7dd56409cd413f637b55ebc5748bbc7e06a5fb349171e4b494fba6ab89957b37

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Eon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	OWinstaller.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
4524	Eon.exe
7992	FreeRAM XP Pro.exe
760	FreeRAM XP Pro.exe
5072	FreeRAM XP Pro.exe
6524	FreeRAM XP Pro.exe
7660	FreeRAM XP Pro.exe
7040	Reader_uk_install.exe
2844	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
7668	OWinstaller.exe

Loads dropped DLL 55 IoCs

pid	Process
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
7668	OWinstaller.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FreeRAM XP = "\"C:\\Program Files (x86)\\YourWare Solutions\\FreeRAM XP Pro\\FreeRAM XP Pro.exe\" -win"	FreeRAM XP Pro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OWinstaller.exe

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
694	discord.com
695	discord.com
702	discord.com
711	discord.com
1356	drive.google.com
1809	drive.google.com
2894	sites.google.com
2896	sites.google.com
724	discord.com
2306	drive.google.com
2307	drive.google.com
2308	drive.google.com
2895	sites.google.com
2897	sites.google.com

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\T:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\E:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\J:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\U:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\S:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\X:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\Y:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\V:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\M:	Eon_Launcher_1.2.1_x64_en-US.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	Eon_Launcher_1.2.1_x64_en-US.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
869	ip-api.com
3232	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	DxDiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	DxDiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	DxDiag.exe

Suspicious use of SetThreadContext 62 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 7928	3256	Explorer.EXE	313
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312
PID 3256 set thread context of 3360	3256	Explorer.EXE	312

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/7040-7887-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-7931-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-8645-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-9426-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-9888-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-11026-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx
behavioral1/memory/7040-11531-0x0000000000660000-0x0000000000AE2000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3808_346674877\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3808_346674877\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Program Files\luncheon\kluoncyuost	laubcher.exe
File opened for modification	C:\Program Files\salamanders\hydreensoially.dat	Explorer.EXE
File opened for modification	C:\Program Files (x86)\brainwashing\iongags.inf	Explorer.EXE
File opened for modification	C:\Program Files\luncheon\kluoncyuost	laubcher.exe
File created	C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe	Install FreeRAM XP Pro 1.52.exe
File opened for modification	C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe	Install FreeRAM XP Pro 1.52.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3808_346674877\protocols.json	msedgewebview2.exe
File opened for modification	C:\Program Files\gables\efoissioungs.inf	Explorer.EXE
File opened for modification	C:\Program Files\luncheon\kluoncyuost	laubcher.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59094d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C4C.tmp	msiexec.exe
File created	C:\Windows\Installer\e59094f.msi	msiexec.exe
File created	C:\Windows\Installer\e59094d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BA.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3725B2ED-92E8-4F15-B02B-19F9F470DCF8}	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Reader_uk_install.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	OWinstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_uk_install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FreeRAM XP Pro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FreeRAM XP Pro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OWinstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OWinstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_uk_install.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRAM XP Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRAM XP Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_uk_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Buff Achievement Tracker - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Buff Achievement Tracker - Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eon_Launcher_1.2.1_x64_en-US.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install FreeRAM XP Pro 1.52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRAM XP Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRAM XP Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRAM XP Pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5080	chrome.exe
5976	msedge.exe
5048	msedge.exe
6820	msedge.exe
6568	msedge.exe
4624	chrome.exe

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DxDiag.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000298171ba54d972bf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000298171ba0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900298171ba000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a298171ba000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d298171ba000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DxDiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DxDiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DxDiag.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 24 IoCs

pid	Process
8960	taskkill.exe
6248	taskkill.exe
5980	taskkill.exe
3432	taskkill.exe
176	taskkill.exe
8896	taskkill.exe
8940	taskkill.exe
10820	taskkill.exe
10160	taskkill.exe
8996	taskkill.exe
8520	taskkill.exe
3600	taskkill.exe
9248	taskkill.exe
6092	taskkill.exe
1996	taskkill.exe
7776	taskkill.exe
204	taskkill.exe
8928	taskkill.exe
8916	taskkill.exe
4716	taskkill.exe
1344	taskkill.exe
3656	taskkill.exe
7796	taskkill.exe
8948	taskkill.exe

Modifies Control Panel 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Colors	Eon.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DE2B52738E2951F40BB2919F4F07CD8F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2B52738E2951F40BB2919F4F07CD8F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000002000000040000000300000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	DxDiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	DxDiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	DxDiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\MRUListEx = 00000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Documents"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	DxDiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 3a002e80aba36ff8d270c74f9c99fcbf05467f3a260001002600efbe11000000e7058212ff41dd0174014a16ff41dd0159d04869ff41dd0114000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0 = 5400310000000000625db135100041737365747300003e0009000400efbe625daf35625db1352e000000d7440200000007000000000000000000000000000000e7f51f01410073007300650074007300000016000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	DxDiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	DxDiag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2B52738E2951F40BB2919F4F07CD8F\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\NodeSlot = "9"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	DxDiag.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0\NodeSlot = "11"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	DxDiag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 050000000100000002000000040000000300000000000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE2B52738E2951F40BB2919F4F07CD8F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Eon\\Eon Launcher 1.2.1\\install\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0CBFB2E5CBD40E4D9EF4ACDE33F503C	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\framxpro.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\framxpro(1).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Reader_uk_install.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Glacier.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1096	msiexec.exe
1096	msiexec.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
4524	Eon.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
7508	chrome.exe
7508	chrome.exe
7040	Reader_uk_install.exe
7040	Reader_uk_install.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
2844	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
4756	Buff Achievement Tracker - Installer.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
5272	DxDiag.exe
5272	DxDiag.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
7668	OWinstaller.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
8732	glaicer.exe
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE
3256	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
8132	firefox.exe
5800	Install FreeRAM XP Pro 1.52.exe
7992	FreeRAM XP Pro.exe
3256	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
6244	msedge.exe
6244	msedge.exe
6244	msedge.exe
6244	msedge.exe
6244	msedge.exe
7508	chrome.exe
7508	chrome.exe
7508	chrome.exe
7508	chrome.exe
7508	chrome.exe
3808	msedgewebview2.exe
3808	msedgewebview2.exe
3808	msedgewebview2.exe
3360	chrome.exe
3360	chrome.exe
7928	msedge.exe
7928	msedge.exe
3360	chrome.exe
9128	msedge.exe
9128	msedge.exe
9128	msedge.exe
9128	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: SeCreateTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeAssignPrimaryTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeLockMemoryPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeIncreaseQuotaPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeMachineAccountPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeTcbPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSecurityPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeTakeOwnershipPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeLoadDriverPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemProfilePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemtimePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeProfSingleProcessPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeIncBasePriorityPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreatePagefilePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreatePermanentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeBackupPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeRestorePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeShutdownPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeDebugPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeAuditPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemEnvironmentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeChangeNotifyPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeRemoteShutdownPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeUndockPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSyncAgentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeEnableDelegationPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeManageVolumePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeImpersonatePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreateGlobalPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreateTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeAssignPrimaryTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeLockMemoryPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeIncreaseQuotaPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeMachineAccountPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeTcbPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSecurityPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeTakeOwnershipPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeLoadDriverPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemProfilePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemtimePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeProfSingleProcessPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeIncBasePriorityPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreatePagefilePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreatePermanentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeBackupPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeRestorePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeShutdownPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeDebugPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeAuditPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSystemEnvironmentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeChangeNotifyPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeRemoteShutdownPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeUndockPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeSyncAgentPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeEnableDelegationPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeManageVolumePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeImpersonatePrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreateGlobalPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeCreateTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeAssignPrimaryTokenPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeLockMemoryPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeIncreaseQuotaPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe
Token: SeMachineAccountPrivilege	2764	Eon_Launcher_1.2.1_x64_en-US.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2764	Eon_Launcher_1.2.1_x64_en-US.exe
3488	msiexec.exe
3488	msiexec.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3488	msiexec.exe
3536	firefox.exe
3536	firefox.exe
6244	msedge.exe
6244	msedge.exe
6244	msedge.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
8132	firefox.exe
8132	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
6156	7zG.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
8132	firefox.exe
8132	firefox.exe
3536	firefox.exe
3536	firefox.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
7992	FreeRAM XP Pro.exe
5660	taskmgr.exe
7992	FreeRAM XP Pro.exe
5660	taskmgr.exe
7992	FreeRAM XP Pro.exe
5660	taskmgr.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe
7992	FreeRAM XP Pro.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3536	firefox.exe
8132	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
7040	Reader_uk_install.exe
7040	Reader_uk_install.exe
7040	Reader_uk_install.exe
7040	Reader_uk_install.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
7668	OWinstaller.exe
5272	DxDiag.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe
4056	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4496	1096	msiexec.exe	87
PID 2764 wrote to memory of 3488	2764	Eon_Launcher_1.2.1_x64_en-US.exe	88
PID 1096 wrote to memory of 1368	1096	msiexec.exe	89
PID 1096 wrote to memory of 3900	1096	msiexec.exe	100
PID 1096 wrote to memory of 4816	1096	msiexec.exe	102
PID 464 wrote to memory of 3536	464	firefox.exe	104
PID 464 wrote to memory of 3536	464	firefox.exe	104
PID 3536 wrote to memory of 1092	3536	firefox.exe	105
PID 3536 wrote to memory of 1092	3536	firefox.exe	105
PID 3536 wrote to memory of 1092	3536	firefox.exe	105
PID 3536 wrote to memory of 1300	3536	firefox.exe	107
PID 3536 wrote to memory of 1300	3536	firefox.exe	107
PID 3536 wrote to memory of 1300	3536	firefox.exe	107
PID 3536 wrote to memory of 1300	3536	firefox.exe	107
PID 3536 wrote to memory of 1572	3536	firefox.exe	108
PID 3536 wrote to memory of 1572	3536	firefox.exe	108
PID 3536 wrote to memory of 1572	3536	firefox.exe	108
PID 3536 wrote to memory of 1572	3536	firefox.exe	108
PID 3536 wrote to memory of 1652	3536	firefox.exe	109
PID 3536 wrote to memory of 1652	3536	firefox.exe	109
PID 3536 wrote to memory of 1652	3536	firefox.exe	109
PID 3536 wrote to memory of 4332	3536	firefox.exe	110
PID 3536 wrote to memory of 4332	3536	firefox.exe	110
PID 3536 wrote to memory of 4332	3536	firefox.exe	110
PID 3536 wrote to memory of 4332	3536	firefox.exe	110
PID 3536 wrote to memory of 5152	3536	firefox.exe	111
PID 3536 wrote to memory of 5152	3536	firefox.exe	111
PID 3536 wrote to memory of 5152	3536	firefox.exe	111
PID 3536 wrote to memory of 5152	3536	firefox.exe	111
PID 3536 wrote to memory of 5192	3536	firefox.exe	112
PID 3536 wrote to memory of 5192	3536	firefox.exe	112
PID 3536 wrote to memory of 5192	3536	firefox.exe	112
PID 3536 wrote to memory of 5192	3536	firefox.exe	112
PID 3536 wrote to memory of 5204	3536	firefox.exe	113
PID 3536 wrote to memory of 5204	3536	firefox.exe	113
PID 3536 wrote to memory of 5204	3536	firefox.exe	113
PID 3536 wrote to memory of 5204	3536	firefox.exe	113
PID 3536 wrote to memory of 5260	3536	firefox.exe	114
PID 3536 wrote to memory of 5260	3536	firefox.exe	114
PID 3536 wrote to memory of 5260	3536	firefox.exe	114
PID 3536 wrote to memory of 5260	3536	firefox.exe	114
PID 3536 wrote to memory of 2840	3536	firefox.exe	117
PID 3536 wrote to memory of 2840	3536	firefox.exe	117
PID 3536 wrote to memory of 2840	3536	firefox.exe	117
PID 3536 wrote to memory of 2840	3536	firefox.exe	117
PID 3536 wrote to memory of 1872	3536	firefox.exe	118
PID 3536 wrote to memory of 1872	3536	firefox.exe	118
PID 3536 wrote to memory of 1872	3536	firefox.exe	118
PID 3536 wrote to memory of 1872	3536	firefox.exe	118
PID 3536 wrote to memory of 5956	3536	firefox.exe	119
PID 3536 wrote to memory of 5956	3536	firefox.exe	119
PID 3536 wrote to memory of 5956	3536	firefox.exe	119
PID 3536 wrote to memory of 5956	3536	firefox.exe	119
PID 3536 wrote to memory of 5620	3536	firefox.exe	120
PID 3536 wrote to memory of 5620	3536	firefox.exe	120
PID 3536 wrote to memory of 5620	3536	firefox.exe	120
PID 3536 wrote to memory of 5620	3536	firefox.exe	120
PID 3536 wrote to memory of 748	3536	firefox.exe	121
PID 3536 wrote to memory of 748	3536	firefox.exe	121
PID 3536 wrote to memory of 748	3536	firefox.exe	121
PID 3536 wrote to memory of 748	3536	firefox.exe	121
PID 3536 wrote to memory of 4984	3536	firefox.exe	122
PID 3536 wrote to memory of 4984	3536	firefox.exe	122
PID 3536 wrote to memory of 4984	3536	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	glaicer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3256
- C:\Users\Admin\AppData\Local\Temp\Eon_Launcher_1.2.1_x64_en-US.exe
  "C:\Users\Admin\AppData\Local\Temp\Eon_Launcher_1.2.1_x64_en-US.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eon\Eon Launcher 1.2.1\install\Eon Installer.x64.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Eon_Launcher_1.2.1_x64_en-US.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1793361200 "
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3488
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27099 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {f1c33936-5497-4169-831d-f37846952872} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27135 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {9822d8fe-b82e-4263-9d55-1d8f79dd23b7} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27276 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {3ab3b3b2-d6d0-4a29-825c-86f54c37caeb} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      PID:1572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27276 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {282ef483-d2ff-4f43-b310-cc9dfdf02ece} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4380 -prefsLen 34775 -prefMapHandle 4384 -prefMapSize 270279 -jsInitHandle 4388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {4e8a4952-edd8-46bd-a43a-451e3d38d2a1} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2752 -prefsLen 35091 -prefMapHandle 4988 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {cade1dd3-c664-4757-a0d1-7ac90577f113} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32979 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {90a615a3-e378-4bc0-ad41-793aeef1fa50} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:5192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 32979 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {f21d4218-20f9-4b11-9a13-9902f597b613} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5680 -prefsLen 32979 -prefMapHandle 5684 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {eeaceb52-5819-429d-8115-3cd172d2a4ee} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      PID:5260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 33071 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6104 -initialChannelId {331dd79b-40da-49d6-a3c0-ea5cb9b8a254} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6456 -prefsLen 36885 -prefMapHandle 6452 -prefMapSize 270279 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6440 -initialChannelId {68a62b13-885a-4f73-acf5-d4c5befe101a} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      PID:1872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 36885 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {c538cbe0-0ca8-4d44-85ca-392e8f1ae180} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      PID:5956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6440 -prefsLen 40024 -prefMapHandle 4672 -prefMapSize 270279 -ipcHandle 2752 -initialChannelId {4b3c8dec-968e-4aed-94df-51a2f6fa6f77} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
      4⤵
      PID:5620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6052 -prefsLen 36885 -prefMapHandle 2696 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {8c5fbd37-699f-451e-a301-18b917fa6fce} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
      4⤵
      PID:748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6776 -prefsLen 36885 -prefMapHandle 6772 -prefMapSize 270279 -jsInitHandle 2648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6988 -initialChannelId {924e6ad4-0c85-44a8-9637-6d1dd716dc1b} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
      4⤵
      PID:4984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5972 -prefsLen 36885 -prefMapHandle 6136 -prefMapSize 270279 -jsInitHandle 6016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {f8a7a448-fa46-436b-b90e-091aeb9929cf} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
      4⤵
      PID:5808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6668 -prefsLen 36885 -prefMapHandle 6628 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5980 -initialChannelId {0d12b383-2ff4-4386-bbb5-14fcd88eccd5} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
      4⤵
      PID:5312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7120 -prefsLen 36885 -prefMapHandle 7104 -prefMapSize 270279 -jsInitHandle 7108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {eed0ab48-7ce7-41c9-b1ff-691105be624f} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
      4⤵
      PID:2396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6168 -prefsLen 36885 -prefMapHandle 4696 -prefMapSize 270279 -jsInitHandle 6164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {a9d56876-0038-4892-869f-8b573efaf9eb} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
      4⤵
      PID:4084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6416 -prefsLen 36885 -prefMapHandle 6792 -prefMapSize 270279 -jsInitHandle 6772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6760 -initialChannelId {c2fb9bd3-4ca3-4f4d-bba3-2bdb5eaf82de} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
      4⤵
      Checks processor information in registry
      PID:1184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3176 -prefsLen 36885 -prefMapHandle 6872 -prefMapSize 270279 -jsInitHandle 6888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {ed240fb3-d8e7-4f47-a447-99a6e791c941} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
      4⤵
      PID:5764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7008 -prefsLen 36885 -prefMapHandle 5936 -prefMapSize 270279 -jsInitHandle 4724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7188 -initialChannelId {ef098e02-9d1b-4a88-8b12-b591f0e99e6b} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
      4⤵
      PID:4648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6080 -prefsLen 36885 -prefMapHandle 6176 -prefMapSize 270279 -jsInitHandle 6164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4760 -initialChannelId {10e783a5-59bc-46f1-be4f-e48c347a44dc} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
      4⤵
      PID:5384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 36885 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 2696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7392 -initialChannelId {bcfd4507-7922-4bd4-a346-87abfefcf3d1} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
      4⤵
      PID:2832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7512 -prefsLen 36885 -prefMapHandle 7516 -prefMapSize 270279 -jsInitHandle 7520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7528 -initialChannelId {d7d2c713-ae30-4091-941f-fa19cc6a23e5} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
      4⤵
      PID:1684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7312 -prefsLen 36885 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 1496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7416 -initialChannelId {49d374a6-82a8-4f33-b9a9-2e613185606a} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
      4⤵
      PID:2928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7840 -prefsLen 36885 -prefMapHandle 7844 -prefMapSize 270279 -jsInitHandle 7848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7856 -initialChannelId {7e99cfeb-d407-42ef-8438-799fabe106d6} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
      4⤵
      Checks processor information in registry
      PID:748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8028 -prefsLen 36885 -prefMapHandle 8016 -prefMapSize 270279 -jsInitHandle 8012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8084 -initialChannelId {80199c1d-c513-466c-8cd8-a5c609bf2c2e} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
      4⤵
      PID:5312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8848 -prefsLen 36885 -prefMapHandle 8856 -prefMapSize 270279 -jsInitHandle 8860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8868 -initialChannelId {e9c3bae6-069f-446f-afe8-b7ea8ea3df3b} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
      4⤵
      PID:3028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9116 -prefsLen 36885 -prefMapHandle 9120 -prefMapSize 270279 -jsInitHandle 9124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9040 -initialChannelId {5592489d-e1dc-40e8-b466-d9fe5f013671} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
      4⤵
      PID:5404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9084 -prefsLen 36885 -prefMapHandle 9412 -prefMapSize 270279 -jsInitHandle 9416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9424 -initialChannelId {9e052958-3c49-4bee-ad44-6cd03a0e6127} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
      4⤵
      PID:1488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9544 -prefsLen 36885 -prefMapHandle 9548 -prefMapSize 270279 -jsInitHandle 9552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9560 -initialChannelId {fa0896e2-f5ed-40bc-9df3-fb31b21f24da} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
      4⤵
      PID:5780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9492 -prefsLen 36885 -prefMapHandle 9528 -prefMapSize 270279 -jsInitHandle 9496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9488 -initialChannelId {6fbd34ab-ddae-4f55-a63f-e42186167a1e} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
      4⤵
      PID:5900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8812 -prefsLen 36885 -prefMapHandle 9464 -prefMapSize 270279 -jsInitHandle 9468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9476 -initialChannelId {4ac9ecdb-6a5b-4d8e-a7d3-d7702fcb125d} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
      4⤵
      Checks processor information in registry
      PID:8100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9984 -prefsLen 36885 -prefMapHandle 9488 -prefMapSize 270279 -jsInitHandle 10024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10036 -initialChannelId {a1b5a9e8-7247-43e6-b871-88a84b3b2881} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
      4⤵
      PID:8108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 10400 -prefsLen 40398 -prefMapHandle 10524 -prefMapSize 270279 -ipcHandle 6800 -initialChannelId {9d07a62d-b8ea-4172-afea-d3725a613558} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 utility
      4⤵
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:8132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9776 -prefsLen 37013 -prefMapHandle 9856 -prefMapSize 270279 -jsInitHandle 9860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9208 -initialChannelId {8a06fd1b-9295-4440-98da-b455a429b6e2} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
      4⤵
      PID:2296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9148 -prefsLen 37013 -prefMapHandle 9136 -prefMapSize 270279 -jsInitHandle 9040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9444 -initialChannelId {aff85ec4-6bab-42f1-b591-b7ea9c4d3615} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
      4⤵
      Checks processor information in registry
      PID:4200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6560 -prefsLen 37013 -prefMapHandle 7136 -prefMapSize 270279 -jsInitHandle 4136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6684 -initialChannelId {3e53642d-f58d-46b6-91cc-69f91bab005a} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
      4⤵
      Checks processor information in registry
      PID:6660
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10176 -prefsLen 37013 -prefMapHandle 10044 -prefMapSize 270279 -jsInitHandle 10048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10232 -initialChannelId {9b665ad9-1bed-4da8-be53-5039a8086903} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
      4⤵
      PID:4648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6760 -prefsLen 37013 -prefMapHandle 5564 -prefMapSize 270279 -jsInitHandle 9264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7360 -initialChannelId {215e29e5-9f55-4262-bf4c-5162ecdf8293} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
      4⤵
      Checks processor information in registry
      PID:5592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9948 -prefsLen 37013 -prefMapHandle 8796 -prefMapSize 270279 -jsInitHandle 9880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7812 -initialChannelId {86e9e1ce-3275-4d14-820e-c70b6669b17a} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
      4⤵
      Checks processor information in registry
      PID:3712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9040 -prefsLen 37013 -prefMapHandle 8240 -prefMapSize 270279 -jsInitHandle 8236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6868 -initialChannelId {cc8e8d17-dd53-4031-82d3-29b6cdeaddba} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
      4⤵
      PID:2292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8976 -prefsLen 37013 -prefMapHandle 6868 -prefMapSize 270279 -jsInitHandle 8904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8936 -initialChannelId {b4024514-85fc-410f-bf09-58c2cdaecd14} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
      4⤵
      PID:3720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9676 -prefsLen 37053 -prefMapHandle 9652 -prefMapSize 270279 -jsInitHandle 9604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9628 -initialChannelId {e3e472a7-b212-4395-8a32-d3521b424b44} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
      4⤵
      PID:8100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8184 -prefsLen 37053 -prefMapHandle 9976 -prefMapSize 270279 -jsInitHandle 1644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8112 -initialChannelId {80bd7bcd-ba21-47d5-a72c-797666276b98} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
      4⤵
      PID:7756
- C:\Users\Admin\Documents\Eon Launcher\Assets\Eon.exe
  "C:\Users\Admin\Documents\Eon Launcher\Assets\Eon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/channels/1185620726695342260/1210499602885640213
    3⤵
    PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/channels/1185620726695342260/1210499602885640213
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff83bc9c188,0x7ff83bc9c194,0x7ff83bc9c1a0
        5⤵
        
        PID:6272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,4535776440917188853,2787147167489074557,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8699063748725780329,10431229342342394449,262144 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
        5⤵
        
        PID:6576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,3391478541873688769,10531676435671228213,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
        5⤵
        
        PID:6620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14522073105216714106,17174520457968838474,2097152 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:6832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13387020509468167981,852919475814497777,2097152 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:6840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,12746944794251234517,11120083798155688560,2097152 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
        5⤵
        
        PID:7004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8208403723901373193,10031562236680872193,2097152 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
        5⤵
        
        PID:7012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,2485966197779202373,9429231937531252321,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:8
        5⤵
        
        PID:6988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5264,i,7674239666304856300,3540411271157271741,2097152 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
        5⤵
        
        PID:6836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13968191914000841185,12983403179064127000,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14655202350535590570,835624276992493772,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
        5⤵
        
        PID:1524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8884192017679917582,8848054357722427406,524288 --field-trial-handle=2292,i,5921082506891217869,10367339444726891257,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
        5⤵
        
        PID:7172
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17421:84:7zEvent6053
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:6156
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\framxpro(1)\Readme and Notes.txt
  2⤵
  PID:3108
- C:\Users\Admin\Downloads\framxpro(1)\Install FreeRAM XP Pro 1.52.exe
  "C:\Users\Admin\Downloads\framxpro(1)\Install FreeRAM XP Pro 1.52.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5800
- - C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    "C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:7992
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:5660
- C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
  "C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
  "C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6524
- C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
  "C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:7508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff855e9c728,0x7ff855e9c734,0x7ff855e9c740
    3⤵
    PID:6692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,4147392098069810621,11125543200845774815,262144 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:2940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13701662425966293116,17694092113420214957,524288 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3291398327099495841,14049421878672492313,524288 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2584 /prefetch:8
    3⤵
    PID:6968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,17465687811763404228,3662320695800185146,2097152 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:7228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,1226731169665736102,13328343723088246501,2097152 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:7304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,2762520088533706560,16396973095636541119,2097152 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4324 /prefetch:2
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,17051156883822440604,7233490032318189508,2097152 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15924110127606745644,4741958004878474652,524288 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:7772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5864,i,2793823937511087953,13025440816444482197,2097152 --field-trial-handle=1972,i,10638060343744017784,3091909318685701650,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:4484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Downloads MZ/PE file
    - A potential corporate email address has been identified in the URL
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:4056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2044 -prefsLen 31482 -prefMapHandle 2052 -prefMapSize 271090 -ipcHandle 2136 -initialChannelId {a4656149-c9b3-4003-ba08-f954d1d21731} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:7924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2376 -prefsLen 31482 -prefMapHandle 2368 -prefMapSize 271090 -ipcHandle 2416 -initialChannelId {c4b1b5a8-37e3-40f2-9055-9c9c4fee1d54} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:8032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 32090 -prefMapHandle 3784 -prefMapSize 271090 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {dcf4907f-4dcb-4754-80ce-bead15a8f1d0} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 32090 -prefMapHandle 4024 -prefMapSize 271090 -ipcHandle 4032 -initialChannelId {e1efeb91-58cd-405a-b77d-2b98a56d7384} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:7972
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4696 -prefsLen 39646 -prefMapHandle 4700 -prefMapSize 271090 -jsInitHandle 4704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4708 -initialChannelId {818130fe-3b20-4874-87ab-e17dde2c9e8a} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:4740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 39753 -prefMapHandle 5080 -prefMapSize 271090 -ipcHandle 5072 -initialChannelId {beede4c8-3923-4c9e-81b4-bb6bbefc14c4} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 36420 -prefMapHandle 5352 -prefMapSize 271090 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {01cd15d8-c99e-4595-bab1-c0f43a2cec71} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 36420 -prefMapHandle 5476 -prefMapSize 271090 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {3bbde939-b2c0-4bde-8e60-615191faf3b8} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:4956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 36420 -prefMapHandle 5656 -prefMapSize 271090 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {22ef00b2-d26e-46b4-a922-604322a9b35b} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      PID:1784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3384 -prefsLen 36460 -prefMapHandle 6280 -prefMapSize 271090 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6268 -initialChannelId {d9dcd1da-5281-4856-bd00-eecebfade4ed} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      PID:4736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 36460 -prefMapHandle 2604 -prefMapSize 271090 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {d589cdb8-80b9-422e-81aa-3152bf00cc6e} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:7352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 36460 -prefMapHandle 5600 -prefMapSize 271090 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6536 -initialChannelId {52f32ab9-14f8-4ac4-a090-09014380dce5} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      PID:1720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 36460 -prefMapHandle 3268 -prefMapSize 271090 -jsInitHandle 2984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4996 -initialChannelId {6db3c90c-86c1-49e0-a9dd-9164e873b3d0} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      PID:6548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6848 -prefsLen 39845 -prefMapHandle 6856 -prefMapSize 271090 -ipcHandle 4548 -initialChannelId {908cf889-74f4-4cdf-8762-c8e2715066e9} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
      4⤵
      PID:5268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6876 -prefsLen 39845 -prefMapHandle 6880 -prefMapSize 271090 -ipcHandle 6816 -initialChannelId {c8aab1d1-15d5-4e68-a7a6-ac732fd35bae} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
      4⤵
      PID:6020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 36460 -prefMapHandle 5844 -prefMapSize 271090 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {caf1b3b3-7d53-4fde-97fa-1b5858caa62a} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
      4⤵
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3260 -prefsLen 36460 -prefMapHandle 7344 -prefMapSize 271090 -jsInitHandle 7328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {313cc3fa-69f3-454a-8e08-80c075b6a3b4} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
      4⤵
      PID:6932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7504 -prefsLen 36460 -prefMapHandle 7500 -prefMapSize 271090 -jsInitHandle 7548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7560 -initialChannelId {3274da09-c818-4722-b85d-dd72e7c0cca8} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7732 -prefsLen 36460 -prefMapHandle 7728 -prefMapSize 271090 -jsInitHandle 7736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7740 -initialChannelId {fe2b23de-8347-4566-b169-2324662eb569} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
      4⤵
      Checks processor information in registry
      PID:3332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6728 -prefsLen 36460 -prefMapHandle 6296 -prefMapSize 271090 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {aaca41aa-621d-4d4b-9d0b-8c3c7067dede} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
      4⤵
      PID:4032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 36460 -prefMapHandle 6580 -prefMapSize 271090 -jsInitHandle 2620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {e181bc60-fca5-455e-af36-bc4c3e6cf793} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
      4⤵
      PID:7140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7384 -prefsLen 36460 -prefMapHandle 7460 -prefMapSize 271090 -jsInitHandle 7448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7492 -initialChannelId {3553c9a3-38ca-4c90-98dd-06025d7be6ec} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
      4⤵
      PID:4320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 36460 -prefMapHandle 5928 -prefMapSize 271090 -jsInitHandle 7548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6396 -initialChannelId {ae8254b2-2791-41c2-907b-f032f5bf01ee} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
      4⤵
      Checks processor information in registry
      PID:2844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 36460 -prefMapHandle 5576 -prefMapSize 271090 -jsInitHandle 6584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6776 -initialChannelId {3588b1ca-304e-47cc-beb3-e3fd0bb8644f} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
      4⤵
      Checks processor information in registry
      PID:7364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 36460 -prefMapHandle 6304 -prefMapSize 271090 -jsInitHandle 6588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {90dbd907-95f4-4de9-b11d-bad1592affbc} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
      4⤵
      Checks processor information in registry
      PID:6172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6836 -prefsLen 36460 -prefMapHandle 5612 -prefMapSize 271090 -jsInitHandle 6616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7708 -initialChannelId {2cd7ed2e-2609-4788-a930-788c8ef50bcf} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
      4⤵
      PID:6844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6356 -prefsLen 36460 -prefMapHandle 7460 -prefMapSize 271090 -jsInitHandle 7748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7696 -initialChannelId {03da5416-9573-4c86-b511-529516b0aefc} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
      4⤵
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 36460 -prefMapHandle 2996 -prefMapSize 271090 -jsInitHandle 7368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7776 -initialChannelId {eb2f9ea7-7203-4a81-84df-fe1f8a65b1c0} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
      4⤵
      Checks processor information in registry
      PID:5396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 36460 -prefMapHandle 7448 -prefMapSize 271090 -jsInitHandle 7696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3260 -initialChannelId {d5d92ded-a35e-4a6c-b3f9-ae2e9fcd21b5} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
      4⤵
      PID:2168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8668 -prefsLen 36460 -prefMapHandle 8672 -prefMapSize 271090 -jsInitHandle 8676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7392 -initialChannelId {be8d24c1-f9ef-4543-952f-cc334b69e629} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
      4⤵
      Checks processor information in registry
      PID:2972
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 36460 -prefMapHandle 8604 -prefMapSize 271090 -jsInitHandle 7784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {d05441a7-602d-4984-b616-2e4038f1e8a1} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
      4⤵
      PID:4520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6804 -prefsLen 36460 -prefMapHandle 8308 -prefMapSize 271090 -jsInitHandle 7588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6388 -initialChannelId {fe7625cd-c8bc-4605-9fba-befce37475fb} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
      4⤵
      Checks processor information in registry
      PID:3216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4660 -prefsLen 36460 -prefMapHandle 6440 -prefMapSize 271090 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7568 -initialChannelId {a7238613-9dd9-4168-8b01-083d83dbe4bc} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
      4⤵
      PID:1952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8564 -prefsLen 36460 -prefMapHandle 8556 -prefMapSize 271090 -jsInitHandle 8540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8528 -initialChannelId {375bfeac-1a6e-41d1-a89f-74789d0f347b} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
      4⤵
      Checks processor information in registry
      PID:1352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8900 -prefsLen 36460 -prefMapHandle 8904 -prefMapSize 271090 -jsInitHandle 8908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8860 -initialChannelId {e06c4262-c484-4cdd-bba7-3c9473442c33} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
      4⤵
      Checks processor information in registry
      PID:7032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 36460 -prefMapHandle 5624 -prefMapSize 271090 -jsInitHandle 8512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7392 -initialChannelId {6bb1d646-7cbf-4a23-8666-1efdd7e3cab2} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
      4⤵
      Checks processor information in registry
      PID:7044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 36460 -prefMapHandle 8444 -prefMapSize 271090 -jsInitHandle 7700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8316 -initialChannelId {7c617b3c-7154-4e88-bb5b-5c1e68b3b98c} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
      4⤵
      Checks processor information in registry
      PID:4812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4852 -prefsLen 36460 -prefMapHandle 5772 -prefMapSize 271090 -jsInitHandle 5936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6600 -initialChannelId {5cc6a149-6ea5-4aeb-ab7b-367180ef9d63} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
      4⤵
      Checks processor information in registry
      PID:3800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8792 -prefsLen 36460 -prefMapHandle 5060 -prefMapSize 271090 -jsInitHandle 4668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3296 -initialChannelId {66270e25-f0ce-4919-8e33-05ffc6adfc20} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
      4⤵
      PID:1060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2620 -prefsLen 36460 -prefMapHandle 7624 -prefMapSize 271090 -jsInitHandle 8488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8548 -initialChannelId {123b669d-9d5e-4a13-807a-126ebd27217c} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
      4⤵
      PID:5856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3260 -prefsLen 36460 -prefMapHandle 6636 -prefMapSize 271090 -jsInitHandle 7472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7380 -initialChannelId {9b1cca31-a6c2-47ab-94ae-1ea583624e0c} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
      4⤵
      PID:5940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9180 -prefsLen 36460 -prefMapHandle 9184 -prefMapSize 271090 -jsInitHandle 9188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9016 -initialChannelId {f449e3e2-7369-4325-9eb1-4eaad080f907} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
      4⤵
      Checks processor information in registry
      PID:5488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9124 -prefsLen 36460 -prefMapHandle 9072 -prefMapSize 271090 -jsInitHandle 9128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8800 -initialChannelId {7d6d0545-8e7a-4316-8e84-3a653607f8aa} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
      4⤵
      Checks processor information in registry
      PID:6536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7616 -prefsLen 36600 -prefMapHandle 7604 -prefMapSize 271090 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {feaca318-9cdf-4218-96ff-3359faefaec2} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
      4⤵
      Checks processor information in registry
      PID:6652
  - - C:\Users\Admin\Downloads\Reader_uk_install.exe
      "C:\Users\Admin\Downloads\Reader_uk_install.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:7040
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 36600 -prefMapHandle 2584 -prefMapSize 271090 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6572 -initialChannelId {912ade4e-dfba-4519-b07a-c9380c8f8383} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
      4⤵
      Checks processor information in registry
      PID:4392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10220 -prefsLen 36600 -prefMapHandle 10216 -prefMapSize 271090 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7392 -initialChannelId {6a3573ac-2ef9-4305-b79e-c13ea9815418} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
      4⤵
      Checks processor information in registry
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9312 -prefsLen 36600 -prefMapHandle 9332 -prefMapSize 271090 -jsInitHandle 9284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6676 -initialChannelId {d9a7b385-dcc0-470d-94c5-ffdc84b68af4} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
      4⤵
      Checks processor information in registry
      PID:1276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6816 -prefsLen 36600 -prefMapHandle 8692 -prefMapSize 271090 -jsInitHandle 6840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2988 -initialChannelId {63569e32-4281-4e44-abb2-3227d6b009e5} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
      4⤵
      Checks processor information in registry
      PID:6640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7940 -prefsLen 36687 -prefMapHandle 2960 -prefMapSize 271090 -jsInitHandle 8556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2620 -initialChannelId {a2aa45ba-fe52-4006-b804-c75d6bd4f6be} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
      4⤵
      PID:1292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10140 -prefsLen 36687 -prefMapHandle 9016 -prefMapSize 271090 -jsInitHandle 6784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4996 -initialChannelId {d2c41d01-9170-4afb-9cd9-b9e976a83460} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
      4⤵
      Checks processor information in registry
      PID:5912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8768 -prefsLen 36687 -prefMapHandle 9320 -prefMapSize 271090 -jsInitHandle 9116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6444 -initialChannelId {5939d818-e0c9-485c-87fc-d65a6a63c61e} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
      4⤵
      PID:4596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9832 -prefsLen 36687 -prefMapHandle 10256 -prefMapSize 271090 -jsInitHandle 8952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {62d3db71-c1fb-46f4-a54a-054137a63def} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
      4⤵
      PID:2772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9176 -prefsLen 36687 -prefMapHandle 7856 -prefMapSize 271090 -jsInitHandle 8548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10640 -initialChannelId {7b900caa-259f-482a-b923-74210df9192d} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab
      4⤵
      Checks processor information in registry
      PID:5248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8964 -prefsLen 36687 -prefMapHandle 10336 -prefMapSize 271090 -jsInitHandle 7968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8428 -initialChannelId {6b71ceb1-bf1f-428b-9f60-974657cf99b7} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab
      4⤵
      PID:2980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11004 -prefsLen 36687 -prefMapHandle 11008 -prefMapSize 271090 -jsInitHandle 11012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {d477f98d-3378-4c9b-9959-bfa6f786ce11} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab
      4⤵
      Checks processor information in registry
      PID:5984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11168 -prefsLen 36687 -prefMapHandle 11244 -prefMapSize 271090 -jsInitHandle 11248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10584 -initialChannelId {f5409d83-faaa-467f-9e4b-f1fd8cf73127} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab
      4⤵
      Checks processor information in registry
      PID:7440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11292 -prefsLen 36687 -prefMapHandle 11296 -prefMapSize 271090 -jsInitHandle 11300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11308 -initialChannelId {60bc8f67-8edc-47de-b94b-f724e595bdf2} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab
      4⤵
      Checks processor information in registry
      PID:7872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11600 -prefsLen 36687 -prefMapHandle 11596 -prefMapSize 271090 -jsInitHandle 11608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11616 -initialChannelId {0b97f4cc-f50a-4ffe-956a-0f27cb72cbd7} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab
      4⤵
      Checks processor information in registry
      PID:5060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11192 -prefsLen 36687 -prefMapHandle 11896 -prefMapSize 271090 -jsInitHandle 11900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7480 -initialChannelId {4a19db73-f192-45df-b690-396213575e9d} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab
      4⤵
      PID:6228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12104 -prefsLen 36687 -prefMapHandle 12108 -prefMapSize 271090 -jsInitHandle 12112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12036 -initialChannelId {2836572d-67fc-4afc-a364-ad5b1f910235} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab
      4⤵
      Checks processor information in registry
      PID:7512
  - - C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe
      "C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2844
    - - C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe
        
        "C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe" /UAC:100110 /NCRC
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe" Sel=1&Partner=3762&Extension=caboggillkkpgkiokbjmgldfkedbfnpkgadakcdl&Name=Buff%20Achievement%20Tracker&Thanks=https%3A%2F%2Fbuff.game%2Fthank-you-page%2F&UtmSource=Buff_Affiliate&UtmMedium=Avi&UtmCampaign=AdMaven_minecraft&UtmTerm=227497311878625278&UtmContent=affpoints&Extra=48d3cd864378465c92e1d01bf9ae11d6&Browser=firefox -partnerCustomizationLevel 0 --app-name="Buff" -exepath C:\Users\Admin\Downloads\Buff Achievement Tracker - Installer.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Direct Volume Access: Opens a physical disk for reading
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:7668
      - C:\Windows\System32\DxDiag.exe
        
        "C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml
        6⤵
        Drops file in System32 directory
        Checks SCSI registry key(s)
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=7668.7088.16551064505493561549
        6⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3808
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x134,0x7ff83ce3b078,0x7ff83ce3b084,0x7ff83ce3b090
        7⤵
        
        PID:2468
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1676,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
        7⤵
        
        PID:388
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:3
        7⤵
        
        PID:4124
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2304,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
        7⤵
        
        PID:4964
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
        7⤵
        
        PID:6516
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4176,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
        7⤵
        
        PID:3328
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4344,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
        7⤵
        
        PID:5160
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4256,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
        7⤵
        
        PID:6036
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsgD9C9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.315.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2640,i,16821135490550579637,9172529239808891516,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:8
        7⤵
        
        PID:1812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 11820 -prefsLen 40373 -prefMapHandle 9016 -prefMapSize 271090 -ipcHandle 11340 -initialChannelId {17955cf5-80f0-4056-a9e8-5c8c9411a425} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 gpu
      4⤵
      PID:6688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7648 -prefsLen 36687 -prefMapHandle 5300 -prefMapSize 271090 -jsInitHandle 11500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7796 -initialChannelId {539a5004-eb6e-4fce-aa07-8d19335cf851} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab
      4⤵
      Checks processor information in registry
      PID:4688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 36687 -prefMapHandle 11784 -prefMapSize 271090 -jsInitHandle 9984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4068 -initialChannelId {632d0279-5a00-4595-83fb-968aea0926d7} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab
      4⤵
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9716 -prefsLen 36687 -prefMapHandle 10444 -prefMapSize 271090 -jsInitHandle 10540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10400 -initialChannelId {cb2fc3cb-f09c-4b41-8cd7-1d5bd8b4360e} -parentPid 4056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab
      4⤵
      PID:8356
- C:\Users\Admin\Downloads\Glacier\glaicer.exe
  "C:\Users\Admin\Downloads\Glacier\glaicer.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  PID:8732
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:8896
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:8916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:8928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:8940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:8948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    PID:6248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:8960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:8520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless
    3⤵
    PID:6428
- C:\Users\Admin\Downloads\Glacier\laubcher.exe
  "C:\Users\Admin\Downloads\Glacier\laubcher.exe"
  2⤵
  - Drops file in Program Files directory
  PID:8804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85767c728,0x7ff85767c734,0x7ff85767c740
    3⤵
    PID:9136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,4285305614511292344,13895872323515142921,262144 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,11567304719192748130,17648342443841967083,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,5707549159874022752,300695544137425478,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,333852780937492682,10625377599929369337,2097152 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:7948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,198005014393230988,16694267513390657139,2097152 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:8640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,10405775260279301717,10700686262997761932,2097152 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=4372 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,17878795408747063075,17017542187960230463,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:8168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,13433367168168143285,2015023223972911261,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:9292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,258657025052812116,9658834674815691040,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    PID:9288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,11408238745690490779,18422555952018435927,524288 --field-trial-handle=1984,i,7297605001233323538,14718718717473282664,262144 --variations-seed-version=20261101-030049.620000-production --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:7928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x2f0,0x7ff84884c188,0x7ff84884c194,0x7ff84884c1a0
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,1883547044233165090,3396235201501842609,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,6863792228374663471,8223858705031224870,262144 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:2
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,3125008023292421292,11183242844473659133,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8966106290726340006,4170342248368198361,2097152 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13175049943938393055,14209961453721849763,2097152 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,15070778628641049078,5020813619285125424,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,8480154808046179232,11145498703206263166,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,18269814758134585424,17224420527260961612,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:8320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,6070999760418100062,9712335592731292289,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:7616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,6016189372873488896,11620555103568831899,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:8116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,6016189372873488896,11620555103568831899,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17198294868128550975,12247485567065287475,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4640387280696584323,4636771620919628643,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
    3⤵
    PID:8276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,110159769860435795,6655894405083333287,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
    3⤵
    PID:11192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,16319851198134780073,4037189881025549098,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
    3⤵
    PID:11200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,2129994096593423679,16403723131262687071,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,13201475547498917801,16972534336075247857,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,4608467538802455216,10381471540658490672,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
    3⤵
    PID:8564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18049974225584324845,17983694233505395494,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:9388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,4918925720401406611,7301360949419815189,524288 --field-trial-handle=2000,i,16603492001744109824,17326462812775719806,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
    3⤵
    PID:1492
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:8876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    PID:8908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 31840 -prefMapHandle 2044 -prefMapSize 271318 -ipcHandle 2132 -initialChannelId {d385c396-36b8-47d5-8b33-f8e7b907a056} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 31840 -prefMapHandle 2404 -prefMapSize 271318 -ipcHandle 2420 -initialChannelId {79be39cc-edae-46ae-a403-cf8c89f5f290} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 32448 -prefMapHandle 3876 -prefMapSize 271318 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {03b4e9e1-a77d-45ea-9e09-b09099ecdb31} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      PID:5260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4112 -prefsLen 32448 -prefMapHandle 4116 -prefMapSize 271318 -ipcHandle 4124 -initialChannelId {28a54464-fe77-4fe3-a621-dd75a02878b5} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3244 -prefsLen 39947 -prefMapHandle 1496 -prefMapSize 271318 -jsInitHandle 2940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2704 -initialChannelId {c965d195-2990-459e-b4af-44510cf04d96} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:7824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5008 -prefsLen 40001 -prefMapHandle 5012 -prefMapSize 271318 -ipcHandle 4960 -initialChannelId {0579eb63-0dce-4bd4-bb6c-73c17954dc5f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      PID:2424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 36315 -prefMapHandle 5256 -prefMapSize 271318 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4984 -initialChannelId {0179cdd3-1544-4d76-81d3-81bf9047caa7} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:8520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5740 -prefsLen 36367 -prefMapHandle 5744 -prefMapSize 271318 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3380 -initialChannelId {1629f43e-2280-46d9-820e-4252d3831fd8} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:7756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 36367 -prefMapHandle 5916 -prefMapSize 271318 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {66832a70-e0f4-4785-b8d7-48f16e0c3391} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6096 -prefsLen 36367 -prefMapHandle 6100 -prefMapSize 271318 -jsInitHandle 6104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {c5b6f587-5efe-440b-aa88-bf6706f7a212} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      PID:8200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4600 -prefsLen 36367 -prefMapHandle 6352 -prefMapSize 271318 -jsInitHandle 6356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3380 -initialChannelId {1610d769-347c-4d35-aaea-5c0dadedfd06} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:9116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6552 -prefsLen 36367 -prefMapHandle 6592 -prefMapSize 271318 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {85bf1065-676d-4a36-9add-a45b31d37363} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:7088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6808 -prefsLen 36367 -prefMapHandle 6812 -prefMapSize 271318 -jsInitHandle 6816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6592 -initialChannelId {ba9823b4-9503-449b-b093-c30a0a15b568} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      PID:5888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 36367 -prefMapHandle 5296 -prefMapSize 271318 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {6ddd8411-376f-4bf5-897c-ff178ab0aa5a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
      4⤵
      PID:3024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1476 -prefsLen 36367 -prefMapHandle 4068 -prefMapSize 271318 -jsInitHandle 4508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6136 -initialChannelId {12bc8fff-f4f1-4d6b-aca0-437235a81226} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
      4⤵
      PID:7332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7124 -prefsLen 36367 -prefMapHandle 7128 -prefMapSize 271318 -jsInitHandle 7132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7140 -initialChannelId {ff2f0ea6-268f-47a2-a1fc-e47da5489886} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
      4⤵
      Checks processor information in registry
      PID:7700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7324 -prefsLen 36367 -prefMapHandle 7328 -prefMapSize 271318 -jsInitHandle 7332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7340 -initialChannelId {9421ee01-4242-487e-ad47-a03fd8e6c3d7} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
      4⤵
      PID:6508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7520 -prefsLen 36367 -prefMapHandle 7524 -prefMapSize 271318 -jsInitHandle 7528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7536 -initialChannelId {cc6ce605-eccb-4864-a085-30cd41a846fa} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
      4⤵
      PID:6140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7724 -prefsLen 36367 -prefMapHandle 7728 -prefMapSize 271318 -jsInitHandle 7732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7696 -initialChannelId {999a7b69-d681-407a-ad30-a7c1908fafb5} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
      4⤵
      PID:4600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7916 -prefsLen 36367 -prefMapHandle 7920 -prefMapSize 271318 -jsInitHandle 7924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7928 -initialChannelId {341a0ddb-a293-4923-b6c0-9d9d1113e42f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
      4⤵
      PID:1668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8120 -prefsLen 36367 -prefMapHandle 8124 -prefMapSize 271318 -jsInitHandle 8128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8136 -initialChannelId {a8d629f5-597d-4584-9a30-9b6ea7caef05} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
      4⤵
      Checks processor information in registry
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8320 -prefsLen 36367 -prefMapHandle 8324 -prefMapSize 271318 -jsInitHandle 8328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8336 -initialChannelId {e043410f-6ca0-49de-9670-0e1d8ccd993d} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
      4⤵
      PID:5268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8524 -prefsLen 36367 -prefMapHandle 8528 -prefMapSize 271318 -jsInitHandle 8532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8496 -initialChannelId {a9f7b90b-c3a0-4bc4-a583-67d0c1bffce1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
      4⤵
      Checks processor information in registry
      PID:4544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8524 -prefsLen 36367 -prefMapHandle 8560 -prefMapSize 271318 -jsInitHandle 8548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8736 -initialChannelId {ad63d4cf-fdec-465d-9e1d-03aa0ebb093b} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
      4⤵
      PID:3712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8908 -prefsLen 36367 -prefMapHandle 8912 -prefMapSize 271318 -jsInitHandle 8916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8924 -initialChannelId {0abb69c4-6f18-49a0-886d-30dccc74317d} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
      4⤵
      PID:7324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9104 -prefsLen 36367 -prefMapHandle 9108 -prefMapSize 271318 -jsInitHandle 9112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9120 -initialChannelId {071c3033-4b20-43d1-a129-ce10a15f1ae6} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
      4⤵
      PID:4460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9304 -prefsLen 36367 -prefMapHandle 9308 -prefMapSize 271318 -jsInitHandle 9312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9320 -initialChannelId {0cfd6538-deba-4f73-8b1e-c83b6b1997e2} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
      4⤵
      PID:8368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9508 -prefsLen 36367 -prefMapHandle 9512 -prefMapSize 271318 -jsInitHandle 9516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9480 -initialChannelId {097ab891-4cca-4e78-ae6b-25129d706cbe} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
      4⤵
      Checks processor information in registry
      PID:3332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9696 -prefsLen 36367 -prefMapHandle 9700 -prefMapSize 271318 -jsInitHandle 9704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9712 -initialChannelId {3cca5150-c693-4c98-bb1c-53f8150a28ae} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
      4⤵
      PID:4036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9892 -prefsLen 36367 -prefMapHandle 9896 -prefMapSize 271318 -jsInitHandle 9900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9908 -initialChannelId {c0eeda89-071c-4e10-bd15-2b12eeb6b7b6} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
      4⤵
      PID:64
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10088 -prefsLen 36367 -prefMapHandle 10092 -prefMapSize 271318 -jsInitHandle 10096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10104 -initialChannelId {8b5e2366-e319-4609-92bc-5ea406d512c0} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
      4⤵
      PID:8272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10288 -prefsLen 36367 -prefMapHandle 10292 -prefMapSize 271318 -jsInitHandle 10296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10304 -initialChannelId {35eaaa91-cfdb-4208-833c-5b84ef34374d} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
      4⤵
      PID:4372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10484 -prefsLen 36367 -prefMapHandle 10488 -prefMapSize 271318 -jsInitHandle 10492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10500 -initialChannelId {0340878c-4f11-4522-96e2-39a2752ae708} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
      4⤵
      PID:1792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10680 -prefsLen 36367 -prefMapHandle 10684 -prefMapSize 271318 -jsInitHandle 10688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10696 -initialChannelId {29f1b71c-6b8a-4312-a1ab-a1f1ec9a46a6} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
      4⤵
      PID:6072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10876 -prefsLen 36367 -prefMapHandle 10880 -prefMapSize 271318 -jsInitHandle 10884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10892 -initialChannelId {7235a7d3-90f9-43f5-b5ee-ff771087fd13} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
      4⤵
      PID:7068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11080 -prefsLen 36367 -prefMapHandle 11084 -prefMapSize 271318 -jsInitHandle 11088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11052 -initialChannelId {95a8bf88-9d5c-4b3b-94c8-2725b578ddf8} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
      4⤵
      PID:6260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11272 -prefsLen 36367 -prefMapHandle 11276 -prefMapSize 271318 -jsInitHandle 11280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11288 -initialChannelId {4f03313d-bf9e-42ba-b579-e8f5652400b7} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
      4⤵
      PID:2880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11468 -prefsLen 36367 -prefMapHandle 11472 -prefMapSize 271318 -jsInitHandle 11476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11484 -initialChannelId {9efa5842-a900-4b62-a48d-5b65cbbeebab} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
      4⤵
      PID:8316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11664 -prefsLen 36367 -prefMapHandle 11668 -prefMapSize 271318 -jsInitHandle 11672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11680 -initialChannelId {9bea6f20-26d9-4b20-a2b1-403e2354fce0} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
      4⤵
      PID:8600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11860 -prefsLen 36367 -prefMapHandle 11864 -prefMapSize 271318 -jsInitHandle 11868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11876 -initialChannelId {34591ef4-9b27-4ba3-9bc4-2c3ad7f6b4cf} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
      4⤵
      PID:8292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12056 -prefsLen 36367 -prefMapHandle 12060 -prefMapSize 271318 -jsInitHandle 12064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12072 -initialChannelId {6db36ae7-7a61-4d1f-bdc4-b1a562253151} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
      4⤵
      PID:8300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12252 -prefsLen 36367 -prefMapHandle 12256 -prefMapSize 271318 -jsInitHandle 12260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12268 -initialChannelId {3330f8ed-4fe8-4a11-afa5-7a9d024f9d82} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
      4⤵
      PID:7296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12452 -prefsLen 36367 -prefMapHandle 12456 -prefMapSize 271318 -jsInitHandle 12460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12468 -initialChannelId {90ed1dd9-4422-42da-9b7c-b98b38e67281} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
      4⤵
      PID:9028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12648 -prefsLen 36367 -prefMapHandle 12652 -prefMapSize 271318 -jsInitHandle 12656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12664 -initialChannelId {b0c2da8a-5cdd-4882-a5e9-9d13e3445bd8} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
      4⤵
      PID:3404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12844 -prefsLen 36367 -prefMapHandle 12848 -prefMapSize 271318 -jsInitHandle 12852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12860 -initialChannelId {8dbebb2e-7fc7-4c58-a199-69f4934f5eca} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
      4⤵
      PID:7356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13040 -prefsLen 36367 -prefMapHandle 13044 -prefMapSize 271318 -jsInitHandle 13048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13056 -initialChannelId {7274523d-a691-472b-a17a-f5d4efd0cd56} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
      4⤵
      PID:1348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13236 -prefsLen 36367 -prefMapHandle 13240 -prefMapSize 271318 -jsInitHandle 13244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13252 -initialChannelId {95cefd91-97ee-4d56-ac75-e31db31f6e22} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
      4⤵
      PID:1720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13436 -prefsLen 36367 -prefMapHandle 13440 -prefMapSize 271318 -jsInitHandle 13444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13452 -initialChannelId {b8ecc324-f895-4229-bdfa-0fd7c09baa82} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
      4⤵
      PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13632 -prefsLen 36367 -prefMapHandle 13636 -prefMapSize 271318 -jsInitHandle 13640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13648 -initialChannelId {755e120a-2b13-4359-a72f-d3f5f7660421} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
      4⤵
      PID:6504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13804 -prefsLen 36367 -prefMapHandle 13808 -prefMapSize 271318 -jsInitHandle 13812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13820 -initialChannelId {189866e6-5cee-4c9a-9c06-d211e354f49c} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
      4⤵
      PID:7976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14000 -prefsLen 36367 -prefMapHandle 14004 -prefMapSize 271318 -jsInitHandle 14008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14016 -initialChannelId {0afbe5d1-7121-4caf-b3a8-059c1fb4e005} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
      4⤵
      PID:8980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14196 -prefsLen 36367 -prefMapHandle 14200 -prefMapSize 271318 -jsInitHandle 14204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14212 -initialChannelId {3743bf58-c717-46dd-974a-444fbdc6b288} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
      4⤵
      PID:7412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14372 -prefsLen 36367 -prefMapHandle 14376 -prefMapSize 271318 -jsInitHandle 14380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14388 -initialChannelId {fe0beeb0-9c60-4cbb-838f-fb87c168eeb7} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab
      4⤵
      PID:4292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14576 -prefsLen 36367 -prefMapHandle 14580 -prefMapSize 271318 -jsInitHandle 14584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14548 -initialChannelId {d30c68f9-f406-4a6b-972d-67cd855d3ab1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab
      4⤵
      PID:7720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14764 -prefsLen 36367 -prefMapHandle 14768 -prefMapSize 271318 -jsInitHandle 14772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14780 -initialChannelId {5105b7fa-fe83-45fa-a114-d1ffd8dc7ed1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab
      4⤵
      PID:7556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14968 -prefsLen 36367 -prefMapHandle 14972 -prefMapSize 271318 -jsInitHandle 14976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14984 -initialChannelId {444310f9-4355-454e-bbd5-e3d8e1e32800} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab
      4⤵
      PID:9200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15156 -prefsLen 36367 -prefMapHandle 15160 -prefMapSize 271318 -jsInitHandle 15164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15172 -initialChannelId {82037bb8-3dfb-4c68-9272-933e321a9d02} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab
      4⤵
      PID:5896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15340 -prefsLen 36367 -prefMapHandle 15344 -prefMapSize 271318 -jsInitHandle 15348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15356 -initialChannelId {d7af7e1b-2103-4562-ae4c-0a9fd3c1eee5} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab
      4⤵
      PID:4608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6388 -prefsLen 36367 -prefMapHandle 6392 -prefMapSize 271318 -jsInitHandle 6376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15960 -initialChannelId {b80a82af-01b4-486c-ba4f-e1af8e1f4ec8} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab
      4⤵
      PID:5748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7460 -prefsLen 36367 -prefMapHandle 7456 -prefMapSize 271318 -jsInitHandle 7356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7492 -initialChannelId {8a7755e4-f312-40f7-a3d6-76e8d7e669da} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab
      4⤵
      PID:6844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6804 -prefsLen 36367 -prefMapHandle 2964 -prefMapSize 271318 -jsInitHandle 1856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {4687b634-adf5-4291-a2e3-f14141979801} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 tab
      4⤵
      PID:3320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16268 -prefsLen 36367 -prefMapHandle 16272 -prefMapSize 271318 -jsInitHandle 16276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16284 -initialChannelId {1e5baa39-deba-43bb-9f70-4de1bd31afe3} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab
      4⤵
      PID:6644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7084 -prefsLen 36367 -prefMapHandle 7080 -prefMapSize 271318 -jsInitHandle 7076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16368 -initialChannelId {02356ba1-024d-40c7-9f4b-a2b62b8db248} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab
      4⤵
      PID:9020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16448 -prefsLen 36367 -prefMapHandle 16452 -prefMapSize 271318 -jsInitHandle 16456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16464 -initialChannelId {e82c04a1-b676-4fe3-804d-2c62b1b4329f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab
      4⤵
      PID:8524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7288 -prefsLen 36367 -prefMapHandle 7284 -prefMapSize 271318 -jsInitHandle 7280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7272 -initialChannelId {0e41239b-b860-4629-9875-0c829d1295eb} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 65 tab
      4⤵
      PID:6248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9516 -prefsLen 36367 -prefMapHandle 9508 -prefMapSize 271318 -jsInitHandle 16604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16624 -initialChannelId {b85c0888-f2b0-4401-820a-00530ae3127a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 66 tab
      4⤵
      PID:4024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9852 -prefsLen 36367 -prefMapHandle 9848 -prefMapSize 271318 -jsInitHandle 9844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9532 -initialChannelId {52c70575-c64d-479d-b238-4b70c0e6bd17} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 67 tab
      4⤵
      PID:7044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7520 -prefsLen 36367 -prefMapHandle 7524 -prefMapSize 271318 -jsInitHandle 7528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16820 -initialChannelId {43377b6d-8a64-4b13-8688-833ac6b89969} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 68 tab
      4⤵
      PID:1196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16944 -prefsLen 36367 -prefMapHandle 16948 -prefMapSize 271318 -jsInitHandle 16952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16960 -initialChannelId {eb9d27c3-c6d4-4efa-bf51-f9f5d7b040cf} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 69 tab
      4⤵
      PID:2804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7872 -prefsLen 36367 -prefMapHandle 7868 -prefMapSize 271318 -jsInitHandle 7864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7852 -initialChannelId {c7602c6e-2345-4645-b207-b81adc411a7f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 70 tab
      4⤵
      PID:3924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10840 -prefsLen 36367 -prefMapHandle 10836 -prefMapSize 271318 -jsInitHandle 10832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10828 -initialChannelId {897b5196-d630-4869-848a-aedc9e7fa619} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 71 tab
      4⤵
      PID:6288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11500 -prefsLen 36367 -prefMapHandle 11512 -prefMapSize 271318 -jsInitHandle 11468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11476 -initialChannelId {803a715d-abf3-4de1-8c5d-36114289596b} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 72 tab
      4⤵
      PID:7884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17224 -prefsLen 36367 -prefMapHandle 17228 -prefMapSize 271318 -jsInitHandle 17232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17240 -initialChannelId {fee3f8bd-9c17-4297-b728-5e6a49c767ca} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 73 tab
      4⤵
      PID:4344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17424 -prefsLen 36367 -prefMapHandle 17428 -prefMapSize 271318 -jsInitHandle 17432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17440 -initialChannelId {976ed940-c97e-41bd-9126-bdeacc3a2b35} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 74 tab
      4⤵
      PID:692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17620 -prefsLen 36367 -prefMapHandle 17624 -prefMapSize 271318 -jsInitHandle 17628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17636 -initialChannelId {a013607e-41c2-4906-b726-206b82737d5a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 75 tab
      4⤵
      PID:6648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17856 -prefsLen 36367 -prefMapHandle 17860 -prefMapSize 271318 -jsInitHandle 17864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17872 -initialChannelId {75a7bc6c-5467-476d-9d36-d67bb192d46c} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 76 tab
      4⤵
      PID:7712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17980 -prefsLen 36367 -prefMapHandle 17984 -prefMapSize 271318 -jsInitHandle 17988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17996 -initialChannelId {61957c6c-94e4-400a-9700-7543dd74215c} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 77 tab
      4⤵
      PID:7136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18204 -prefsLen 36367 -prefMapHandle 18208 -prefMapSize 271318 -jsInitHandle 18212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8104 -initialChannelId {290399c8-63ec-4cc4-ad35-79e3e498b910} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 78 tab
      4⤵
      PID:1624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18340 -prefsLen 36367 -prefMapHandle 18344 -prefMapSize 271318 -jsInitHandle 18348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8116 -initialChannelId {36b23ffe-da56-485a-86c7-bd0e8257f7a9} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 79 tab
      4⤵
      PID:3464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 36367 -prefMapHandle 2668 -prefMapSize 271318 -jsInitHandle 3424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {91e2f711-b31f-4918-99a2-2509f6092130} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 80 tab
      4⤵
      PID:756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18444 -prefsLen 36367 -prefMapHandle 18448 -prefMapSize 271318 -jsInitHandle 18452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18460 -initialChannelId {27feea67-6ab4-4544-8493-3d2760f7fa0a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 81 tab
      4⤵
      PID:6896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18640 -prefsLen 36367 -prefMapHandle 18644 -prefMapSize 271318 -jsInitHandle 18648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18656 -initialChannelId {43433305-8b7a-49dc-b45e-72e1fa55a525} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 82 tab
      4⤵
      PID:3240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 18836 -prefsLen 36367 -prefMapHandle 18840 -prefMapSize 271318 -jsInitHandle 18844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18852 -initialChannelId {34d01cc1-dc48-4642-b000-b7a5849f2ffd} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 83 tab
      4⤵
      PID:2028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19032 -prefsLen 36367 -prefMapHandle 19036 -prefMapSize 271318 -jsInitHandle 19040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19048 -initialChannelId {d7089915-822a-4f55-9fa6-0e521c92cd7a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 84 tab
      4⤵
      PID:7584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19236 -prefsLen 36367 -prefMapHandle 19240 -prefMapSize 271318 -jsInitHandle 19244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19208 -initialChannelId {669d869c-7896-4f1b-a2c7-934ca57d2c82} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 85 tab
      4⤵
      PID:5128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19440 -prefsLen 36367 -prefMapHandle 19444 -prefMapSize 271318 -jsInitHandle 19448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19412 -initialChannelId {17d15862-b803-4381-bf75-64adb45c3535} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 86 tab
      4⤵
      PID:7292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19632 -prefsLen 36367 -prefMapHandle 19636 -prefMapSize 271318 -jsInitHandle 19640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19648 -initialChannelId {40602850-7ac8-4583-998d-a55d067630ee} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 87 tab
      4⤵
      PID:5180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19828 -prefsLen 36367 -prefMapHandle 19832 -prefMapSize 271318 -jsInitHandle 19836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19844 -initialChannelId {34d5b997-c424-410e-8efa-d4336003d067} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 88 tab
      4⤵
      PID:3960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20024 -prefsLen 36367 -prefMapHandle 20028 -prefMapSize 271318 -jsInitHandle 20032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20040 -initialChannelId {f91f38c3-553b-4e3e-b36d-81ce47dae217} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 89 tab
      4⤵
      PID:4556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20220 -prefsLen 36367 -prefMapHandle 20224 -prefMapSize 271318 -jsInitHandle 20228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20236 -initialChannelId {e8cfbdec-4a65-4687-8889-aa5922589773} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 90 tab
      4⤵
      PID:7664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20416 -prefsLen 36367 -prefMapHandle 20420 -prefMapSize 271318 -jsInitHandle 20424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20432 -initialChannelId {702d3e6f-02de-4301-ace6-311b08fc27d1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 91 tab
      4⤵
      PID:8128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20616 -prefsLen 36367 -prefMapHandle 20620 -prefMapSize 271318 -jsInitHandle 20624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20632 -initialChannelId {9bf42915-ccc5-4220-b39c-03280ccc34a1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 92 tab
      4⤵
      PID:5948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20812 -prefsLen 36367 -prefMapHandle 20816 -prefMapSize 271318 -jsInitHandle 20820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20828 -initialChannelId {f735766b-bc27-4260-897c-0b07935321bd} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 93 tab
      4⤵
      PID:460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20988 -prefsLen 36367 -prefMapHandle 21012 -prefMapSize 271318 -jsInitHandle 21016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21024 -initialChannelId {18ca0e6e-d75c-4d42-86f1-983125d2e9dc} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 94 tab
      4⤵
      PID:6904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21204 -prefsLen 36367 -prefMapHandle 21208 -prefMapSize 271318 -jsInitHandle 21212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21220 -initialChannelId {e57a0523-8514-4545-88d7-901532e0ed3f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 95 tab
      4⤵
      PID:1916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21400 -prefsLen 36367 -prefMapHandle 21404 -prefMapSize 271318 -jsInitHandle 21408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21416 -initialChannelId {736464a6-a818-4b54-bf4d-af4356886fb6} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 96 tab
      4⤵
      PID:8016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21600 -prefsLen 36367 -prefMapHandle 21604 -prefMapSize 271318 -jsInitHandle 21608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21616 -initialChannelId {2545bfa3-118e-4a82-a8d7-c91caa2a3118} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 97 tab
      4⤵
      PID:8928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21644 -prefsLen 36367 -prefMapHandle 21632 -prefMapSize 271318 -jsInitHandle 21736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21816 -initialChannelId {1b5804ac-7880-4b6a-ad1e-80fd7720cbd2} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab
      4⤵
      PID:6312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21992 -prefsLen 36367 -prefMapHandle 21996 -prefMapSize 271318 -jsInitHandle 22000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22008 -initialChannelId {cce7f22a-7228-45fe-a083-4ec4f7b92ca0} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 99 tab
      4⤵
      PID:6028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22188 -prefsLen 36367 -prefMapHandle 22192 -prefMapSize 271318 -jsInitHandle 22196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22204 -initialChannelId {3f93dbdf-5445-446e-8174-70643b777903} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 100 tab
      4⤵
      PID:5540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22384 -prefsLen 36367 -prefMapHandle 22388 -prefMapSize 271318 -jsInitHandle 22392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22400 -initialChannelId {d88d4033-f621-4902-92a5-b53fc079fa68} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 101 tab
      4⤵
      PID:8116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22584 -prefsLen 36367 -prefMapHandle 22588 -prefMapSize 271318 -jsInitHandle 22592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22600 -initialChannelId {931d06de-a43a-4c3f-b18f-d90c33ad2e97} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 102 tab
      4⤵
      PID:4956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22780 -prefsLen 36367 -prefMapHandle 22784 -prefMapSize 271318 -jsInitHandle 22788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22796 -initialChannelId {06a9d440-fbe3-47f4-89f7-073511ce11dd} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 103 tab
      4⤵
      PID:1716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22976 -prefsLen 36367 -prefMapHandle 22980 -prefMapSize 271318 -jsInitHandle 22984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22992 -initialChannelId {34db5f27-eb4c-4a3c-9c04-6bbf15923f8a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 104 tab
      4⤵
      PID:8152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23180 -prefsLen 36367 -prefMapHandle 23184 -prefMapSize 271318 -jsInitHandle 23188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23152 -initialChannelId {79edd931-6158-4d93-bc91-1b6c8ac04847} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 105 tab
      4⤵
      PID:7424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23368 -prefsLen 36367 -prefMapHandle 23372 -prefMapSize 271318 -jsInitHandle 23376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23384 -initialChannelId {5f13ccb0-31e1-4a7e-b183-76588bb5de52} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 106 tab
      4⤵
      PID:2156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23568 -prefsLen 36367 -prefMapHandle 23572 -prefMapSize 271318 -jsInitHandle 23576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23584 -initialChannelId {a7e84756-c92e-4843-b6ef-7951db6573c1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 107 tab
      4⤵
      PID:4696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23764 -prefsLen 36367 -prefMapHandle 23768 -prefMapSize 271318 -jsInitHandle 23772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23780 -initialChannelId {1b43e9fc-d435-4e02-981a-a34c1b18a5ee} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 108 tab
      4⤵
      PID:7604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23964 -prefsLen 36367 -prefMapHandle 23968 -prefMapSize 271318 -jsInitHandle 23972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23980 -initialChannelId {fc38b983-fcee-46c7-b34d-93d9494783f4} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 109 tab
      4⤵
      PID:6728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10448 -prefsLen 36367 -prefMapHandle 10444 -prefMapSize 271318 -jsInitHandle 10440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23968 -initialChannelId {cbf6e86e-ba85-4084-9123-2d6eafe8e076} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 110 tab
      4⤵
      PID:3348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24208 -prefsLen 36367 -prefMapHandle 24212 -prefMapSize 271318 -jsInitHandle 24216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24224 -initialChannelId {0618d452-4b85-462b-b9d0-bba0cfc159fa} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 111 tab
      4⤵
      PID:6628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24412 -prefsLen 36367 -prefMapHandle 24416 -prefMapSize 271318 -jsInitHandle 24420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24428 -initialChannelId {353af601-692b-4ff3-bc6c-1ec8a7208f55} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 112 tab
      4⤵
      PID:6852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24604 -prefsLen 36367 -prefMapHandle 24608 -prefMapSize 271318 -jsInitHandle 24612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24620 -initialChannelId {e899fedf-b5d1-4ba0-ae69-ac8de8fbccba} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 113 tab
      4⤵
      PID:2812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24840 -prefsLen 36367 -prefMapHandle 24844 -prefMapSize 271318 -jsInitHandle 24848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24600 -initialChannelId {5dd28191-05c3-4b88-9f87-277d6fe5c64a} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 114 tab
      4⤵
      PID:7580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24996 -prefsLen 36367 -prefMapHandle 25000 -prefMapSize 271318 -jsInitHandle 25004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25012 -initialChannelId {f60fab39-1334-46c7-823c-1e4e09f6d08f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 115 tab
      4⤵
      PID:7576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25192 -prefsLen 36367 -prefMapHandle 25196 -prefMapSize 271318 -jsInitHandle 25200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25208 -initialChannelId {719e715e-8a45-481b-b9c4-b6860fdcc62f} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 116 tab
      4⤵
      PID:7520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25388 -prefsLen 36367 -prefMapHandle 25392 -prefMapSize 271318 -jsInitHandle 25396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25404 -initialChannelId {2ea7bc19-b7bc-4002-828c-1e5a792cfe44} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 117 tab
      4⤵
      PID:7500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12612 -prefsLen 36367 -prefMapHandle 12608 -prefMapSize 271318 -jsInitHandle 12604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25576 -initialChannelId {d678d2c6-d956-4da2-8874-b514d97d2435} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 118 tab
      4⤵
      PID:7464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25628 -prefsLen 36367 -prefMapHandle 25636 -prefMapSize 271318 -jsInitHandle 25640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25648 -initialChannelId {561ccbbb-bc26-4c47-98b1-52c2bbbd3d57} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 119 tab
      4⤵
      Checks processor information in registry
      PID:884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6964 -prefsLen 36367 -prefMapHandle 6940 -prefMapSize 271318 -jsInitHandle 25804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6960 -initialChannelId {ca795a97-c641-4a6e-8d09-a0cf62596464} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 120 tab
      4⤵
      PID:4216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6616 -prefsLen 36367 -prefMapHandle 6628 -prefMapSize 271318 -jsInitHandle 6552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25976 -initialChannelId {97ff9917-80a1-4fb5-81fd-88294654dbd0} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 121 tab
      4⤵
      PID:5388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6828 -prefsLen 36367 -prefMapHandle 6840 -prefMapSize 271318 -jsInitHandle 6920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6908 -initialChannelId {18e082c3-2b8f-4b8b-895c-ff46fd94acee} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 122 tab
      4⤵
      PID:7432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26212 -prefsLen 36367 -prefMapHandle 26216 -prefMapSize 271318 -jsInitHandle 26220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26228 -initialChannelId {ec3346ca-a755-4859-9fdc-521861c26d7e} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 123 tab
      4⤵
      PID:988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26344 -prefsLen 36367 -prefMapHandle 26348 -prefMapSize 271318 -jsInitHandle 26412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26424 -initialChannelId {baa590ec-2127-4d93-af93-a182509a12d1} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 124 tab
      4⤵
      PID:7056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26604 -prefsLen 36367 -prefMapHandle 26608 -prefMapSize 271318 -jsInitHandle 26612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26620 -initialChannelId {16bf934a-751a-4bcd-8d33-e91a1d94c2e4} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 125 tab
      4⤵
      PID:2696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26804 -prefsLen 36367 -prefMapHandle 26808 -prefMapSize 271318 -jsInitHandle 26812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26820 -initialChannelId {270c825a-a1fd-434d-bbe1-f957561870ba} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 126 tab
      4⤵
      PID:2140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27000 -prefsLen 36367 -prefMapHandle 27004 -prefMapSize 271318 -jsInitHandle 27008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27016 -initialChannelId {b64f9f95-6f32-4f05-b3d8-5569bfaefe2d} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 127 tab
      4⤵
      PID:2152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27196 -prefsLen 36367 -prefMapHandle 27200 -prefMapSize 271318 -jsInitHandle 27204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27212 -initialChannelId {41a553bc-3741-4860-839b-5490b6acbccd} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 128 tab
      4⤵
      PID:6940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27392 -prefsLen 36367 -prefMapHandle 27396 -prefMapSize 271318 -jsInitHandle 27400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27408 -initialChannelId {fec65913-e793-469f-94c7-4796f756e413} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 129 tab
      4⤵
      PID:1456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27588 -prefsLen 36367 -prefMapHandle 27592 -prefMapSize 271318 -jsInitHandle 27596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27604 -initialChannelId {85a3b4c2-5c3f-43b1-bcd2-b69a67ee0c4e} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 130 tab
      4⤵
      PID:7392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27788 -prefsLen 36367 -prefMapHandle 27792 -prefMapSize 271318 -jsInitHandle 27796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27804 -initialChannelId {d945063e-630f-4393-af3f-4a89a5aa9345} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 131 tab
      4⤵
      PID:2272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27984 -prefsLen 36367 -prefMapHandle 27988 -prefMapSize 271318 -jsInitHandle 27992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 28000 -initialChannelId {26e7deed-1b7a-49e9-8426-c004955d14e2} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 132 tab
      4⤵
      PID:3316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 28180 -prefsLen 36367 -prefMapHandle 28184 -prefMapSize 271318 -jsInitHandle 28188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 28196 -initialChannelId {6831af76-b87a-4b6d-a43a-6dca5ef7088c} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 133 tab
      4⤵
      PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 28376 -prefsLen 36367 -prefMapHandle 28380 -prefMapSize 271318 -jsInitHandle 28384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 28392 -initialChannelId {c15d8f21-dbea-46ac-b2a5-a8c37c79de98} -parentPid 8908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 134 tab
      4⤵
      PID:2756
- C:\Users\Admin\Downloads\Glacier\laubcher.exe
  "C:\Users\Admin\Downloads\Glacier\laubcher.exe"
  2⤵
  - Drops file in Program Files directory
  PID:6888
- C:\Users\Admin\Downloads\Glacier\glaicer.exe
  "C:\Users\Admin\Downloads\Glacier\glaicer.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  PID:6304
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4716
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5980
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:3432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:1344
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:3600
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    PID:9248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:176
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless
    3⤵
    PID:5840
- C:\Users\Admin\Downloads\Glacier\glaicer.exe
  "C:\Users\Admin\Downloads\Glacier\glaicer.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  PID:10704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:10820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:6092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:1996
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:7776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    PID:7796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:10160
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:8996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless
    3⤵
    PID:9092
- C:\Users\Admin\Downloads\Glacier\laubcher.exe
  "C:\Users\Admin\Downloads\Glacier\laubcher.exe"
  2⤵
  - Drops file in Program Files directory
  PID:9764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E935DAEF69922373F848C7EDCB540CAE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B61165A2139198D981928BE73421A772 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1368
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F053C8D1053CA55AED8651AA779D04B0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3660

C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
"C:\Program Files (x86)\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:8564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:8764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7076

C:\Program Files\Mozilla Firefox\crashreporter.exe
"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8c04e5be-762d-49c8-a252-6586127a39bc.dmp"
1⤵
PID:11068
- C:\Windows\system32\curl.exe
  "curl" --user-agent crashreporter/1.0.0 --header "Date: Mon, 02 Nov 2026 07:05:34 GMT" --header "X-Telemetry-Agent: Glean/63.0.0 (Rust on Windows)" --header "Content-Encoding: gzip" --header "Content-Type: application/json; charset=utf-8" --header "Content-Length: 833" --data-binary @- https://incoming.telemetry.mozilla.org/submit/firefox-crashreporter/crash/1/dea94bf0-50df-4814-aa38-63d9396d6a6f
  2⤵
  PID:9340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:9624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5264

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:9276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:9128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2d0,0x7ff84884c188,0x7ff84884c194,0x7ff84884c1a0
    3⤵
    PID:10408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,18298162397591361405,16688498259922651062,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,295832412696111661,16464603283820172317,262144 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,14022668570096506357,12138619819323246562,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17856630675159500142,6195453343306913515,2097152 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,17774205611610651877,827383775683558632,2097152 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4764,i,5432591915434508456,1639208361796831331,2097152 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:10528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3744,i,4572236268212225100,18403953467918256362,2097152 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:10184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,10581245694294644457,5803085612740358358,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,14033283900608648590,4160146566639252262,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:10844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17264036680305942416,9304829150463604571,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    PID:11132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17264036680305942416,9304829150463604571,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    PID:11108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,2522947282499724837,1440128837803568891,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,6876040692588072585,17803320555513024430,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:11036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,8639957041304002581,1861209684720270980,524288 --field-trial-handle=2348,i,6953955683060563526,1382678481973362812,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff84884c188,0x7ff84884c194,0x7ff84884c1a0
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9022487580045529488,9253333803187373124,262144 --field-trial-handle=2280,i,14290748363779093650,17226477535377208251,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,16159313510809881354,2285211735785179239,524288 --field-trial-handle=2280,i,14290748363779093650,17226477535377208251,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      System Time Discovery
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,5140387819096988981,974501379957942413,524288 --field-trial-handle=2280,i,14290748363779093650,17226477535377208251,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,5406161049303514912,14276475065191687777,524288 --field-trial-handle=2280,i,14290748363779093650,17226477535377208251,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,5406161049303514912,14276475065191687777,524288 --field-trial-handle=2280,i,14290748363779093650,17226477535377208251,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
      4⤵
      PID:6640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery