67166c6d1cb0c9bef65d6e2634f3d948588ae4323dce3a1b5c36db213807dc1b

Resubmissions

29/06/2026, 04:35

260629-e7qqrac1915

29/06/2026, 04:28

260629-e35zwaet2m5

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
110s
max time network
100s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VencordInstaller.exe
Size 17.0MB
Sample260629-e35zwaet2m
SHA256 67166c6d1cb0c9bef65d6e2634f3d948588ae4323dce3a1b5c36db213807dc1b
MD5 997ffe0b0fffdb45fe4088f1169ac094
SHA1 b480d29707b8ea4078e8babe3826ac4f4e711013
SHA512 2b069dae9145756664c9359af91cd91d275abaf5d712c7e67316bd23f53c04c492ca78c443963de3c4d8a477c221b16d432209a745744c8a5c3d91bb189c1361
SSDEEP 393216:+cK1bh7U+7+9/VsxbhAzkrspMxZEptHLP4BkaMC0DQT:+zVoJG/AzkrsdzLP4BkjjD
TLSH
T1890723D32EE5F0A4D0C34E2866CF579D10D2F6CAD9AA191E39C75802A570FA3CB495B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2632	VencordInstaller.exe
2632	VencordInstaller.exe
8836	VencordInstaller.exe
8836	VencordInstaller.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe
2632	VencordInstaller.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	firefox.exe
Token: SeDebugPrivilege	1832	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe
1832	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1832	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1832	2828	firefox.exe	98
PID 2828 wrote to memory of 1832	2828	firefox.exe	98
PID 1832 wrote to memory of 4148	1832	firefox.exe	99
PID 1832 wrote to memory of 4148	1832	firefox.exe	99
PID 1832 wrote to memory of 4148	1832	firefox.exe	99
PID 1832 wrote to memory of 4216	1832	firefox.exe	100
PID 1832 wrote to memory of 4216	1832	firefox.exe	100
PID 1832 wrote to memory of 4216	1832	firefox.exe	100
PID 1832 wrote to memory of 4216	1832	firefox.exe	100
PID 1832 wrote to memory of 796	1832	firefox.exe	101
PID 1832 wrote to memory of 796	1832	firefox.exe	101
PID 1832 wrote to memory of 796	1832	firefox.exe	101
PID 1832 wrote to memory of 796	1832	firefox.exe	101
PID 1832 wrote to memory of 4448	1832	firefox.exe	102
PID 1832 wrote to memory of 4448	1832	firefox.exe	102
PID 1832 wrote to memory of 4448	1832	firefox.exe	102
PID 1832 wrote to memory of 1756	1832	firefox.exe	103
PID 1832 wrote to memory of 1756	1832	firefox.exe	103
PID 1832 wrote to memory of 1756	1832	firefox.exe	103
PID 1832 wrote to memory of 1756	1832	firefox.exe	103
PID 1832 wrote to memory of 5752	1832	firefox.exe	104
PID 1832 wrote to memory of 5752	1832	firefox.exe	104
PID 1832 wrote to memory of 5752	1832	firefox.exe	104
PID 1832 wrote to memory of 5752	1832	firefox.exe	104
PID 1832 wrote to memory of 5872	1832	firefox.exe	105
PID 1832 wrote to memory of 5872	1832	firefox.exe	105
PID 1832 wrote to memory of 5872	1832	firefox.exe	105
PID 1832 wrote to memory of 5872	1832	firefox.exe	105
PID 1832 wrote to memory of 5880	1832	firefox.exe	106
PID 1832 wrote to memory of 5880	1832	firefox.exe	106
PID 1832 wrote to memory of 5880	1832	firefox.exe	106
PID 1832 wrote to memory of 5880	1832	firefox.exe	106
PID 1832 wrote to memory of 5924	1832	firefox.exe	107
PID 1832 wrote to memory of 5924	1832	firefox.exe	107
PID 1832 wrote to memory of 5924	1832	firefox.exe	107
PID 1832 wrote to memory of 5924	1832	firefox.exe	107
PID 1832 wrote to memory of 1120	1832	firefox.exe	108
PID 1832 wrote to memory of 1120	1832	firefox.exe	108
PID 1832 wrote to memory of 1120	1832	firefox.exe	108
PID 1832 wrote to memory of 1120	1832	firefox.exe	108
PID 1832 wrote to memory of 2252	1832	firefox.exe	109
PID 1832 wrote to memory of 2252	1832	firefox.exe	109
PID 1832 wrote to memory of 2252	1832	firefox.exe	109
PID 1832 wrote to memory of 2252	1832	firefox.exe	109
PID 1832 wrote to memory of 2536	1832	firefox.exe	110
PID 1832 wrote to memory of 2536	1832	firefox.exe	110
PID 1832 wrote to memory of 2536	1832	firefox.exe	110
PID 1832 wrote to memory of 2536	1832	firefox.exe	110
PID 1832 wrote to memory of 4696	1832	firefox.exe	111
PID 1832 wrote to memory of 4696	1832	firefox.exe	111
PID 1832 wrote to memory of 4696	1832	firefox.exe	111
PID 1832 wrote to memory of 4696	1832	firefox.exe	111
PID 1832 wrote to memory of 4392	1832	firefox.exe	112
PID 1832 wrote to memory of 4392	1832	firefox.exe	112
PID 1832 wrote to memory of 4392	1832	firefox.exe	112
PID 1832 wrote to memory of 4392	1832	firefox.exe	112
PID 1832 wrote to memory of 3364	1832	firefox.exe	113
PID 1832 wrote to memory of 3364	1832	firefox.exe	113
PID 1832 wrote to memory of 3364	1832	firefox.exe	113
PID 1832 wrote to memory of 3364	1832	firefox.exe	113
PID 1832 wrote to memory of 2540	1832	firefox.exe	114
PID 1832 wrote to memory of 2540	1832	firefox.exe	114
PID 1832 wrote to memory of 2540	1832	firefox.exe	114
PID 1832 wrote to memory of 2540	1832	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27100 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {cbd25c46-7499-479c-a4a2-205bf829bc42} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {1512f6b3-13e3-4ff3-af49-832d52423309} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3048 -prefsLen 27277 -prefMapHandle 3052 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2964 -initialChannelId {17181629-d078-42cd-95ca-c20595023010} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27277 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {5a000fa2-7c5d-487e-b2f9-f83250dfb2db} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34776 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4396 -initialChannelId {b58704ad-1cb4-434b-bf52-1987df716fdf} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 35013 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {f66126c8-4c52-408d-96e8-f83c6799b2db} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 32900 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {2bfd1321-400f-4a53-8fe5-4114a3deb17f} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32900 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {fc9f4d07-c6be-4110-8580-f297ff9b2509} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32900 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {f4714ec2-f317-4295-9dbf-83040edf11c1} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32952 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 2668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {9e86bee8-8197-4f88-8536-7e468d09ce80} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 32952 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {91e37729-2089-4cab-a748-497da8994b6c} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864 -prefsLen 32952 -prefMapHandle 5868 -prefMapSize 270279 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {47dc6b27-c40a-41e4-a506-99d01f174435} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6004 -prefsLen 32952 -prefMapHandle 6008 -prefMapSize 270279 -jsInitHandle 6012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {58ecb3f4-2e3c-46b2-a543-77bb5c36a52c} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2588 -prefsLen 32952 -prefMapHandle 4872 -prefMapSize 270279 -jsInitHandle 4648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {6090c930-b34b-4abc-b482-f527c75995f5} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4564 -prefsLen 32952 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4548 -initialChannelId {0862ea48-e431-41a2-9eed-8486c9debd77} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6156 -prefsLen 32952 -prefMapHandle 6160 -prefMapSize 270279 -jsInitHandle 6164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6172 -initialChannelId {b192d8af-9cea-4783-93ed-876a757266b4} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6344 -prefsLen 32952 -prefMapHandle 6348 -prefMapSize 270279 -jsInitHandle 6352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6360 -initialChannelId {b2c963ec-084d-42d8-88f8-6b5223d6db9c} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6532 -prefsLen 32952 -prefMapHandle 6536 -prefMapSize 270279 -jsInitHandle 6540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6548 -initialChannelId {5081029f-7d0b-458e-bd81-cec8275c4e8d} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6720 -prefsLen 32952 -prefMapHandle 6724 -prefMapSize 270279 -jsInitHandle 6728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6736 -initialChannelId {9f5b6e06-7c55-4e71-80d5-4d46bbd5463d} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6896 -prefsLen 32952 -prefMapHandle 6900 -prefMapSize 270279 -jsInitHandle 6904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4608 -initialChannelId {5402a93e-a8a7-42ec-be9d-eba342c40893} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7076 -prefsLen 32952 -prefMapHandle 7080 -prefMapSize 270279 -jsInitHandle 7084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7092 -initialChannelId {a93a3c23-4b5f-4cac-bd7e-6504b2f9b0b4} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7268 -prefsLen 32952 -prefMapHandle 7272 -prefMapSize 270279 -jsInitHandle 7276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7284 -initialChannelId {a6204530-3da9-4ed8-8fbc-e63c614b4ab4} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7496 -prefsLen 32952 -prefMapHandle 7500 -prefMapSize 270279 -jsInitHandle 7504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7512 -initialChannelId {4210622f-36c7-4b89-9f83-c07a612d1bf2} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7704 -prefsLen 32952 -prefMapHandle 7708 -prefMapSize 270279 -jsInitHandle 7712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7720 -initialChannelId {745f6659-9df3-4f7b-9a90-810b6132cb99} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7892 -prefsLen 32952 -prefMapHandle 7896 -prefMapSize 270279 -jsInitHandle 7900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7908 -initialChannelId {2541de12-be90-4ae4-a44f-dd9f93164eda} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7916 -prefsLen 32952 -prefMapHandle 8124 -prefMapSize 270279 -jsInitHandle 8128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8136 -initialChannelId {626b2447-f590-42e2-98a0-0514e27db259} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:1236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8332 -prefsLen 32952 -prefMapHandle 8336 -prefMapSize 270279 -jsInitHandle 8340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8348 -initialChannelId {070ee630-0a29-4ef6-972b-12c008ecd73a} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8520 -prefsLen 32952 -prefMapHandle 8524 -prefMapSize 270279 -jsInitHandle 8528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8536 -initialChannelId {5c30eebc-356d-47eb-adb6-6377a067e939} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8732 -prefsLen 32952 -prefMapHandle 8736 -prefMapSize 270279 -jsInitHandle 8740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8744 -initialChannelId {46e0dfd2-3dc8-451f-b521-4204d576f586} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8916 -prefsLen 32952 -prefMapHandle 8920 -prefMapSize 270279 -jsInitHandle 8924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8932 -initialChannelId {df142da7-8b72-440b-9985-6f349087fd89} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9148 -prefsLen 32952 -prefMapHandle 9152 -prefMapSize 270279 -jsInitHandle 9156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9164 -initialChannelId {02ac3477-d09c-4eed-a4d0-2133158c7e33} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9344 -prefsLen 32952 -prefMapHandle 9348 -prefMapSize 270279 -jsInitHandle 9352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9356 -initialChannelId {341ac57f-b0d8-4670-8499-11642a5c5df6} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9572 -prefsLen 32952 -prefMapHandle 9576 -prefMapSize 270279 -jsInitHandle 9580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9584 -initialChannelId {f72b0300-87f4-4339-b894-09d878bee901} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9784 -prefsLen 32952 -prefMapHandle 9788 -prefMapSize 270279 -jsInitHandle 9792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9704 -initialChannelId {4d0ef602-f145-49ea-add1-180cbf5b91c3} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9964 -prefsLen 32952 -prefMapHandle 9968 -prefMapSize 270279 -jsInitHandle 9972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9980 -initialChannelId {3cb4912b-0ea4-4970-9d09-170b459998cd} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10152 -prefsLen 32952 -prefMapHandle 10156 -prefMapSize 270279 -jsInitHandle 10160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10168 -initialChannelId {280e7e1f-57c2-496a-be78-e204b5ef4c1a} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10308 -prefsLen 32952 -prefMapHandle 10312 -prefMapSize 270279 -jsInitHandle 10316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10148 -initialChannelId {33d359d3-2239-4a4a-93d4-3d6c8cd11b6e} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10416 -prefsLen 32952 -prefMapHandle 10420 -prefMapSize 270279 -jsInitHandle 10424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10304 -initialChannelId {f07e0545-f752-4c27-9cfe-f0f5204ee6ab} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10548 -prefsLen 32952 -prefMapHandle 10552 -prefMapSize 270279 -jsInitHandle 10556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10564 -initialChannelId {e0e4e02a-30c4-4137-bd40-4a13e6fdaef9} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    - Checks processor information in registry
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10740 -prefsLen 32952 -prefMapHandle 10744 -prefMapSize 270279 -jsInitHandle 10748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10752 -initialChannelId {04c98c67-1ee1-4f9c-a482-2c28d7c6ebd3} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10944 -prefsLen 32952 -prefMapHandle 10948 -prefMapSize 270279 -jsInitHandle 10952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10960 -initialChannelId {dfd54e03-f610-4693-9255-cfa731624196} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    - Checks processor information in registry
    PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11004 -prefsLen 32952 -prefMapHandle 11008 -prefMapSize 270279 -jsInitHandle 11012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {80048eff-2ee2-4594-990a-8c268f0819d1} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    - Checks processor information in registry
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11192 -prefsLen 32952 -prefMapHandle 11196 -prefMapSize 270279 -jsInitHandle 11200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11208 -initialChannelId {8d12dea0-2ede-4d9a-8ec7-0cec5bcd589c} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    - Checks processor information in registry
    PID:5196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11384 -prefsLen 32952 -prefMapHandle 11388 -prefMapSize 270279 -jsInitHandle 11392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11400 -initialChannelId {9d0aae47-5175-4d92-b46e-aa00cb456363} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11528 -prefsLen 32952 -prefMapHandle 11532 -prefMapSize 270279 -jsInitHandle 11536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11544 -initialChannelId {35d47426-d743-4772-bdc4-755a07d528b2} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
    3⤵
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11656 -prefsLen 32952 -prefMapHandle 11660 -prefMapSize 270279 -jsInitHandle 11664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11672 -initialChannelId {c902b12a-10f4-4f3e-bc9b-26472bffd6d4} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7876 -prefsLen 32952 -prefMapHandle 7712 -prefMapSize 270279 -jsInitHandle 7708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8304 -initialChannelId {ce2100bb-0990-46bd-af6f-a43d4e415cbf} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11972 -prefsLen 32952 -prefMapHandle 11976 -prefMapSize 270279 -jsInitHandle 11980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7080 -initialChannelId {da39fb82-d097-44b3-a634-065aef14d953} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 32952 -prefMapHandle 6680 -prefMapSize 270279 -jsInitHandle 6676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8484 -initialChannelId {fa272db2-e720-482b-8af5-9068416a974f} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6532 -prefsLen 32952 -prefMapHandle 11632 -prefMapSize 270279 -jsInitHandle 8364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8332 -initialChannelId {acf6d300-cac2-494a-b248-0f0b616e27fb} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
    3⤵
    - Checks processor information in registry
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12092 -prefsLen 32952 -prefMapHandle 12096 -prefMapSize 270279 -jsInitHandle 12100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9544 -initialChannelId {141fe5cf-7593-4ed8-bf23-27d8a0de7f73} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
    3⤵
    - Checks processor information in registry
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9932 -prefsLen 32952 -prefMapHandle 9928 -prefMapSize 270279 -jsInitHandle 9924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12116 -initialChannelId {7a989ee5-6280-40d0-8038-9802d461a2e6} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12192 -prefsLen 32952 -prefMapHandle 12196 -prefMapSize 270279 -jsInitHandle 12200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12208 -initialChannelId {a286ac25-aac1-4e82-8bb8-0879f533a027} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab
    3⤵
    - Checks processor information in registry
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12384 -prefsLen 32952 -prefMapHandle 12388 -prefMapSize 270279 -jsInitHandle 12392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12400 -initialChannelId {64f84c43-fb13-4b06-8667-ce4e4c88d196} -parentPid 1832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab
    3⤵
    - Checks processor information in registry
    PID:5540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8728

C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordInstaller.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 f273e70c1928ee506ab77d0edc87e775ca2ec0b171a1f1abaa122cd14319e102
MD5 4dc4521502a283409e328e190274e141
SHA1 d94406a443be62e38ad9af35daeb6657251455a1
SHA512 fead38f44168bad1f593eed3945af944d57bb5eccad9c2622f2eb379a24df3e0680a8e3ee93147cfbd9aacb3e33979e4aee2288d6f4a788fa762fc0a77e68718
SSDEEP 768:CnnZQUGcmhuiERDxS0LlbiIbObulbr/P/:cnTaoP
TLSH
T148C2FF44EB2A953FD41912BEDCA14B002F78F88959192FA73A4C646C6C872DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 8f6c79ef839013f1fa80027eb05c982f1844b7a2c97ba27addc0572b083fbed8
MD5 4d562f8866f60b7a83c9d40347304808
SHA1 443d7e7438953e0e0809ef5e25c5244a1f0bf6a7
SHA512 4664ee1d9d89b7bbd286b11aa8387a071e3aadfe6537edbda8f1f1a6a7dde1106320ed818b77c19958561dcc0aca0b42983dd8684421f8a2f98bedb2a24b8c5b
SSDEEP 768:nPsb6nZQUGcmhuiERDxS0LlbiIbObulbr:RnTao
TLSH
T131C2F244EB2E953FD41812BBDCA54B002F79B88A59092F673A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b1bb648-3cc3-4868-971d-9f957ff4c020

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\2b1bb648-3cc3-4868-971d-9f957ff4c020
Size 235B
SHA256 07b2a8982ee9f70a22d35f1e450f0d6bdad057adbb59037e8c6227aa38d49845
MD5 fb994d39b026ddc6ed9b0affa37c079c
SHA1 85b4af97355d20707dede6b2811de2abd0d9bfc9
SHA512 3beea5557489e9031b5a4c16464b057fedb803e9097222a48878d634a68cbcfb1b9a49ee50e25c0bba38e8e8bdff334223b5ee7f8ba56da9595f29ff63516e3b
TLSH
T171D0978814BC2B9DAC000F0BB0A068C630588C332466D810E5B1457889BEED48262C0A
MD5 SHA1 SHA512 TLSH

Submit Download

334ee70d-1061-4d0e-9c4d-71d9819d6264

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\334ee70d-1061-4d0e-9c4d-71d9819d6264
Size 871B
SHA256 d1cf490107684f8edd4788418bf0614f3045e8ffe13bfcfd3b5e17cc8ec41da3
MD5 77b434e11f4d117f25966ac9026fd1b3
SHA1 b16ab1d25a0c132fdf684cedbaf388183f7977f0
SHA512 2ef3ed99d86bc02d76915d940e4a47b4681dfb002940fc73f32c694183877feb3b92f8de4558b1cf46b7db8f8b6ab092c65de27463a8bd2c2494fcebd0c89b22
TLSH
T12B11E3819534BDF2CCA8834B8D5537425BE4752380CB941C3EA15E180DBAB5DA76625B
MD5 SHA1 SHA512 TLSH

Submit Download

5d7f1546-3c9f-412f-a866-a3905b763df1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\5d7f1546-3c9f-412f-a866-a3905b763df1
Size 886B
SHA256 9838cbe8d47c81d410154ac3d6865eb033cc05424418613a83c3830aa5a632d6
MD5 dee2878ebd711f8c3f3dc27af8368f51
SHA1 71396d6294e53fda91367c47acb1d8469d6bb122
SHA512 c8fb5b6717d4b65de2e61f3239bfdf86ac5d7d17406dd74998a2f40858bcce95eeb494cf12d764dc82556bd8e34b7772bab81412905e786daa7972322639c3a7
TLSH
T1AD1104C19574BAF2CCA8934B98A43B824AD4F52380CB8D183D615A180DEA55E935B217
MD5 SHA1 SHA512 TLSH

Submit Download

c1828913-f984-4f5e-b17e-ee8975667408

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\c1828913-f984-4f5e-b17e-ee8975667408
Size 2KB
SHA256 afe14572534eeb972f00ab5b26b502d460153dc82199dd2b7110301a391677fa
MD5 fdd56d63dc53cd7f442725e210154533
SHA1 6cd4909eb8cd254cddb86f5e0b19ec20b70d51d7
SHA512 b240e7028f248ec55956a9d8f12551b799864e4515937f3f8023e59c72c4ad6621ee3613c264da5bf7592463b1af837a48c99577d39027656b1f5e7bfc844d30
TLSH
T10241439876785DF69C9AF18DD481238E57B08A0300C668932E61DE0C8CD6699336B17F
MD5 SHA1 SHA512 TLSH

Submit Download

e6ea0d81-ae85-4b5f-ba3b-f8027103888f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\e6ea0d81-ae85-4b5f-ba3b-f8027103888f
Size 235B
SHA256 0f4cc882222c52aee04d1a2ada4563559cb1b9cf8441f0eef580f8f67be7d253
MD5 658d449899326b816be0f9d21de90aad
SHA1 605821b80079ea769c31795f32d959fb69decb2f
SHA512 18b899748261b9c0813bc16319813d7323c31dd4283131329fc5e28ffbb2bdfdc19746e689d0d0263b90401c41ed6714ffed38fc18d18c4d25698b012ea70825
TLSH
T177D0978418DC771C48100F06F0E0A9D23084CC372068A820E9904278A9BADC4C2A1847
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 33b98e875419fa514b26f046f93cc6803be25ee0acdd61a2b8b6c7bd151d4611
MD5 6d17ff10dba99c44a624cda342fda41d
SHA1 3a9f53e29178a6a841b2f88e182a5dce280224ee
SHA512 83199a458f43ab6e487b6b5706d26a2a63667fa73965166839e5b579652ad24a426b24fface0dc115794f4ac899d4acc2a09ee96a767e55638141c406db18885
SSDEEP 96:xHltPUTUkqGqFQPfaQDObzSwSSlndv9jcnfyHVd7Bw8OP8L4cnsrM6:3tPHR4faQDiSSc8Vd7Bw8OBL
TLSH
T17BE1317895088F7F64B6776CAC6488716AB2413B77BF68D750B684C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 c04d645a6348ba5d82bf48fe2dac2cbbfa3fdc982d30c3d332c4e302f3a8cc34
MD5 c834131279edb882fa3e94e63fe92c65
SHA1 37780089fb864be2f6c0592b78bae1afbb7e7271
SHA512 76f65603db1caa4ae4adcaea7ecdf29cd7fad831bcd7a0111cc3026be19a938148ab8e0f0161cf7c81aae64f131c21bfe8481493de1e6d27e5be00768182ea1c
SSDEEP 96:xHltPUTUkqGqFQPfaQD1zSwSSlndv9jcnfyHVd7Bw88P8L4cnsrM6:3tPHR4faQD5SSc8Vd7Bw88BL
TLSH
T109E120789508CF7F64B677ACAC6888315AB2413BB7BF68D650B684C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 c23a74b88affdd830524112d66f7bf7409f11f00172848227b0035bec1292f4b
MD5 2d51155a7a4a4b1d3e4cf686c91ab3d5
SHA1 fff93da18a17ef4b27c1cdd588117ce9f4462021
SHA512 dd7688564ed5c83e5891d5188fbfbeb6e4598753f98855986044acdfb5670501a69992dbd30659c0a9c6d5cedb7f297d370e49c0264c81d08b49a8cbaa23c330
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zSBjSSlndv9jCnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmojSSi8Vd7Bw88Bh2
TLSH
T160E130789508CBBF74B677ACAC6488715AB2013BB7BF68D650B654C8014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-2-0x00007FF8F49A0000-0x00007FF8F49A2000-memory.dmp

Download

memory/2632-10-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/2632-9-0x00007FF65AE4A000-0x00007FF65B75C000-memory.dmp

Download

memory/2632-6-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/2632-8-0x00007FF65AE4A000-0x00007FF65B75C000-memory.dmp

Download

memory/2632-0-0x00007FF65AE4A000-0x00007FF65B75C000-memory.dmp

Download

memory/2632-1-0x00007FF8F4990000-0x00007FF8F4992000-memory.dmp

Download

memory/2632-7-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/2632-3-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/8836-387-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/8836-390-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/8836-393-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download

memory/8836-394-0x00007FF65AE40000-0x00007FF65CC6B000-memory.dmp

Download