Analysis
- user interaction
yes - max time kernel
884s - max time network
1621s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
30/10/2026, 22:25
General
- Target RagebotsOffline.exe
- Size 45.9MB
- Sample261030-2b2vgastdw
- SHA256 7fb930f28722597ae4a0bf40abe722b62677856b3294c825ad816a91e08960b4
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 3 IoCs
- Drops file in Drivers directory 6 IoCs
- Manipulates Digital Signatures 1 TTPs 5 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 42 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 31 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 13 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Connections Discovery 1 TTPs 2 IoCs
Attempt to get a listing of network connections.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 43 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 64 IoCs
- Gathers network information 2 TTPs 6 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 59 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- NTFS ADS 4 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 7 IoCs
- Suspicious behavior: LoadsDriver 7 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RagebotsOffline.exe"C:\Users\Admin\AppData\Local\Temp\RagebotsOffline.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RagebotsOffline.exe"C:\Users\Admin\AppData\Local\Temp\RagebotsOffline.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /End /TN "Ragebots Offline - Protocol Server"3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /End /TN "Ragebots Offline - Epic Games Launcher"3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Create /TN "Ragebots Offline - Protocol Server" /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Program Files\Ragebots Offline\RagebotsOffline.exe\" --server" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Delete /TN "Ragebots Offline - Epic Games Launcher" /F3⤵
-
-
C:\Windows\SYSTEM32\reg.exereg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V "Ragebots Offline - Epic Games Launcher" /T REG_SZ /D "\"C:\Program Files\Ragebots Offline\RagebotsOffline.exe\" --launch-epic" /F3⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Run /TN "Ragebots Offline - Protocol Server"3⤵
-
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --launch-epic3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --launch-epic4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\EpicGamesLauncher.exeC:\Users\Admin\Desktop\EpicGamesLauncher.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --server1⤵
- Executes dropped EXE
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /End /TN "Ragebots Offline - Protocol Server"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /End /TN "Ragebots Offline - Epic Games Launcher"3⤵
-
-
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --launch-epic1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Ragebots Offline\RagebotsOffline.exe"C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --launch-epic2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\EpicGamesLauncher.exeC:\Users\Admin\Desktop\EpicGamesLauncher.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe "C:\Program Files\Ragebots Offline\RagebotsOffline.exe" --server1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {64f1f4bf-f418-4aae-8f31-adfb6cbe9f9d} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27133 -prefMapHandle 2388 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {619c3727-31b0-4322-b970-7f05943ddea9} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3636 -prefsLen 27274 -prefMapHandle 3640 -prefMapSize 270279 -jsInitHandle 3644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {be813b3e-eb60-4631-b558-709d275bd85e} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27274 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {775478c6-8925-43bb-8407-ffab10bc0863} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34773 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4504 -initialChannelId {a7e9130a-20dc-4c8c-8f8b-03ad46eb1116} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4660 -prefsLen 35010 -prefMapHandle 4648 -prefMapSize 270279 -ipcHandle 2836 -initialChannelId {bd0a9ab1-c91b-415b-921b-6c462976de8b} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 33031 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4956 -initialChannelId {3ceafde0-6c3f-4bd1-b54e-31647c73d5d3} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 33031 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {f2d5e5fb-615f-4168-9b8e-2c23ef7cc10c} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 33031 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6012 -initialChannelId {305947fc-eb54-4053-ac12-1eaea8e25549} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6276 -prefsLen 33071 -prefMapHandle 6280 -prefMapSize 270279 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6236 -initialChannelId {c98fb6a5-87cb-4a83-8503-578ec77c3dbf} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6568 -prefsLen 33071 -prefMapHandle 6572 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {ebab709f-aa0f-4d23-8da5-dcf8322d29d4} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3160 -prefsLen 36885 -prefMapHandle 2892 -prefMapSize 270279 -jsInitHandle 4780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3280 -initialChannelId {029e28fd-3603-4d48-a7e2-5cf4da7c4356} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7164 -prefsLen 36885 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 7008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6984 -initialChannelId {b8454433-68b5-4ab5-9937-0b60852bd40f} -parentPid 2992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\uninstalltool_setup.exe"C:\Users\Admin\Downloads\uninstalltool_setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-C1XT0CRTWS.tmp\uninstalltool_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-C1XT0CRTWS.tmp\uninstalltool_setup.tmp" /SL5="$6002A,5462460,895488,C:\Users\Admin\Downloads\uninstalltool_setup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt.dll"5⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"5⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Uninstall Tool\PinToTaskbar.exe"C:\Program Files\Uninstall Tool\PinToTaskbar.exe" /pin UninstallTool.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /init5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uac5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe" /msix_register5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-AppxPackage -Path 'C:\Program Files\Uninstall Tool\UTShellExt2.msix' -ExternalLocation 'C:\Program Files\Uninstall Tool\' -ErrorAction Stop; Write-Host 'MSIX install OK'; exit 0 } catch { Write-Host 'MSIX install FAILED'; $_ | Out-File -FilePath 'C:\Program Files\Uninstall Tool\UTShellExt2_install_error.log' -Encoding utf8; exit 1 }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Downloads\Wireshark-4.6.9-x64.exe"C:\Users\Admin\Downloads\Wireshark-4.6.9-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Wireshark\vc_redist.x64.exe"C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{5E98C8E3-5BF0-4F64-8DB1-2AAD6878BFE3}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{5E98C8E3-5BF0-4F64-8DB1-2AAD6878BFE3}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=728 -burn.filehandle.self=732 /install /quiet /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{10939040-0D10-429F-915C-C7D5426D03DA}\.be\VC_redist.x64.exe"C:\Windows\Temp\{10939040-0D10-429F-915C-C7D5426D03DA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CC73DE4F-5300-436D-9E7E-ED1BF38D96D9} {8C7D8DD1-15D7-4F5F-9C15-6C71FDE74BF9} 2286⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1372 -burn.embedded BurnPipe.{57F585B3-8ADF-4F4B-8E96-C3E2034CFC5E} {4A6B3837-E5AA-43A3-A3BB-489B4308CA78} 41807⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1372 -burn.embedded BurnPipe.{57F585B3-8ADF-4F4B-8E96-C3E2034CFC5E} {4A6B3837-E5AA-43A3-A3BB-489B4308CA78} 41808⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6C2514AA-B9B7-4E3F-94D8-B958C8ED7A4D} {8103C061-53CD-41BE-A238-C245CAF64EAF} 37289⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Program Files\Wireshark\npcap-1.88.exe"C:\Program Files\Wireshark\npcap-1.88.exe" /winpcap_mode=no /loopback_support=no4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\nslDA85.tmp\NPFInstall.exe"C:\Users\Admin\AppData\Local\Temp\nslDA85.tmp\NPFInstall.exe" -n -check_dll5⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4){certutil.exe -verifystore 'Root' 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4}}"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -verifystore "Root" "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"5⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nslDA85.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nslDA85.tmp\signing.p7b"5⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "AddressBook" "C:\Users\Admin\AppData\Local\Temp\nslDA85.tmp\digi-ts-2023.p7b"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -c5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\pnputil.exepnputil.exe -e6⤵
-
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -iw5⤵
- Executes dropped EXE
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -i5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Uninstall Tool\UninstallToolHelper.exe"C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:24522⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261030222747.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261030222747.log" /install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6B9D1AFD-CCA2-4629-A98F-B3CBDA53A3C5} {F30C4D04-A89A-4DE0-ADE3-528D07B01993} 66244⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{68493494-26b5-db42-80ce-bf26968c79c6}\NPCAP.inf" "9" "405306be3" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Npcap"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Program Files\Wireshark\Wireshark.exe"C:\Program Files\Wireshark\Wireshark.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.62⤵
- Executes dropped EXE
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Wireshark\dumpcap.exe"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 12096.dummy -Z 17722⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump2⤵
- Executes dropped EXE
-
-
C:\Program Files\Wireshark\dumpcap.exe"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 12096.dummy -Z 42122⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\net.exenet start npcap2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start npcap3⤵
-
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano 12⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano 12⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\PktMon.exepktmon2⤵
-
-
C:\Windows\system32\PktMon.exepktmon start --capture --pkt-size 02⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdacbac728,0x7ffdacbac734,0x7ffdacbac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1900,i,15987777729705479316,17362132332320415068,262144 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1896 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,12704191559293503724,18251395465479681723,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,2380339857275148038,5497884013791412740,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2408 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,7101764652927109917,15268481002377357308,2097152 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3576,i,6423842474694257657,5819899801875829080,2097152 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,7836221524800663646,9478672452718025265,2097152 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4392 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,10824818514036561434,2162499123352453783,2097152 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,12265352842714667917,16535263575064806412,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,17971026936070913112,17511725993958606746,2097152 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,516096832400088202,12644350646581563156,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6116 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,220017056694512710,3454369176694942630,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,4321614777979902158,5220785008737639958,524288 --field-trial-handle=1904,i,5201838837312495902,12807109158362649140,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 31800 -prefMapHandle 1992 -prefMapSize 271030 -ipcHandle 1928 -initialChannelId {70a535b2-0e10-47ee-bf5f-5a56bdddb457} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 31800 -prefMapHandle 2388 -prefMapSize 271030 -ipcHandle 2272 -initialChannelId {69157d5c-eb0a-4d9f-9dff-d32fe70bfc27} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3376 -prefsLen 32408 -prefMapHandle 3380 -prefMapSize 271030 -jsInitHandle 3384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3388 -initialChannelId {1dc74174-8d84-4c8d-82d4-d2239521e7bd} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3544 -prefsLen 32408 -prefMapHandle 3548 -prefMapSize 271030 -ipcHandle 3556 -initialChannelId {48051646-4d0f-47d5-8beb-196e3dd80d33} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4084 -prefsLen 39907 -prefMapHandle 4088 -prefMapSize 271030 -jsInitHandle 4092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4104 -initialChannelId {6ab4bfd5-7703-4066-8009-26f07d860ef8} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4668 -prefsLen 39907 -prefMapHandle 4676 -prefMapSize 271030 -ipcHandle 4680 -initialChannelId {b04c36cc-2a5b-41d5-b9bf-cfba8890aa07} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 36724 -prefMapHandle 5896 -prefMapSize 271030 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5876 -initialChannelId {473827fd-20dd-4a04-9d14-9cb583b72710} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 36724 -prefMapHandle 5828 -prefMapSize 271030 -jsInitHandle 4028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3220 -initialChannelId {f3c52fca-cdb0-4ea0-8291-b13cfcee8940} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6216 -prefsLen 36724 -prefMapHandle 6220 -prefMapSize 271030 -jsInitHandle 6224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6140 -initialChannelId {0e4ed305-3234-4033-8118-7fad86175d58} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3220 -prefsLen 36871 -prefMapHandle 4596 -prefMapSize 271030 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6460 -initialChannelId {b5a9e9a9-8d26-4b17-80f9-51d5531ded3e} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6772 -prefsLen 36871 -prefMapHandle 6776 -prefMapSize 271030 -jsInitHandle 6780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6788 -initialChannelId {7c587728-4ef9-4700-b65c-4e3f92681f82} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7364 -prefsLen 36871 -prefMapHandle 7220 -prefMapSize 271030 -jsInitHandle 7240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7260 -initialChannelId {ff17d85c-d7ea-48fc-8e58-e5285ddf5e00} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7228 -prefsLen 36871 -prefMapHandle 7236 -prefMapSize 271030 -jsInitHandle 7160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7312 -initialChannelId {006512f2-acca-433c-bd11-f280839e6baa} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7788 -prefsLen 36871 -prefMapHandle 7792 -prefMapSize 271030 -jsInitHandle 7796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7804 -initialChannelId {11c05c0d-5450-4a99-b038-b3da2e8be5c8} -parentPid 11120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
-
C:\Users\Admin\Desktop\EpicGamesLauncher.exe"C:\Users\Admin\Desktop\EpicGamesLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2060 -prefsLen 31743 -prefMapHandle 2064 -prefMapSize 271030 -ipcHandle 2136 -initialChannelId {106a38b7-fa71-4b71-869c-114aa204fe6f} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2372 -prefsLen 31743 -prefMapHandle 2376 -prefMapSize 271030 -ipcHandle 2384 -initialChannelId {f8060048-fed7-4ddf-a53c-65ce9bbcb352} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3532 -prefsLen 32302 -prefMapHandle 3536 -prefMapSize 271030 -jsInitHandle 3540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3548 -initialChannelId {64f66d71-9b46-4e07-a007-ae386e843040} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3876 -prefsLen 32302 -prefMapHandle 3880 -prefMapSize 271030 -ipcHandle 3888 -initialChannelId {4a896e07-2817-46c0-b2e0-bd8e4f0e85ec} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4696 -prefsLen 39961 -prefMapHandle 4700 -prefMapSize 271030 -jsInitHandle 4704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4712 -initialChannelId {64cf2879-b2fc-4b97-9505-13010e302e47} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 36726 -prefMapHandle 5116 -prefMapSize 271030 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {e96c1a83-0286-4d66-8956-3da37f2142ac} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5644 -prefsLen 39961 -prefMapHandle 5648 -prefMapSize 271030 -ipcHandle 5624 -initialChannelId {ece7aa90-9b81-45d9-8a94-d99253c72c30} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 36778 -prefMapHandle 5968 -prefMapSize 271030 -jsInitHandle 5972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {d81cc310-202a-4c9f-b41e-9b9f203f0127} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4740 -prefsLen 36778 -prefMapHandle 5204 -prefMapSize 271030 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {54daef03-ae80-4961-b374-ff71505df268} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 36778 -prefMapHandle 6240 -prefMapSize 271030 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6176 -initialChannelId {f0c6a2d0-b3fb-4398-902c-6a0b4d121e42} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6264 -prefsLen 36778 -prefMapHandle 6364 -prefMapSize 271030 -jsInitHandle 6368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {5e94d883-31d6-4543-8c56-396cca1db7e4} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6636 -prefsLen 36778 -prefMapHandle 6640 -prefMapSize 271030 -jsInitHandle 6644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6604 -initialChannelId {094a0dcc-93f1-4fbb-9cf7-2e09904ba0bc} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 36778 -prefMapHandle 4880 -prefMapSize 271030 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7068 -initialChannelId {90eee610-ca42-444b-840b-771ee2ee3620} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 36818 -prefMapHandle 3204 -prefMapSize 271030 -jsInitHandle 3208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {da046f8e-87b0-4c8c-a880-219fa198ae8e} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 36818 -prefMapHandle 6752 -prefMapSize 271030 -jsInitHandle 6736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {9889e071-e86d-489a-98e9-73ab0c3ddfe8} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6752 -prefsLen 36818 -prefMapHandle 5504 -prefMapSize 271030 -jsInitHandle 7016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6696 -initialChannelId {44bce51d-aa00-45a8-847a-d0f6f4c0d64d} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6536 -prefsLen 36818 -prefMapHandle 6424 -prefMapSize 271030 -jsInitHandle 6572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6448 -initialChannelId {18617064-26a4-4810-a49c-f8a25e28d6dd} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7372 -prefsLen 36818 -prefMapHandle 6536 -prefMapSize 271030 -jsInitHandle 6572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7448 -initialChannelId {43e1e9e1-8fee-4a11-bb58-c57a3d721908} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7568 -prefsLen 36818 -prefMapHandle 7192 -prefMapSize 271030 -jsInitHandle 7736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7728 -initialChannelId {cdb47074-aef2-4f43-bb7a-c4114a879e55} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 36818 -prefMapHandle 6772 -prefMapSize 271030 -jsInitHandle 4696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7588 -initialChannelId {17adeac7-59e5-4990-882e-b4f8f606ca57} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 36818 -prefMapHandle 6816 -prefMapSize 271030 -jsInitHandle 3264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6356 -initialChannelId {d0ac4842-af16-4a4b-8f09-4027500231c8} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 8092 -prefsLen 40053 -prefMapHandle 8096 -prefMapSize 271030 -ipcHandle 8068 -initialChannelId {4bf55434-d3ae-46d7-a666-8573a3fa19cf} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8152 -prefsLen 40053 -prefMapHandle 8156 -prefMapSize 271030 -ipcHandle 8140 -initialChannelId {e1cf2848-0cc2-4b8e-8f01-3ab51065545f} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 36818 -prefMapHandle 4516 -prefMapSize 271030 -jsInitHandle 6448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5936 -initialChannelId {3edd14ff-7abb-4299-aa8b-a3f38f7f726b} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 36818 -prefMapHandle 6416 -prefMapSize 271030 -jsInitHandle 6488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6116 -initialChannelId {961f43e5-1f87-408c-8ca2-c48865deefd8} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
-
-
C:\Users\Admin\Downloads\Regshot-x64-Unicode.exe"C:\Users\Admin\Downloads\Regshot-x64-Unicode.exe"3⤵
- Executes dropped EXE
- Event Triggered Execution: Netsh Helper DLL
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Users\Admin\Downloads\Regshot-x64-Unicode.exe"C:\Users\Admin\Downloads\Regshot-x64-Unicode.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\kk\~res-x64.txt4⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6628 -prefsLen 36818 -prefMapHandle 6852 -prefMapSize 271030 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8632 -initialChannelId {37850a33-95de-4dc2-bb5f-d0ea56077eaf} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6484 -prefsLen 36818 -prefMapHandle 8432 -prefMapSize 271030 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7416 -initialChannelId {5ffc50e0-3ce8-4d71-9167-77eabe18779c} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6448 -prefsLen 36818 -prefMapHandle 4516 -prefMapSize 271030 -jsInitHandle 7540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {2f99291a-2098-4e02-89a5-bacc6633e7af} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9344 -prefsLen 36818 -prefMapHandle 9232 -prefMapSize 271030 -jsInitHandle 9340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8984 -initialChannelId {7164c988-9fee-4f9e-a34f-e3fab9ef236a} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7040 -prefsLen 36818 -prefMapHandle 9232 -prefMapSize 271030 -jsInitHandle 6048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9340 -initialChannelId {b4f580d8-b05d-4ea5-b444-e5ff52fadd40} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9480 -prefsLen 36818 -prefMapHandle 9680 -prefMapSize 271030 -jsInitHandle 9684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1892 -initialChannelId {53c8391d-7924-49da-8aaf-b4ec5ff43ffa} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9828 -prefsLen 36818 -prefMapHandle 9832 -prefMapSize 271030 -jsInitHandle 9944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9948 -initialChannelId {77862008-ea24-4a0a-a5df-ba437aec30c2} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 36818 -prefMapHandle 9356 -prefMapSize 271030 -jsInitHandle 9348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8984 -initialChannelId {15780b66-e072-448d-927d-914c412d358a} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10248 -prefsLen 36818 -prefMapHandle 10224 -prefMapSize 271030 -jsInitHandle 10252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9888 -initialChannelId {c043a7e6-ce54-4d45-8f41-d6b8ac19d110} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10452 -prefsLen 36818 -prefMapHandle 10456 -prefMapSize 271030 -jsInitHandle 10460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10396 -initialChannelId {4ddc0f43-cf95-49ee-981d-058a31dce385} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10212 -prefsLen 36976 -prefMapHandle 10556 -prefMapSize 271030 -jsInitHandle 10560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9712 -initialChannelId {e7f5b8b2-ac89-4eaf-8552-0cfaab3027e8} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10560 -prefsLen 36976 -prefMapHandle 10456 -prefMapSize 271030 -jsInitHandle 10564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6976 -initialChannelId {f5e948ca-1349-4b21-aa20-b6ef19243cb7} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10220 -prefsLen 36976 -prefMapHandle 10104 -prefMapSize 271030 -jsInitHandle 10836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10972 -initialChannelId {2bbfe405-18c3-430b-a496-11090a6a3a01} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10988 -prefsLen 36976 -prefMapHandle 10984 -prefMapSize 271030 -jsInitHandle 10944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10220 -initialChannelId {4a740f90-7383-4a9f-95d9-37a002d5520b} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9744 -prefsLen 36976 -prefMapHandle 9740 -prefMapSize 271030 -jsInitHandle 9768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10592 -initialChannelId {430bcfad-73e4-4c02-9cb6-53d2553c0fd6} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11088 -prefsLen 36976 -prefMapHandle 11016 -prefMapSize 271030 -jsInitHandle 11284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {2cfa8a94-1b8b-4250-897b-e50d29cd2701} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 36976 -prefMapHandle 10492 -prefMapSize 271030 -jsInitHandle 10468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11356 -initialChannelId {26067782-3f06-401f-b789-701c26a59dd7} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11456 -prefsLen 36976 -prefMapHandle 11460 -prefMapSize 271030 -jsInitHandle 11464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11468 -initialChannelId {843a530d-afd9-4b93-9535-ffda98cd431e} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10432 -prefsLen 36976 -prefMapHandle 10552 -prefMapSize 271030 -jsInitHandle 11224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10936 -initialChannelId {918c44d7-8942-47ea-8f59-f4785f045ca4} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11804 -prefsLen 36976 -prefMapHandle 11796 -prefMapSize 271030 -jsInitHandle 11784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11844 -initialChannelId {e68c6592-5cc3-42fd-9fa1-2de065428358} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11524 -prefsLen 36976 -prefMapHandle 11528 -prefMapSize 271030 -jsInitHandle 11512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11480 -initialChannelId {ef9f2d3b-3a81-4eac-a6f7-a3ff02f4aeef} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9764 -prefsLen 36976 -prefMapHandle 11404 -prefMapSize 271030 -jsInitHandle 10224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8704 -initialChannelId {8ada3f4d-96f0-40ce-8bcc-aa8897bce7df} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11968 -prefsLen 36976 -prefMapHandle 12044 -prefMapSize 271030 -jsInitHandle 12048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11948 -initialChannelId {e32c0342-9a98-4f6d-846a-b19e498f889a} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11556 -prefsLen 36976 -prefMapHandle 11652 -prefMapSize 271030 -jsInitHandle 11208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12116 -initialChannelId {f4066502-bc43-4d00-9486-9b5446124b8a} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11708 -prefsLen 36976 -prefMapHandle 11704 -prefMapSize 271030 -jsInitHandle 11720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10512 -initialChannelId {49426931-1baa-4d5d-a7be-ae894dfac227} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10828 -prefsLen 36976 -prefMapHandle 10508 -prefMapSize 271030 -jsInitHandle 10572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11104 -initialChannelId {dbd873fa-eba7-4bef-910f-321781ed3dab} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10220 -prefsLen 36976 -prefMapHandle 12000 -prefMapSize 271030 -jsInitHandle 2940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11300 -initialChannelId {395cef8c-0b14-4a63-a9eb-cd0bd80d11ce} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11048 -prefsLen 36976 -prefMapHandle 9904 -prefMapSize 271030 -jsInitHandle 8668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9144 -initialChannelId {e5038431-ca1b-4301-a1f7-c5e22b9da166} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9716 -prefsLen 36976 -prefMapHandle 10148 -prefMapSize 271030 -jsInitHandle 10340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7528 -initialChannelId {c1966596-04e5-4be8-a2b1-94ac69889cd7} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 36976 -prefMapHandle 5144 -prefMapSize 271030 -jsInitHandle 4876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6224 -initialChannelId {098639d0-094b-4138-8491-03565003066c} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 36976 -prefMapHandle 11792 -prefMapSize 271030 -jsInitHandle 11664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {5c1f05e5-996d-4730-863d-c0e427e93a6b} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10896 -prefsLen 36976 -prefMapHandle 10516 -prefMapSize 271030 -jsInitHandle 11080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10456 -initialChannelId {a0a72946-195c-4c8d-8c32-74fa1ab7295c} -parentPid 11380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab3⤵
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\84300ed0182a49629e78a08e779072a7 /t 12196 /p 39841⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_folderchangesview.zip\FolderChangesView.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_folderchangesview.zip\FolderChangesView.exe"1⤵
-
C:\Users\Admin\Desktop\kk\EpicGamesLauncher.exe"C:\Users\Admin\Desktop\kk\EpicGamesLauncher.exe"1⤵
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Windows\System32\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1Modify Registry
3Subvert Trust Controls
2SIP and Trust Provider Hijacking
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Debugger Evasion
1Peripheral Device Discovery
2Query Registry
6Software Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ace14.rbs
e5ace20.rbs
e5ace27.rbs
e5ace36.rbs
NPFInstall.exe
NPFInstall.log
PinToTaskbar.exe
UninstallTool.exe
unins000.exe
ws.css
Wireshark.exe
dumpcap.exe
etwdump.exe
dictionary.bintec
zstd.dll
vc_runtimeMinimum_x64.msi
2571058b-dcc6-4bdc-9746-52967098815f.tmp
7eb2e693-fe4b-4b9f-8808-176a2759bdf0.tmp
9c663c8b-bade-43b9-96fd-e24610a863b1.tmp
settings.dat
1b7a38d7-3ec9-4b46-81be-400984399bb0.tmp
4ef9cdd6-6bcf-421e-b333-13e3576b9a83.tmp
13cb2acd-2a91-4c0b-8b9a-edf4ece4ea5f.tmp
66169a63-1958-4198-a26d-f0cbe411ddad.tmp
6a782396-3242-42c2-9fd1-ea339b09d38e.tmp
a066efef-0d2b-4589-8aec-585b311f7593.tmp
b239d09b-5591-488d-b1b9-717934fe1a63.tmp
temp-index
the-real-index
ac48f085-b5f2-4a6e-ab01-01c4d9798a80.tmp
cad94e06-fbf0-4618-85ad-75b52a9b3eff.tmp
ce0634ee-5b2f-4a5c-aece-031a833792e5.tmp
e4079b12-5815-4a76-892a-8b8e8e93c547.tmp
data_1
c6c1da5c-df59-4a4f-9933-470e92d40674.tmp
d5be9907-a146-4bd5-aa0f-7eaa37d723f9.tmp
fc24ec24-841f-4a27-8c26-356c88487ec1.tmp
iconcache_idx.db
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
activity-stream.personalization.json
activity-stream.weather_feed.json
10089
10245
10276
10329
11379
11758
11772
11840
11931
12036
13354
13665
13709
13879
14175
15442
15543
15643
15861
16078
16110
16324
17308
17321
17328
17422
17425
17952
18173
18584
18699
18750
19261
19368
19801
21495
22475
22910
23193
23279
23432
2350
23720
23960
24679
25068
26715
27371
27387
27510
27595
28011
28074
28139
28510
28837
29381
2976
3029
30428
3065
31017
31239
31998
32116
32522
3475
3516
363
4041
5185
5279
5393
5826
6059
6090
6244
6592
6694
7035
7121
7344
7402
7514
7639
792
8205
8465
8542
8704
8790
8948
9109
9289
9380
01E8F9582039803DFC18712C98AFA09B73D44F1A
03BE8C8B468C6BF87C1C7C0621FFB1A6928DF0BD
03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
06522A7555B86D4B9A4DFAA354A039785A045756
06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
09399E85E35798E0A6F672AEE7D3B84B24BB989F
0B07619ADA1AF33F2FD6C54CA4FA0AF258636B99
0B85E9B3A95B3E113DD2B270E6EE05D6525D5D90
0CF9FE753234990521CCB90B0D229E968F045D5D
0DB3803B600B49911A500345FD3798C65EFBC29C
0E3131D3A846A2056956AD876F70E67C0AF42A10
134E1FB8D252DE0FC1D403B4E3AC4903D7369849
1491DD16DEB15A57BD3E9A769BE0C9563D41F7E0
14ED894382E455C9D9DEB618893B2093D659872A
15052168406BE2636F303728B9A0487E0DE27055
18BAE4B824BC37ACB5BF1E42D52A8ADB476FB913
19503881026FDB27ED2870DB48BE32725A5744CC
1A85BFA9A3E96B9804A8E5F3195DC0703B4B10F7
1B01694B6B2AD780FCEA999D0EA1A18397282E1C
1BE70A09C83A9BF4FBAF98B71A96D7CC90D5DF2C
1C6CCE4727E768D8EF30E75676577DD81B759658
1F3CC022447D8DC55956026DDCF2A798C63E918F
21AFD0F44D6D1A7A83866C65C2C485A4CE30400F
22533EF84ED8D0DA126C49E5D623E9C23C30425E
23C4CD33EF720214C4B03DF245F35F774229831D
24DCF0F7C60333F2C0A84FB3C05802053BF376C1
24E8F05422DAF1D51BB44E2AA86776DE95950AEB
2857F0A785F282454165A873747A9154C61631CA
2B0771A6C8A9AA4EEFCC4EA6D94CFDAEA1FB7623
2E0DC2D5604B3BFF356088FFB45353F80312F898
2E19C7481068D41C2C13E1D52294D083B555BA1F
2E1DFA1C962F26B1455F5BAE723DF103FAA61E7A
2ED657C0F8E37B48BD93C1E9DC0E94BAB742FE28
2F5ADC14B5EDE4D05EF2E0E9091CA3E0695EE7FA
2F8CD9CFCE6999111B7D92200748FC758CC8100C
31B13DCD32630689F6CA4B21EED50B4B2C521951
329402086C9DC376319659D703197BAD3CA76702
3357D5CC49089B4647066F263B8DCB32697640E9
336BB86B6EA22C95B8B44F66E8E1E14FDED13598
35D4E8D198DD9D6CA508489D194A44CB37DD5565
362C60291BAD46A5CB8710A5B11BEFD1064E87DE
37D8B1D9A61B90D48A901F86F1C65D6B141E87BE
385F49A91E124C37759B54CF7C30A94067E2E8FB
386D22EAB36C3C5C3713F931E60D7F8CA78D773F
3881448708367D46365129B4FC71A0B875055A85
3AE4367CBD8CBDAF4E8D8EF78BAB2404CE95B01D
3B6BCA49DD81DBECEBC9662B1E3A1E7868F91BD6
3B92583A9DCA62E1F6BDEBD41021AE7AD472D791
3DDAC76E8DB3A8C896334A163588AEF648D5B2AB
3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
3F95C7A9749E262F1A8A83178E3766F45649B162
3FC62443CABFA0ACD420484E3EEF7B34907944E8
4028D2178258B96725AA4A22D1764370B31B80CA
411B87033CDA5A6CBB31E8CF72808203A53307D7
4226B023CAE7E26A7A229091590ED90DF17E3D7A
437EA187734659D9D17BB9719631DFBA080CF2A5
44020AABCE4D5D08E5BBD09258D9EB887F384A1A
45A705404D9AC42C76D1C0363F792DD50B181952
45ABC6B517C806A72273731526799091061959D1
4624441A17F375DC8BFB55797B3E9EA6F73655E1
466D45D191FF64943C9D9AB5D4A5A7247982FFF0
47AA6A82D06D69F77A4D68608828C5288901D4C3
48539BC50C3B5A9F0E0CDDD172F6653794416F37
4B160DF5BDF61FFD20F45192BDF2ACF229D8962E
4B22C8635BAEF6C46EB83573ED12666DCDF29272
4CC2DA1807D4311C914253FDCBBA793A42E0883C
4ED4F391EE16DA91925681050B3984CA3A0E515B
52B859C2CC6593C374796A7ACDB8598169D15B97
5387CAF493C550D4BCF0EC3AC06C24CEB9F06C8E
571D298D6E70B1FDD63A5524F61CBDC2820CCB99
586D04445E74DA043C4B241C15E46663595FAEE3
59BC0ADA0355B3FA9BEECF2D78B7A2A106E5682C
5A487236FF72FB4ED83522061A536EC1F4650D68
5C2762860791E05067C11C342AB04B3AD3945895
5C3F2DBFC07D62E8902F75C65C12283AEE116FBB
5D1A79CA453C63548E664452E165CE0FC3A9C6E9
5E268756EF747C1356189AD7B6A61FD7F753F2FB
63E802DC4A9B70B62E0D5B770C885A9AEFCA428D
66F8B481D3DEDDA282DEDD299BB8A2AD42CEB87B
6817415664FA393E3F2CFAB0DA107A5F1877395D
684B40DE668384E4CE0D800867753E54BC50BE11
6A221F896E638763771079172ECD18FAE669B252
6CFE601672F7C77FA1FA5DDB46BE158BE92BEB32
6D943273D17DC7658713CC5D099B31EB861196F0
6D98E5A83E94561C030B5D7B5E20ACB26CF54736
6E76790583B878A2D6AAFF7D072783CE8170E965
6F90A984E037E2A06C8E5EC9C9223FECF968AB77
7050AA281285239791373461F4825A47468316E8
70D7AEFB1945FBA4871FCBACC06790BB1CAD0FBA
73670EDC7C32B3D852EDE042AC122A3943862F1A
73AA94E9D3BD4FF527F11AE13A4ABF8A387DCA22
76F1AC139B9D1E973E995B534F84A8DFB6568F6B
7A78DF7D0D06E1F93768EC4CDBBA0FBC2332DF92
7D2430F480E9C05F5C096CBE19D2EE2185C750BB
7F231EAC275223B87D2BBAF62E27C3F900192477
80C88E29E725EC4A10190BF466821279162F23B3
834A1C58E266D44E07C4DDA39CF9F5BF24C74E4E
841A23B19B362C283F04E5E57128EC55257AF1E9
844D214EFD97AC0BBDAA6F715A411F53285CE766
8501A0E5BE1F6E3E64955C29642EDCB300F167CC
8540EC873F08CBAD5DF5121BD3BABF95624B4A14
88FD2FDED190DD28F92704AF68944F786553E0BA
8A69CBF06B981A60C16032253540F09D2F103687
8AA63613695FF144860A7977D33F8A1DD369E5ED
8D171E03862E977F0BD02397F9648D18CF903F9A
8EA2DF255F3F6833AC65A3B49CD6D21E35590432
8F5761B40076A0514A08E50B20575B1704232522
91C6C9B2AE2731CF9BE0B7E45E24CBA00206622A
938B2EBB839BE52FC5521CFDEA9F50F9FDB590B9
93AB2CC058862696FA35D78DA46F86A2A8882477
96640DA32BB2D3EAC35FDCAA3FB7D9546C702D5C
971E935CEA431F8BAEE5EEDC94026F97A5605A9A
9749B3FD6A82BC5180A96B6587306FC6756F4D2E
974A354E2429609FDA828332873DB850F80F6A70
97C40DDAEA91C6342436210181CE0D64FC740DBA
98446637A46FE21EBDE3D7622B738DCE5337EA9A
98E7CB868A0E2CCBB49693CA594496B2A4BD01CC
9A3A22898DA6D25D67B876FB85780F8E69EFD141
9A8733ED9F9229AF0EC35579FC0B1F3C91A00B74
9CBC3DA066E605A2CDEF15B68CC7880EE182BD7F
9E148583864486CF54DD08A8364F3CB93060DFCA
9F34D37A914D1283E919E0B6A29F3E42D1CCB01E
9FEB36E4CFB753D77CB9AB3BD73471500ACA9136
9FEFA8FA27E2BCA37E1898BFF8B5BC8369B104CA
A6754CE750252665CAC6AD42BBAB70EFCEBD286C
A86EAD815AA35580B8E416FA0A931721AC5EA1CF
A97171DB22B30036FD42335E1077585DF483D36E
A9C876F7AB633AD1BBB46B34A17CE4F98C1B90C5
AA21E2E5AFA05923AD3B4706784D5EF0CEC5A8F0
AA79385ADBC79AC048F3F6FF517127B0F59D7F8B
AB6CD5EDBC4ED9222D6A03E3CA35FE143473233A
ADB9C707F88E8769A882BA5A852A87FF075D6D4A
AF5B36033265D804416F7910FEEA68DA844EE58F
B05C92FA82EE383C66B824360314D891E5F6A0DB
B1BF032C3F2DF3AC04C17069134C4639668E17AC
B352227B14BF6B9749FE1667CE1F098B7066D040
B3D384C0CBD34C1EC2D7A6C5C2DBE9687BE737B7
B6B69426C60CF395476C2CFC9B77C75A3250991C
B6CC53B0972D295D54F95FA82A5838EC5616B026
B7255963E33458BD5543D884D42068651605E1F1
B75E0A4E2301ADC60A6EA33BFECF81EBBB9220D9
B81F84622A8CFC45DB47E23F987D96120CD34A4A
B8F54D9AE2F22076CC9D42AA8047AA48B9E04921
B9A76326D5524509F2AF8AA43460C9878B78C502
C0037F9D89E27FAC3A354BAC5C3E090A3B766FAF
C06557FD1C491662C8AD20C7FB23E9A524CD7EBD
C2BDC99267DFA9F43951F2267BD8AD5ABF305ED7
C3144C936AB1517A3CC06CAF20ADADE2784693C6
C3EF31BE5D6C04F7DDE3D4E29A99C4E724F616B8
C3F723844489FEC1A4A5308266AC5864BD552431
C7E74C82FBF448E86D00CA0E501DA1C7EB4F1406
C865ADBE3EB170EB49AAE429E9256DDC5C00354E
C8F7D9504A1BC4F93D7A5E68E7434881674E6B38
C9AF40F547720B0E37088856DE61E441C061C4F8
CC145F78D07F155560A3F1D56FD9593505BE6B87
CC61A992ED7F80B88DE1DE6BBC012FE874CDFAD5
CD2E653643B2C319A4A7B76E63AC75731B30B240
CFFD4ACF07EF444F025B91883F714C17D4560935
D0C0C9E67370B64535DCE3575902FA0C5A14FFCC
D195F98BDB37E81FF17EE89449F6496CB8B8C311
D1C98106794D68BA02DB9BC79029D8CF7F7A8787
D37FD7021E24659A7A523B1495DE9C2101DF2D06
D38C1BDA5C35536E915632F90F0FE6C8789A9373
D3E7B68CB919BA149CCAB4354F9CA0721A8C74D0
D4650D78942E45AF6C67840C0A9FC45C9D5197C0
D57D013DCE620698FA86B881849BDD1E9E725A2D
D5F0427E3D15A7D89413C96EE0B9B2A412331CE8
D6243ABCDC49487D5A02A3672335428AE1048A05
D65B73C9A144397CE5ED6FCFE73D0F55798D4FA5
D7707F330980A9313E15D0169FE92FF445E4A261
D8674F675878232CCBD7443BE4ACF8EF02061A3F
DB3E2A76999E13E92B8ABC27302C3BB61DFBA768
DB7BD8CCE54CF35E4330B65B747F8894C8AF717C
DBB667ECE6FDD525E65C576DADD234FE2B4998CB
DBC810A0699CF0BE1217AD74681A226DB8B24740
DC53053A18CF761DD43AFCE7F540314E4018FF21
DC91F368A8DB7B5798345CE76C14CA2EAB76FAC5
DDFEFB381E3A93565CAF1551222CC8D1E5DC9FC0
DE71B0014AB9B7A3656C4FB55AB26F883732FF47
DEB6752770D61C6C54BEEB9AFB2DBD22B20F1BC1
DEFB94ED33EA79A637331A3DA4BFA2083FA72EAB
DF9C2F64DE858672749721C1F688EB8DC4D3B4F6
DFF0E0DD75E98DCE8DCFF82FD2BB953027AEFBD7
DFFF73607F4999B59DB54F6694A7BBAB06AF94BD
E0E113FEF3B017A22150CFE64EACB67423F30AFF
E14AFB25042EB0CE045151A8889FC3AD264C4F6B
E2CC0ECE9F34B7946655DFC291EF7C4E8CE0BED5
E47641A57763463E2C8928055F7E91F93B59518B
E4C6E6808D54352D91E54FA856DEF3864EE601D0
E6236EDE82F576C70A7DD05DFA22F0AFF03C9C41
E9162AE675653888918CB8BB04332B9F62C7BFEF
E9338C5CCF1E2FCF149487351399F198A4F9FCD6
EA87465A6B977981215042B94E7AB9FECDDEE708
EB3A69D73ABB62E4AF134E86F2A1A769B7FE9A8F
EB73E7FF0DA31744A2FBB64A65A5138D85179E37
EC15812412775E1E3B46439EEC59A765BA0A08A2
ED3253B50CFC5EDD63DF004891CED422ECB1A31A
EDB90E41FDECFE03FF5831CD5C80A6D0F7B3F508
EFD9BC2D8CC0D5DAA880BEFF76D87C2B6CA7C2DF
F03FEC6D7DC46722FDEC3258A7EC4C75AE7920B6
F12438933DCAA5300F771BB2C408A2B6AB6F22AA
F33AE45C5F10D1B889FA4A183DDEDA8F74A36DF7
F4A66D9E97DE3F2215358A0856858559EB6E2089
F4E3CAFAF99D660C4AD193B18EA773CD7E6D4781
F7EE0483D3C4E8B3C575C328269A3932B1021747
F81C9F6FACB14DC1A5CA523A35B7874DE6D1DF6E
F99404887EB0804B6520E09DBB2EA3A87C680E98
F9D2583DD0B1CECB073FACB2B28FC92B9E897B25
FD2636AA85B67150AA8FFBF064DE293750F2E2B3
FE52E6D17B76C841B707DAD918A38397C9391D58
index
Ocwnfu2pjfo9UApuOrASPonica5smh4DlvOO2Wb5Srg=.ico
n0xUeCBb68bXbM9OHnCaK1sEx1GbHtOEh5dxwtp9Si8=.ico
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
scriptCache-child-current.bin
scriptCache-child-current.bin
scriptCache-current.bin
scriptCache-current.bin
urlCache-current.bin
urlCache-current.bin
webext.sc.lz4
webext.sc.lz4
457dde8ba547fd3e7a39555e99471c0b.png
62242b32f0b12ce3e7976cd016de3413.png
FolderChangesView.cfg
fishbot_1337_clean_stage1_rod_r4.js
fishbot_1337_clean_stage1_rod_r6.js
fishbot_1337_es2015_test.js
fishbot_1337_loader_probe.js
fishbot_1337_modern.js
fishbot_1337_probe.js
fishbot_1337_r10_registered_bridge.js
fishbot_1337_r11_exported_core.js
fishbot_1337_r12_injected_runtime.js
fishbot_1337_r13_synchronous_loader.js
fishbot_1337_r14_core_first.js
fishbot_1337_r15_static.js
fishbot_1337_r16_local_scope.js
fishbot_1337_r17_staged_static.js
fishbot_1337_r18_safe_draw_callback.js
fishbot_1337_r19_crash_isolator.js
fishbot_1337_r20_targeted_cef_guards.js
fishbot_1337_r21_deferred_worker_loops.js
fishbot_1337_r22_focus_safe_ui.js
fishbot_1337_r23_input_inventory_drag.js
fishbot_1337_r24_bind_cursor_manual_rod.js
fishbot_1337_r25_startup_diagnostics.js
fishbot_1337_r26_cef_water_cache_fix.js
fishbot_1337_r27_no_false_rod_gate.js
fishbot_1337_r3_min.js
fishbot_1337_r4_packed.js
fishbot_1337_r5_direct_eval.js
fishbot_1337_r6_delayed_diagnostic.js
fishbot_1337_r6_es5_diagnostic.js
fishbot_1337_r7_port_gui.js
_psutil_windows.pyd
lz-string
lz-string.cmd
lz-string.ps1
.package-lock.json
LICENSE
README.md
bin.js
bower.json
base64-string.js
lz-string.js
lz-string.min.js
package.json
lz-string-1.0.2.js
SpecRunner.html
MIT.LICENSE
jasmine-html.js
jasmine.css
jasmine.js
lz-string-spec.js
lz-string.d.ts
build_fishbot_1337.js
fishbot_1337_r8_port_bootstrap.js
fishbot_1337_r9_port_bridge.js
fishbot_1337_r9_port_bridge_min.js
fishbot_gui_assets.json
pack_fishbot_1337.js
ragemp_r18_all_threads.txt
ragemp_r18_cdb_analysis.txt
test_fishbot_1337_clean_stage1.js
test_fishbot_1337_clean_stage1_r6.js
test_fishbot_1337_crash_isolator.js
test_fishbot_1337_smoke.js
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
response_061_4275399468.json
INSTALLER
METADATA
RECORD
WHEEL
LICENSE
LICENSE.APACHE
LICENSE.BSD
cryptography-rust.cyclonedx.json
sbom.json
_rust.pyd
EpicGamesLauncher.exe
MSVCP140.dll
MSVCP140_ATOMIC_WAIT.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
gta5rp_module.dll
libcrypto-3.dll
libffi-8.dll
payload_rebuilt_035c0000_idalib_copy.dll
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_c3n4dy5k.tlr.ps1
b615b404-bc0b-469a-b473-cfb1b556b747.zip
CertificationPage.ini
InstallOptions.dll
NpcapPage.ini
NpcapPage.ini
NpcapPage.ini
System.dll
USBPcapPage.ini
USBPcapPage.ini
USBPcapPage.ini
modern-wizard.bmp
nsDialogs.dll
InstallOptions.dll
System.dll
final.ini
final.ini
nsExec.dll
options.ini
remote-settings-startup-bundle-
tmpaddon
tmpaddon
tmpaddon
NPCAP.inf
npcap.cat
npcap.sys
preferences.xml
1KVD07F028EYTQIWKKNU.temp
6824f4a902c78fbd.customDestinations-ms
8Z276TW471CVQO48EPC8.temp
AVH4ZH0HWUQL1CKDT2BP.temp
BLNQCX4EQ8U37ZDEXLAB.temp
FPR0HSVRE47Z0DYFYLZ0.temp
J9QIPP37I1IZMXC8XYB4.temp
JS44KUI9B136JST8Q6GW.temp
P7FKMVETKA9H8QJLGFNJ.temp
RZODQ3BYJTSZ6JJG1WKM.temp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
SiteSecurityServiceState.bin
addonStartup.json.lz4
bookmarks-2026-10-30.jsonlz4
broadcast-listeners.json
broadcast-listeners.json
cookies.sqlite
store.json.mozlz4
data.safe.bin
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
events
events
pageload
005450e9-b2ea-4af6-beb3-d9d42f3e6a31
0544bbf1-895c-423a-9115-eaca2efb44ab
0b0e8d6f-bfa3-4d7c-84f1-01eeecd78aef
119e0a72-9cb8-42b2-8864-74720e26c8e4
163b84cd-a84c-48e6-a292-5bb69eb2ad8e
1dc0fe2a-4d32-4bb6-bfef-2989acf3fa4c
25511983-2486-410b-b990-44f63a9c11e0
2d8d84fb-220d-437d-9017-d58f32a4852d
3e989705-263b-4e3f-90b6-e382e1384798
737851c5-4b85-422c-968f-345573d52fcb
81a54efb-a822-4b54-9264-0bccbcd7a017
b0df0d8e-7177-4e24-80e2-6a0b841c1eaf
bc1991cb-ce6b-4ece-a4fb-615b69964299
c699df0c-e289-44b1-9f9a-1b1ad79e7a83
dab7f8a3-251c-426b-9445-996ce6254530
df4d8f4c-3020-461d-a96e-2348076e6a8a
f04376f7-6d1e-46e3-b47b-d002c35b9ac0
f563d531-8cbe-4a9b-a51e-c85fdd7178e2
f96e1c5f-a5da-4d93-bddf-ad009d5c94f9
downloads.json
downloads.json
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
sessionCheckpoints.json.tmp
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
sessionstore.jsonlz4
data.safe.tmp
2077849893osfefilrienueq_Ac3a%c.sqlite
{3c3a635b-2867-409a-9922-ba1a71289f77}.final
.padding
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
targeting.snapshot.json
targeting.snapshot.json
xulstore.json
xulstore.json
xulstore.json
xulstore.json
xulstore.json
xulstore.json
Pfv8lO3N.exe.part
uninstalltool_setup.20GcquSs.exe.part
uninstalltool_setup.exe:Zone.Identifier
CisUtMonitor.sys
fishbot_1337_es5_swc_test.js
fishbot_1337_r2_compat.js
logo.png
VC_redist.x64.exe
license.rtf
thm.wxl
thm.xml
BootstrapperApplicationData.xml
wixstdba.dll
memory/112-13635-0x0000000006470000-0x00000000064DE000-memory.dmp
memory/756-2211-0x0000000000610000-0x0000000000A62000-memory.dmp
memory/756-2302-0x0000000000610000-0x0000000000A62000-memory.dmp
memory/756-2312-0x0000000000610000-0x0000000000A62000-memory.dmp
memory/776-8147-0x0000000006E50000-0x0000000006E84000-memory.dmp
memory/776-8144-0x0000000005590000-0x00000000058E7000-memory.dmp
memory/868-772-0x00007FF62C630000-0x00007FF62ED96000-memory.dmp
memory/868-770-0x00007FFDB8CB0000-0x00007FFDB8CB2000-memory.dmp
memory/868-771-0x00007FFDB8CC0000-0x00007FFDB8CC2000-memory.dmp
memory/872-15776-0x000001DD4F4B0000-0x000001DD4F4DC000-memory.dmp
memory/872-15777-0x000001DD69A70000-0x000001DD69A78000-memory.dmp
memory/872-15780-0x000001DD69AF0000-0x000001DD69B04000-memory.dmp
memory/872-15779-0x000001DD6B0B0000-0x000001DD6B158000-memory.dmp
memory/1172-767-0x0000019F05680000-0x0000019F05B83000-memory.dmp
memory/1264-765-0x000001A84CF60000-0x000001A84D5AC000-memory.dmp
memory/3140-7912-0x00000000089A0000-0x000000000901A000-memory.dmp
memory/3140-7904-0x0000000006810000-0x000000000685C000-memory.dmp
memory/3140-7891-0x0000000005AE0000-0x000000000610A000-memory.dmp
memory/3140-7893-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/3140-7894-0x0000000006110000-0x0000000006176000-memory.dmp
memory/3140-7892-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/3140-7901-0x0000000006280000-0x00000000065D7000-memory.dmp
memory/3140-7902-0x0000000006760000-0x000000000677E000-memory.dmp
memory/3140-7908-0x0000000007720000-0x00000000077B6000-memory.dmp
memory/3140-7909-0x0000000006CB0000-0x0000000006CCA000-memory.dmp
memory/3140-7910-0x0000000006CD0000-0x0000000006CF2000-memory.dmp
memory/3140-7911-0x0000000007D70000-0x0000000008316000-memory.dmp
memory/3140-7890-0x0000000005310000-0x0000000005346000-memory.dmp
memory/3140-7913-0x0000000007BD0000-0x0000000007C0D000-memory.dmp
memory/3224-778-0x00007FF62C630000-0x00007FF62ED96000-memory.dmp
memory/3288-2265-0x0000000000400000-0x0000000000474000-memory.dmp
memory/3728-3080-0x00000000006C0000-0x0000000000737000-memory.dmp
memory/3888-2047-0x00000000009F0000-0x0000000000ADA000-memory.dmp
memory/3888-2313-0x00000000009F0000-0x0000000000ADA000-memory.dmp
memory/3888-1995-0x00000000009F0000-0x0000000000ADA000-memory.dmp
memory/4944-782-0x0000020ECE2B0000-0x0000020ECE8FC000-memory.dmp
memory/5212-2273-0x000001E6A7FF0000-0x000001E6A800C000-memory.dmp
memory/5212-2275-0x000001E6A8560000-0x000001E6A857C000-memory.dmp
memory/5212-2274-0x000001E6A8010000-0x000001E6A80C3000-memory.dmp
memory/5212-2306-0x000001E6A7F60000-0x000001E6A7FAB000-memory.dmp
memory/5212-2276-0x000001E6A7FF0000-0x000001E6A7FFA000-memory.dmp
memory/5212-2258-0x000001E6A7DA0000-0x000001E6A7DC2000-memory.dmp
memory/5332-3081-0x00000000006C0000-0x0000000000737000-memory.dmp
memory/5720-11490-0x000001AD2C260000-0x000001AD2C2A6000-memory.dmp
memory/7060-3078-0x00000000006C0000-0x0000000000737000-memory.dmp
memory/7236-8130-0x0000000005C60000-0x0000000005FB7000-memory.dmp
memory/7520-11583-0x000001F6A8680000-0x000001F6A8733000-memory.dmp
memory/7520-11584-0x000001F6A85F0000-0x000001F6A85FA000-memory.dmp
memory/7520-11585-0x000001F6A8760000-0x000001F6A877C000-memory.dmp
memory/11252-15417-0x00007FF73AEB0000-0x00007FF73D616000-memory.dmp
memory/11252-15416-0x00007FFDB8CC0000-0x00007FFDB8CC2000-memory.dmp
memory/11252-15415-0x00007FFDB8CB0000-0x00007FFDB8CB2000-memory.dmp
memory/11416-11850-0x00007FF62C630000-0x00007FF62ED96000-memory.dmp
memory/12096-10541-0x00007FFD93C70000-0x00007FFD942B7000-memory.dmp
memory/12096-10542-0x00007FF764C90000-0x00007FF765E81000-memory.dmp