 -prefMapHandle 8584 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93a59814-9aec-43b2-9564-d0aa7dffbb22} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8284 16ef3d71058 tab
    3⤵
    PID:6792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.60.1615493490\50223805" -childID 57 -isForBrowser -prefsHandle 7892 -prefMapHandle 7956 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5fb51a1-c52f-4380-8052-8ab5d9bb581c} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 9128 16ef2404a58 tab
    3⤵
    PID:1796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.61.353905567\136075487" -childID 58 -isForBrowser -prefsHandle 6028 -prefMapHandle 8028 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7001d60e-9c93-4928-bda8-dc357f45dadc} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8896 16ef5093b58 tab
    3⤵
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.62.1049401709\1301432921" -childID 59 -isForBrowser -prefsHandle 5292 -prefMapHandle 4260 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd5b55a0-d7fc-4490-8e46-de492007d67d} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7020 16eefa54f58 tab
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.63.260741529\1312849017" -childID 60 -isForBrowser -prefsHandle 9088 -prefMapHandle 7840 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6b288cb-eb10-495b-939c-80aa939c503a} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6712 16ef431a458 tab
    3⤵
    PID:6636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.64.2136209086\1701806792" -childID 61 -isForBrowser -prefsHandle 4504 -prefMapHandle 7856 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb1934fd-5d43-453c-8d9d-7e68147bf974} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6284 16ef3dd2f58 tab
    3⤵
    PID:5676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.65.1747489444\995551403" -childID 62 -isForBrowser -prefsHandle 9088 -prefMapHandle 6728 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {200aaf5a-82cd-4f98-95e9-61df2fc14489} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5176 16ef3dd0b58 tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.66.1095091021\161691616" -childID 63 -isForBrowser -prefsHandle 9076 -prefMapHandle 4444 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed54e705-2237-4646-ad7e-a4e8e40bc17d} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6248 16ef1411858 tab
    3⤵
    PID:6788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.67.694402681\742532695" -childID 64 -isForBrowser -prefsHandle 7856 -prefMapHandle 7936 -prefsLen 26882 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {828acfd2-ea42-4457-8a5b-c5ccde333453} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8860 16ef4a3a658 tab
    3⤵
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.68.2116921860\268322032" -childID 65 -isForBrowser -prefsHandle 6116 -prefMapHandle 8088 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d8e8807-2b0d-41e7-bccc-05f377ab38e4} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 10200 16ee7cebd58 tab
    3⤵
    PID:7084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.69.619530992\130501148" -childID 66 -isForBrowser -prefsHandle 6052 -prefMapHandle 7848 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7123a175-eb30-4475-94b4-1e7422a5d092} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7800 16ee8fdc858 tab
    3⤵
    PID:6248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.70.1549377919\1169102643" -childID 67 -isForBrowser -prefsHandle 4620 -prefMapHandle 9880 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb8a051b-cc79-4be3-9e2f-9324ea2227ed} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 4912 16ed3161058 tab
    3⤵
    PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.71.99454493\1045923929" -childID 68 -isForBrowser -prefsHandle 7112 -prefMapHandle 7028 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4138c68-ae83-4071-a9a9-cab200c9baab} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 7528 16eee39f458 tab
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.72.1171574814\201424056" -childID 69 -isForBrowser -prefsHandle 5788 -prefMapHandle 8352 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {baa13b19-bfed-4248-b89e-4d97004e3633} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 8944 16eef2e2f58 tab
    3⤵
    PID:3432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SpaceHub-main\grilliatag.lua
  2⤵
  PID:1148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.0.1594387461\1393325292" -parentBuildID 20221007134813 -prefsHandle 1540 -prefMapHandle 1424 -prefsLen 21431 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a60fc28c-9987-4948-8779-678ef1ef042d} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 1636 1eda12fb958 gpu
    3⤵
    PID:2548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.1.1297615897\1512062152" -parentBuildID 20221007134813 -prefsHandle 1968 -prefMapHandle 1964 -prefsLen 21476 -prefMapSize 233863 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {559eb270-1732-4f6f-92c0-3dcfac87f6d9} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 1980 1ed8f1da158 socket
    3⤵
    PID:7112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.2.1197602064\845740549" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2604 -prefsLen 21937 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79410d1e-c007-469a-b4e4-0ef7b259e884} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 2732 1eda135ce58 tab
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.3.357233148\177821985" -childID 2 -isForBrowser -prefsHandle 2672 -prefMapHandle 2668 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b27cf0e-f3d9-4d1c-a2ca-29d2670c984d} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3024 1ed8f12d858 tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.4.725546006\81690560" -childID 3 -isForBrowser -prefsHandle 2864 -prefMapHandle 2636 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {680275cb-c395-4480-b208-d65c65b9a9ee} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 2308 1eda7003b58 tab
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.5.912678887\1215169625" -childID 4 -isForBrowser -prefsHandle 4576 -prefMapHandle 4572 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6125b21-1274-4d05-92c2-c73db6b7e5b0} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 4628 1ed8f130b58 tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.6.316326103\1685646717" -childID 5 -isForBrowser -prefsHandle 4976 -prefMapHandle 4968 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11d0a59-035f-4767-b557-7caf1c67f15d} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 4988 1eda8edad58 tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.7.1795962695\1734895841" -childID 6 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9402a82-0790-429b-a24a-e851c2895716} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5004 1eda8edb058 tab
    3⤵
    PID:504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.8.1561081069\1405510877" -childID 7 -isForBrowser -prefsHandle 5336 -prefMapHandle 5340 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83f3af9e-b1a9-4818-965b-5e5ac28a3620} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5328 1eda8f86858 tab
    3⤵
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.9.791975334\1508552369" -childID 8 -isForBrowser -prefsHandle 5128 -prefMapHandle 5564 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94c133f9-42ea-4e31-9070-8257ec48e0fb} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5368 1ed8f164d58 tab
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.10.177460033\1688390558" -childID 9 -isForBrowser -prefsHandle 5784 -prefMapHandle 5804 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c259c78-c20b-43d8-a69c-210dd58e25af} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5772 1edaa9ea758 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.11.2073259852\1162674128" -parentBuildID 20221007134813 -prefsHandle 6156 -prefMapHandle 6160 -prefsLen 27115 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80ab557d-f7f7-41d1-8063-dd49b79652af} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 6148 1edaa648858 rdd
    3⤵
    PID:6640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.12.249495089\1942821629" -childID 10 -isForBrowser -prefsHandle 6228 -prefMapHandle 6224 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86fd82c0-2e59-4e62-b6b4-5fe265561398} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 6240 1edaa69cb58 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.13.169901486\91181479" -childID 11 -isForBrowser -prefsHandle 5024 -prefMapHandle 5016 -prefsLen 27115 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec0f0007-d76a-45e9-8cce-1e3c7f91d6bf} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5540 1eda70de258 tab
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.14.731550057\1720517398" -childID 12 -isForBrowser -prefsHandle 5600 -prefMapHandle 4448 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1084e9ce-edca-4052-9dfc-b3aa5e983c65} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5488 1eda9f4aa58 tab
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.15.120502626\1137520286" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9752 -prefMapHandle 5184 -prefsLen 27124 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dcde182-33e7-453b-9cc2-eb3122391592} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9596 1edaa9e9258 utility
    3⤵
    PID:6900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.16.1137982861\1009592311" -childID 13 -isForBrowser -prefsHandle 9472 -prefMapHandle 9476 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69882870-534e-4069-ba3c-5f1d29366caa} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9464 1edaa7cb558 tab
    3⤵
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.17.515607287\1253965057" -childID 14 -isForBrowser -prefsHandle 9312 -prefMapHandle 9288 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb3455ad-323f-41ef-81de-50053c043f5d} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5328 1eda50a1958 tab
    3⤵
    PID:6776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.18.385664643\1151134981" -childID 15 -isForBrowser -prefsHandle 2828 -prefMapHandle 5020 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8efbdb5f-3e6f-49e5-ab00-7e3118c7335f} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9436 1eda7d90358 tab
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.19.776292080\592610446" -childID 16 -isForBrowser -prefsHandle 5168 -prefMapHandle 6392 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0317f9ac-75f4-4076-a970-0e1a430d2e34} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5336 1eda9cab158 tab
    3⤵
    PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.20.633179180\1456254466" -childID 17 -isForBrowser -prefsHandle 9628 -prefMapHandle 9652 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f15c44d-d794-46fa-86ea-455c4ea94a00} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9400 1edaa354458 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.21.8786544\1499125968" -childID 18 -isForBrowser -prefsHandle 9244 -prefMapHandle 9184 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b578060a-2717-46fb-a26a-30f6b87af473} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9116 1eda97d9b58 tab
    3⤵
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.22.1547132281\1151193362" -childID 19 -isForBrowser -prefsHandle 8908 -prefMapHandle 8904 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03fddbde-3717-4712-9f59-bba317b9a2a3} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9104 1edaa946558 tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.23.583543152\1743141430" -childID 20 -isForBrowser -prefsHandle 8788 -prefMapHandle 8784 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a430b9d3-0d97-4f8a-ba77-2432a158a6f1} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8796 1edaa19e558 tab
    3⤵
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.24.1011372403\935857159" -childID 21 -isForBrowser -prefsHandle 5040 -prefMapHandle 5412 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb93776a-0f07-44b2-986e-dbe3d8b79aeb} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5104 1eda50b5358 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.25.39997055\712075800" -childID 22 -isForBrowser -prefsHandle 4776 -prefMapHandle 8760 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e31ab22-0b9c-4ad5-8e71-2b993749348a} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 4412 1eda8f24b58 tab
    3⤵
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.26.1620026725\1569670688" -childID 23 -isForBrowser -prefsHandle 8728 -prefMapHandle 8732 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95b4111d-d8ac-4201-9c1b-0c10966855a4} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3828 1ed8f12e758 tab
    3⤵
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.27.390254182\1819731857" -childID 24 -isForBrowser -prefsHandle 8744 -prefMapHandle 8736 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07c2d4ee-7ded-41d7-a670-7ceb18009aab} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8708 1ed8f160d58 tab
    3⤵
    PID:5336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.28.331554042\618875477" -childID 25 -isForBrowser -prefsHandle 5976 -prefMapHandle 10000 -prefsLen 27124 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c74303d7-0109-4294-95b2-1d71827f1107} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5736 1eda3d73e58 tab
    3⤵
    PID:6936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.29.995259248\1525091191" -childID 26 -isForBrowser -prefsHandle 5776 -prefMapHandle 8968 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {820155d0-285c-47c8-a80b-5d5b4fd165ae} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9052 1eda9b25e58 tab
    3⤵
    PID:2816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.30.649872412\1871335046" -childID 27 -isForBrowser -prefsHandle 8616 -prefMapHandle 8984 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b343c87b-47cb-4b66-bd3a-9769d9c23c51} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9200 1ed8f166558 tab
    3⤵
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.31.779207117\850999473" -childID 28 -isForBrowser -prefsHandle 8776 -prefMapHandle 4136 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cde5119-c16d-4b45-b9f7-46015d1756cf} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8712 1eda50b3258 tab
    3⤵
    PID:6804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.32.1472514710\1902117328" -childID 29 -isForBrowser -prefsHandle 3828 -prefMapHandle 5896 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6417845-3210-403a-bae6-2592870117ad} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5444 1edaa9e9858 tab
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.33.37385142\310639359" -childID 30 -isForBrowser -prefsHandle 6008 -prefMapHandle 5960 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c86ad07c-cad3-4cad-89a0-738c2139c0f0} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5976 1eda9320b58 tab
    3⤵
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.34.831934780\1990608276" -childID 31 -isForBrowser -prefsHandle 6148 -prefMapHandle 5904 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3719f7f8-7f1e-4fd2-be2a-4f4ccbd6f26c} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 2224 1eda9fe3258 tab
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.35.433154611\508905938" -childID 32 -isForBrowser -prefsHandle 9388 -prefMapHandle 5536 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8215c59-19f8-403e-bd18-5b43ad4a3b6a} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3828 1edad8cb558 tab
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.36.83584956\1152259535" -childID 33 -isForBrowser -prefsHandle 8476 -prefMapHandle 8504 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eecf6cb4-a4e3-4aba-b1dd-e97a79fc971e} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 6072 1edacebdb58 tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.37.1414994400\229953877" -childID 34 -isForBrowser -prefsHandle 8272 -prefMapHandle 8468 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e63bebc1-e20e-42ab-bad0-4be3fedde6f2} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 1496 1eda95d8c58 tab
    3⤵
    PID:3964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.38.501097068\1133906137" -childID 35 -isForBrowser -prefsHandle 4520 -prefMapHandle 5768 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {150855ca-b8a1-4e38-b74e-d927b1bbb2f8} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5756 1edab0d2958 tab
    3⤵
    PID:664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.39.1183512138\1826651798" -childID 36 -isForBrowser -prefsHandle 8440 -prefMapHandle 8248 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb46ed82-75b2-4ba0-b715-e3b29ddf6d50} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8244 1eda360ad58 tab
    3⤵
    PID:7084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.40.1806526076\1004029827" -childID 37 -isForBrowser -prefsHandle 6280 -prefMapHandle 6288 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b35137-50b7-4629-a612-20ab384c471a} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5612 1eda97d6258 tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.41.2059820810\717238353" -childID 38 -isForBrowser -prefsHandle 8720 -prefMapHandle 8516 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc1c5dfc-92d5-415f-ba20-f9597f977ff1} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9680 1eda77b4b58 tab
    3⤵
    PID:4820
- - C:\Users\Admin\Downloads\siinst.exe
    "C:\Users\Admin\Downloads\siinst.exe"
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\is-U8EDF.tmp\siinst.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U8EDF.tmp\siinst.tmp" /SL5="$80372,3521793,119296,C:\Users\Admin\Downloads\siinst.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2460
    - - C:\Program Files\Software Informer\softinfo.exe
        
        "C:\Program Files\Software Informer\softinfo.exe" -service
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Checks system information in the registry
        Checks SCSI registry key(s)
        Checks processor information in registry
        
        PID:6216
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /create /sc onlogon /tn SoftwareInformerService /f /rl highest /tr "\"C:\Program Files\Software Informer\softinfo.exe\" -service"
        5⤵
        Creates scheduled task(s)
        
        PID:2240
    - - C:\Program Files\Software Informer\softinfo.exe
        
        "C:\Program Files\Software Informer\softinfo.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2388
- - C:\Users\Admin\Downloads\siinst.exe
    "C:\Users\Admin\Downloads\siinst.exe"
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\is-JCN8F.tmp\siinst.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JCN8F.tmp\siinst.tmp" /SL5="$A033C,3521793,119296,C:\Users\Admin\Downloads\siinst.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1924
    - - C:\Program Files\Software Informer\softinfo.exe
        
        "C:\Program Files\Software Informer\softinfo.exe" -service
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4852
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /create /sc onlogon /tn SoftwareInformerService /f /rl highest /tr "\"C:\Program Files\Software Informer\softinfo.exe\" -service"
        5⤵
        Creates scheduled task(s)
        
        PID:6436
    - - C:\Program Files\Software Informer\softinfo.exe
        
        "C:\Program Files\Software Informer\softinfo.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:96
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.42.1408997810\550058385" -childID 39 -isForBrowser -prefsHandle 5760 -prefMapHandle 8772 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db0acab7-b642-47da-ac0c-cef4cfbe5ff8} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8640 1eda5e1ca58 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.43.593217416\987433937" -childID 40 -isForBrowser -prefsHandle 8136 -prefMapHandle 8144 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79ae1be4-3b67-49f3-9ce6-1661c33d0aab} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8124 1eda9f4cb58 tab
    3⤵
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.44.34553293\606116770" -childID 41 -isForBrowser -prefsHandle 4136 -prefMapHandle 9064 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6f242ed-e2b4-47e1-9450-ce02a6a5e844} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5016 1eda9f4b058 tab
    3⤵
    PID:5928
- - C:\Users\Admin\Downloads\WeMod-Setup.exe
    "C:\Users\Admin\Downloads\WeMod-Setup.exe"
    3⤵
    - Executes dropped EXE
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.45.2123218843\1586361494" -childID 42 -isForBrowser -prefsHandle 4152 -prefMapHandle 8288 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f09808ef-e865-492c-97c5-6d7e9385f646} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8696 1edaa6c8a58 tab
    3⤵
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.46.1934281510\1885927555" -childID 43 -isForBrowser -prefsHandle 8060 -prefMapHandle 5368 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32103a2c-b678-4292-8848-efb7a4122c6d} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9316 1eda50b3258 tab
    3⤵
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.47.334211757\998176215" -childID 44 -isForBrowser -prefsHandle 6028 -prefMapHandle 7828 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a408a20e-cb7d-446f-aedf-86d2a4de9be4} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9684 1eda50b5058 tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.48.1642772547\336374465" -childID 45 -isForBrowser -prefsHandle 7660 -prefMapHandle 5552 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9db9090-f6c9-4c59-a4a5-ba62cb39be40} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3060 1eda50b3b58 tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.49.1143433393\495372944" -childID 46 -isForBrowser -prefsHandle 9340 -prefMapHandle 4168 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7923f517-58fc-4f92-89f5-d24b87606b6c} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8868 1eda97d7758 tab
    3⤵
    PID:6324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.50.2012570889\345978975" -childID 47 -isForBrowser -prefsHandle 3840 -prefMapHandle 8828 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bf2608e-e9cc-40e0-9f3d-266117fc02f1} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8996 1edaa359258 tab
    3⤵
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.51.198763001\2020866998" -childID 48 -isForBrowser -prefsHandle 4172 -prefMapHandle 9280 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {457212be-daea-4224-b16d-faa937861159} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 6132 1ed8f166858 tab
    3⤵
    PID:7124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.52.2139498101\1514101259" -childID 49 -isForBrowser -prefsHandle 5336 -prefMapHandle 9244 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79fd7279-06e2-4c9f-9e08-79fd6a4c3781} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5504 1edaa9e9858 tab
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.53.595184479\773331949" -childID 50 -isForBrowser -prefsHandle 5680 -prefMapHandle 5928 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e41d818d-e8ff-48f6-84f6-660ac2d897aa} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9056 1edaa70e858 tab
    3⤵
    PID:6476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.54.2065761962\1706981316" -childID 51 -isForBrowser -prefsHandle 5736 -prefMapHandle 8144 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d06bc6a3-f5f2-4340-8c22-5575c2c44db9} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 7776 1eda360bc58 tab
    3⤵
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.55.1337496929\1045358069" -childID 52 -isForBrowser -prefsHandle 8112 -prefMapHandle 5028 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b87fa4ae-7663-41e6-ac23-288cb60e6137} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 1536 1eda553aa58 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.56.2003780935\1986011612" -childID 53 -isForBrowser -prefsHandle 3828 -prefMapHandle 9220 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {963751f0-160e-4700-8534-48ce6b53a2d8} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5908 1eda95d8658 tab
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.57.1330606156\820453797" -childID 54 -isForBrowser -prefsHandle 8600 -prefMapHandle 8896 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abea8b74-2cc4-41bf-aa59-d1d0a75f665e} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9316 1eda9f4c858 tab
    3⤵
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.58.1095194985\561346687" -childID 55 -isForBrowser -prefsHandle 9000 -prefMapHandle 8604 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {367c176a-4b20-4ec8-a2c7-1f106fc09461} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 6024 1edacebe158 tab
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.59.1967797677\394119178" -childID 56 -isForBrowser -prefsHandle 520 -prefMapHandle 2556 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f31200e4-1216-4567-ae30-f8e960ee4eb8} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3052 1edace12b58 tab
    3⤵
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.60.1118904200\1580899992" -childID 57 -isForBrowser -prefsHandle 8780 -prefMapHandle 4252 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffaee7d0-ffbe-45f2-b1b7-2e04622ad60b} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 9248 1edace0f858 tab
    3⤵
    PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.61.125715194\1612542290" -childID 58 -isForBrowser -prefsHandle 5060 -prefMapHandle 8448 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3becb363-838f-43f1-b56d-4833e7d11500} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8296 1edace10458 tab
    3⤵
    PID:1112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.62.1665969995\1693992605" -childID 59 -isForBrowser -prefsHandle 5156 -prefMapHandle 9196 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daa7f9f8-9290-42cd-824e-7e95d58e376b} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 5696 1edaa6fd858 tab
    3⤵
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.63.1065874302\1015033199" -childID 60 -isForBrowser -prefsHandle 8780 -prefMapHandle 5800 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {886606f8-4d9a-4cc0-9d50-ccb9b20a781f} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8828 1edaa6fc658 tab
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.64.2093840551\1037051012" -childID 61 -isForBrowser -prefsHandle 5084 -prefMapHandle 8992 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eb31c0b-abb8-48c5-a711-c81bff030357} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 3980 1edaa6fbd58 tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.65.644995427\1263168498" -childID 62 -isForBrowser -prefsHandle 7776 -prefMapHandle 6332 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2ea8bc6-ecf0-43e7-afca-35c4c8e2a2eb} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 2212 1eda7d8e558 tab
    3⤵
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5308.66.35602235\1838060551" -childID 63 -isForBrowser -prefsHandle 5852 -prefMapHandle 5028 -prefsLen 27182 -prefMapSize 233863 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e23b1a28-8544-4507-ac56-6e53387b429a} 5308 "\\.\pipe\gecko-crash-server-pipe.5308" 8324 1eda7d8f158 tab
    3⤵
    PID:4804

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\lua-5.4.6.tar.gz"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\lua-5.4.6(1).tar.gz"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5668
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO426FCB71\manual.css
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7076

C:\Program Files\Software Informer\softinfo.exe
"C:\Program Files\Software Informer\softinfo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
PID:3656

C:\Program Files\Software Informer\softinfo.exe
"C:\Program Files\Software Informer\softinfo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584

C:\Program Files\Software Informer\softinfo.exe
"C:\Program Files\Software Informer\softinfo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7128

C:\Program Files\Software Informer\softinfo.exe
"C:\Program Files\Software Informer\softinfo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480

C:\Users\Admin\Downloads\WeMod-Setup.exe
"C:\Users\Admin\Downloads\WeMod-Setup.exe"
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:5616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5268
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5568

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64(1).msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:2376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery