Analysis
-
max time kernel
1050s -
max time network
1050s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
18-09-2024 06:56
General
-
Target
alterware-launcher.exe
-
Size
2.7MB
-
MD5
4af0f95919968b3532fd5109f1e6fee6
-
SHA1
bdd35631146d1cc10f43374a14dc3d9c80168d37
-
SHA256
743db4f06c2d37ec3a1a5bc9869266638544b9acf24e1403e7776c1dff357284
-
SHA512
c3292412774dbb72132803786e7f30b6b87f976660b34fe78aca2222080acdefde9d44484914bdc889a79ef0e22582b6752b1f170b9067926c4b562dee1d763a
-
SSDEEP
49152:QTnKYBANPY2maIwCnY73C6YV0EoViMYdxHqPljH2mQtvt1w:Dv9jAtV1
Score
10/10
Malware Config
Extracted
Family
crimsonrat
C2
185.136.161.124
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe".
If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.)
rar password: wcry123
Run and follow the instructions!
�
Wallets
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
CrimsonRAT main payload 1 IoCs
-
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 45 IoCs
-
Loads dropped DLL 49 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry 2 TTPs 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 10 IoCs
-
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Modifies data under HKEY_USERS 34 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 10 IoCs
-
NTFS ADS 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 63 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.0.1267671284\1823111117" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd99c2aa-7161-4d54-9ef5-0203802ce741} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1776 2a6587d8458 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.1.1169787363\1860050673" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {620f07d9-0148-45d2-b2d6-2b51db82db6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 2132 2a658331a58 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.2.3801453\1719471495" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2936 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {716fcde3-81c9-4fa7-90e5-ea8f53b321fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3040 2a658759158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.3.1775251606\1732174024" -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f4c05aa-8edb-4842-bc3f-926b970cffdc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3516 2a64d762558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.4.1734189433\144661467" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4655f14e-1dee-41ae-b006-e6925bd928f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3840 2a65dfe4358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.5.772655261\1069716895" -childID 4 -isForBrowser -prefsHandle 4920 -prefMapHandle 4916 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c066793-02a2-4b87-a90b-5aa0059fd45a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4932 2a65efbc858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.6.557133865\1176470708" -childID 5 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9efff52-f0e8-4ed9-949d-5c37175da84c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5064 2a65f3ed258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.7.920169307\2112874374" -childID 6 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c4915a-364d-47a8-9088-1c685ce2a49a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5276 2a65f3ede58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.8.1358294070\1157579184" -childID 7 -isForBrowser -prefsHandle 2272 -prefMapHandle 2660 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b182b49-3b8a-4ad8-9918-1c6a4da67e99} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5456 2a658a55b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.9.1346521284\1461543781" -childID 8 -isForBrowser -prefsHandle 5016 -prefMapHandle 5004 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c72758a5-6a73-439c-b53a-7b17af7e22a9} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5028 2a661c51958 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.10.1725905689\1780544138" -childID 9 -isForBrowser -prefsHandle 5904 -prefMapHandle 6072 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b74bfa10-7319-4eaa-8dad-95517d2cc15b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5864 2a660b82858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.11.1743739469\1698006757" -childID 10 -isForBrowser -prefsHandle 5816 -prefMapHandle 5808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d15bfbf-088b-4e80-a2b5-03783afce109} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5416 2a65dfe4658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.12.1207111419\814360943" -childID 11 -isForBrowser -prefsHandle 5352 -prefMapHandle 5480 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bbfef58-ae2f-49df-9940-2e3875526844} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5528 2a662c4ce58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.13.1895520298\881121082" -childID 12 -isForBrowser -prefsHandle 9904 -prefMapHandle 4460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24355836-0f5b-4630-af81-da455ba6049a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4576 2a65ef1b158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.14.1661194221\1637747925" -childID 13 -isForBrowser -prefsHandle 5704 -prefMapHandle 5460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fcaa253-53c5-402d-badc-3dcf5bcfe55a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5688 2a658a55e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.15.1840769970\1736322571" -parentBuildID 20221007134813 -prefsHandle 1448 -prefMapHandle 5432 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2912c9a-4eaa-4b8d-b7c1-3598df6d6aff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4692 2a66376cb58 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.16.589615036\2106031476" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5384 -prefMapHandle 5372 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6fde613-d4db-429f-803e-c574eb2d65a5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5396 2a663d98358 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.17.1809026445\74364837" -childID 14 -isForBrowser -prefsHandle 5244 -prefMapHandle 4688 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2176320-25d0-4169-a0d3-04dec022470a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1448 2a65b166058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.18.1389921718\290118821" -childID 15 -isForBrowser -prefsHandle 9240 -prefMapHandle 9244 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf0efc3-2a34-48d2-b7a8-819cffaa4e93} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661255158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.19.1069021686\274808377" -childID 16 -isForBrowser -prefsHandle 6356 -prefMapHandle 10116 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70439923-e539-4a7d-aa93-fb793e6565a4} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4460 2a6645e7358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.20.1403906855\2093882964" -childID 17 -isForBrowser -prefsHandle 9824 -prefMapHandle 9916 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a5b5297-fc1a-47bb-9e47-cc69b83b2397} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9632 2a6612b7158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.21.1480060550\1005371452" -childID 18 -isForBrowser -prefsHandle 9428 -prefMapHandle 5652 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d459706-81b8-4f29-8f8f-f0eb8fd7cd0b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9468 2a665066558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.22.1877237901\1174862409" -childID 19 -isForBrowser -prefsHandle 5532 -prefMapHandle 4960 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a3eef98-5c1d-4aa3-8826-c24763c8f107} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10012 2a665066b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.23.116437921\225715968" -childID 20 -isForBrowser -prefsHandle 8828 -prefMapHandle 8824 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecf8f576-7953-42aa-9ed1-ead3e80e1ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8740 2a665067d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.24.1512054813\1847828640" -childID 21 -isForBrowser -prefsHandle 10084 -prefMapHandle 10156 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d81b3ae-3407-4539-941f-074237fc8dcf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10108 2a6641a5558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.25.596096088\211042372" -childID 22 -isForBrowser -prefsHandle 5032 -prefMapHandle 9088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {823afe6c-9e16-4b71-b080-8967552aa4f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9244 2a665b82558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.26.1837840257\726243811" -childID 23 -isForBrowser -prefsHandle 8408 -prefMapHandle 8404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab028043-c380-438f-937b-8efc015563f1} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8416 2a665b84058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.27.592645779\835789488" -childID 24 -isForBrowser -prefsHandle 8212 -prefMapHandle 8208 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c000810-f8a8-4e04-9bca-eea710ff0ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8224 2a665b82b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.28.829295389\1198901972" -childID 25 -isForBrowser -prefsHandle 8492 -prefMapHandle 8848 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c14278fc-867d-465d-b168-862baac50e6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8508 2a666288558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.29.1487319126\1800581706" -childID 26 -isForBrowser -prefsHandle 9380 -prefMapHandle 9588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9283e92d-a98a-4662-bde1-4216be5f329b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4300 2a6650bbb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.30.921745295\946609326" -childID 27 -isForBrowser -prefsHandle 8588 -prefMapHandle 8528 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cfac111-78a1-4757-938a-ef158b98d43f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8796 2a662b87858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.31.180833687\253147647" -childID 28 -isForBrowser -prefsHandle 8052 -prefMapHandle 9808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5b46ad-30a1-457a-9c3c-1c7abb977f55} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7900 2a662b8a558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.32.1009495250\438964623" -childID 29 -isForBrowser -prefsHandle 7984 -prefMapHandle 7988 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f822bdf0-0909-4863-b2af-3fee4271ab73} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8584 2a662dd4258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.33.2036490974\1695826256" -childID 30 -isForBrowser -prefsHandle 9124 -prefMapHandle 7968 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {972f8608-5bdf-4dd7-88ae-f6b9791520ff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8972 2a65f3ef658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.34.337926043\225051119" -childID 31 -isForBrowser -prefsHandle 6152 -prefMapHandle 9064 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0223dea4-d2ed-43cd-b060-67162cf1dbc6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661137558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.35.1212494327\1254117856" -childID 32 -isForBrowser -prefsHandle 8448 -prefMapHandle 7880 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8a67f39-5993-4310-92fc-721123665bfc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7712 2a658a55b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.36.340915966\1705405833" -childID 33 -isForBrowser -prefsHandle 7596 -prefMapHandle 7600 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec79109b-4d33-453d-bef0-387790377f6c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4928 2a658a5fd58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.37.1845489907\2010022783" -childID 34 -isForBrowser -prefsHandle 7424 -prefMapHandle 7428 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e7754ee-9f77-43ab-8b30-d54aae941cc3} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7372 2a661135a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.38.1183218298\1872634629" -childID 35 -isForBrowser -prefsHandle 7428 -prefMapHandle 7228 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26a346b5-90ac-4b8b-a85d-6bdf83e619aa} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7212 2a661ea1b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.39.1966258158\1483032214" -childID 36 -isForBrowser -prefsHandle 7456 -prefMapHandle 7484 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde591f9-9e3e-4efb-8075-631de6b84748} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7148 2a661ea3f58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.40.887713148\14076364" -childID 37 -isForBrowser -prefsHandle 7036 -prefMapHandle 7280 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {082ba880-20e5-4e2a-b62e-b789c1857e44} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6300 2a661ea3658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.41.1418488241\356406825" -childID 38 -isForBrowser -prefsHandle 7132 -prefMapHandle 7148 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9062af4d-7022-4180-af11-1b5d441ce650} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7016 2a661ea4e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.42.1010518286\2046648963" -childID 39 -isForBrowser -prefsHandle 9016 -prefMapHandle 9036 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c17369-60ea-4ed8-874d-d4bee027305c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10044 2a661134258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.43.1718932381\1659397115" -childID 40 -isForBrowser -prefsHandle 7024 -prefMapHandle 9632 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4005dec-98d6-4c01-ac2f-c167badb1f2a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4336 2a661fe3758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.44.700547237\1811610808" -childID 41 -isForBrowser -prefsHandle 9464 -prefMapHandle 9168 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b93205-86ec-4ba6-a5d9-c0ac14f7312f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4464 2a66210be58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.45.119935072\1923932786" -childID 42 -isForBrowser -prefsHandle 5776 -prefMapHandle 5780 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e63ede-853a-4271-9152-083c883cadcc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6924 2a66210ee58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.46.63832016\1521595712" -childID 43 -isForBrowser -prefsHandle 8112 -prefMapHandle 8088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cdf1b6f-a952-4330-9793-ee805419800e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7028 2a66210c458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.47.1578425455\1523440712" -childID 44 -isForBrowser -prefsHandle 7952 -prefMapHandle 5896 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e312838-ff69-4bce-8a60-676cde5add9b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8100 2a65c979658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.48.322449415\10664982" -childID 45 -isForBrowser -prefsHandle 5468 -prefMapHandle 9128 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f77b188-6287-49f6-9673-769742f4685e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7768 2a65c979c58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.49.415443667\1105092303" -childID 46 -isForBrowser -prefsHandle 8112 -prefMapHandle 7748 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da864b61-3c94-498d-ac4e-0430673f31a7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6880 2a65d71eb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.50.1145720364\1350694353" -childID 47 -isForBrowser -prefsHandle 8032 -prefMapHandle 8580 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7b2f00b-2f72-497b-b7d4-982ce1e83d96} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8188 2a663a4ba58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.51.1210471403\1390582392" -childID 48 -isForBrowser -prefsHandle 5896 -prefMapHandle 7952 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e274d02f-f4a0-42eb-9dff-3468c95ba265} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7804 2a663a4d858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.52.657155230\1917237364" -childID 49 -isForBrowser -prefsHandle 8432 -prefMapHandle 5864 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7b75018-d76c-4abd-a2b0-7960066e51fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5644 2a663e94e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.53.852274923\930609621" -childID 50 -isForBrowser -prefsHandle 8528 -prefMapHandle 5644 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc583d62-cd1e-4bfe-89c5-eb846751d90a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8424 2a66403b158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.54.1106453375\1209406326" -childID 51 -isForBrowser -prefsHandle 5532 -prefMapHandle 7264 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1beea77-c2ac-4c4b-9b5c-50b9f68e64fe} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5436 2a6640bde58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.55.1206639682\1690563381" -childID 52 -isForBrowser -prefsHandle 9916 -prefMapHandle 9536 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9aa5514-6a9d-4ec5-ad15-bdc7176547b5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8404 2a65b178a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.56.291904047\748555281" -childID 53 -isForBrowser -prefsHandle 6408 -prefMapHandle 6404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66d9236c-ff04-4e9c-8a84-6b0eb25b3f40} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6420 2a663ca0758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.57.771296403\100132169" -childID 54 -isForBrowser -prefsHandle 6600 -prefMapHandle 6592 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04385b65-bd9b-476d-9569-29c31dbd2acf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a66491b858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.58.251256087\338412576" -childID 55 -isForBrowser -prefsHandle 8412 -prefMapHandle 6588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb17006b-7c7e-494e-991a-325e038859d7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a664a50e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.59.367453286\1350232082" -childID 56 -isForBrowser -prefsHandle 9228 -prefMapHandle 5364 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af56a99-2242-4a30-957c-f7ca4012ed9a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8196 2a664a50558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.60.1628073918\186263094" -childID 57 -isForBrowser -prefsHandle 10372 -prefMapHandle 10368 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08c1867a-3107-4904-b2d7-7d740c80e602} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10332 2a658a33558 tab3⤵
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\aj5A64.exe"C:\Users\Admin\AppData\Local\Temp\aj5A64.exe" /relaunch=8 /was_elevated=1 /tagdata4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsl5B4D.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0ZBQkE2QkRGLTUzNUEtNEI4OS1BQjkzLTY1NDQwNEQ0OThEM30iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins1MUVBOEQwMC0wNDY3LTRGQjItQjFCQi0zRkRFQzI0NkRCMTd9IiB1c2VyaWRfZGF0ZT0iMjAyNDA5MTgiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDkxOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntENjlGQzQwRC1BREUyLTQ3OUUtQTRBMy02Qzg4Q0U4MURBQTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNDIxIi8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{FABA6BDF-535A-4B89-AB93-654404D498D3}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff69aaebfc0,0x7ff69aaebfcc,0x7ff69aaebfd86⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.61.1940652448\166545101" -childID 58 -isForBrowser -prefsHandle 6384 -prefMapHandle 10948 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9c1d135-798e-4aad-8279-c21dba086edb} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9040 2a661fe4c58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.62.2083818536\981442065" -childID 59 -isForBrowser -prefsHandle 5300 -prefMapHandle 5156 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce130893-17b0-46ad-8783-1304545a96f6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5116 2a660b82e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.63.809849872\775777518" -childID 60 -isForBrowser -prefsHandle 5204 -prefMapHandle 11204 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b035273e-f89e-46f9-bda7-611199a73008} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5228 2a662264858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.0.925240826\1867829622" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1620 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {828be36c-a1f4-4a49-973e-4dbb9e4cfd0f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1724 24ef30f6b58 gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.1.1835994436\830726714" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1888 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e047e6a-b74c-49e7-b6dc-a6ad5177589b} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1916 24ef2f3a058 socket5⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.2.405471480\1993952449" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 23698 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff7fc401-c249-4628-b493-63f370b4c57d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3168 24ef8029358 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.3.1677851904\1540161136" -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3852 -prefsLen 23805 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edc2f267-e2f1-40df-80ad-71f81ccca9b1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3916 24ef87a8558 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.4.1206410041\1263801892" -childID 3 -isForBrowser -prefsHandle 3696 -prefMapHandle 3768 -prefsLen 24887 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bad0c58-224e-4880-a2b5-a646145f3778} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3712 24ef8eb0858 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.5.786578772\2107368128" -parentBuildID 20221007134813 -prefsHandle 4224 -prefMapHandle 4240 -prefsLen 30501 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10e5634a-779d-4447-80ce-4b01cf33bbdd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4304 24efa978258 rdd5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.6.682251912\1532786877" -childID 4 -isForBrowser -prefsHandle 4300 -prefMapHandle 4436 -prefsLen 31920 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0973f103-ce6b-41b8-94a4-9d1647758bcd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3904 24efb721e58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.7.1593891756\1460833457" -childID 5 -isForBrowser -prefsHandle 4860 -prefMapHandle 2888 -prefsLen 32092 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e5f367-8fc9-4f89-ae0a-fc7ec8db136f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4840 24ef48cdd58 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.8.465074148\197669459" -childID 6 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 32016 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf98c1e-4758-492d-926a-6fac9e26bb9d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4892 24ef4a0c758 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.9.988668513\404865402" -childID 7 -isForBrowser -prefsHandle 5636 -prefMapHandle 5712 -prefsLen 32442 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ae27b6f-2220-4865-af05-4d05477cb071} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 5072 24ef4603558 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.10.16605903\1580975062" -childID 8 -isForBrowser -prefsHandle 6096 -prefMapHandle 6076 -prefsLen 32755 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a892447-96bf-4f5a-a1cd-750942a58be2} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6032 24efb0da658 tab5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.11.150578193\578154528" -childID 9 -isForBrowser -prefsHandle 6600 -prefMapHandle 6580 -prefsLen 32804 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c51c0be-ca42-4078-b827-842e2a5d5bb1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6604 24efb0da058 tab5⤵
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff62318bfc0,0x7ff62318bfcc,0x7ff62318bfd84⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PushFind.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"1⤵
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 146581726643294.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 13301726643300.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage