Analysis
- user interaction
yes - max time kernel
845s - max time network
843s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
07/11/2026, 11:21
General
- Target 2026-11-07_a8a45dc809a6204e4e36b840fe862306_dosia_glassworm_poet-rat_qnapcrypt
- Size 7.4MB
- Sample261107-nf2tdaxt5p
- SHA256 c9a6bd849ef72bbe1814838b52764f77b0ad31cc9c754e42224ff723cce3d340
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 3 IoCs
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 28 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Uses WMI to collect hardware manufacturer information 2 TTPs 2 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
- Drops file in System32 directory 24 IoCs
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs
Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.
- Queries system WMI classes for hardware identifiers 2 TTPs 4 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 13 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 3 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 8 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\2026-11-07_a8a45dc809a6204e4e36b840fe862306_dosia_glassworm_poet-rat_qnapcrypt1⤵
- Executes a command shell one-liner
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27100 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {ede5fa1c-7dd1-415b-8261-209a9494042a} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27136 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {be519c2c-5a88-4bff-b95c-fc50a253d051} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4040 -prefsLen 27277 -prefMapHandle 4044 -prefMapSize 270279 -jsInitHandle 4048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4056 -initialChannelId {41ab9840-e403-4041-8c3c-6ed31b0ca2bc} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4216 -prefsLen 27277 -prefMapHandle 4220 -prefMapSize 270279 -ipcHandle 4228 -initialChannelId {49375c16-0beb-4887-9bac-d2e6defade8b} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 34830 -prefMapHandle 1680 -prefMapSize 270279 -jsInitHandle 3372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4528 -initialChannelId {47579a4a-f688-4012-9786-112380ea6290} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35013 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 5100 -initialChannelId {3a9cd7a2-be0a-4422-91d9-7978d4534479} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32900 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {72643f20-3b1d-4e5e-9cc8-aa27966b1d11} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32900 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {b0ec8338-fb60-48a4-b8e5-bd1079f43c1a} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {b067442f-4bd8-4499-aaec-0064b5a023c7} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 33071 -prefMapHandle 1380 -prefMapSize 270279 -jsInitHandle 2852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6464 -initialChannelId {c9ee3a03-7755-4516-b2f7-386de0348baf} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6184 -prefsLen 36885 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {1a55bfc1-f8e1-483b-9d56-533212027624} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 36885 -prefMapHandle 6136 -prefMapSize 270279 -jsInitHandle 7020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4804 -initialChannelId {d6063b0b-8149-45bf-85b2-8ee7490d9378} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6260 -prefsLen 36885 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6476 -initialChannelId {a2fb18dd-20fc-46db-bc52-201019c75b63} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7188 -prefsLen 36885 -prefMapHandle 7192 -prefMapSize 270279 -jsInitHandle 7196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7152 -initialChannelId {fef6c359-b882-4c72-ab80-afb292369c46} -parentPid 5256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
-
-
C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x490 0x2f41⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Downloads\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\pcwrun.exeC:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe" CompatTab1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msdt.exeC:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW4305.xml /skip TRUE2⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\en2re0ux\en2re0ux.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES472C.tmp" "c:\Users\Admin\AppData\Local\Temp\en2re0ux\CSC2AC235DBCEB4283BBCFB0E678CCABC7.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yk1usirr\yk1usirr.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47A9.tmp" "c:\Users\Admin\AppData\Local\Temp\yk1usirr\CSCEE5979063B0A47BDA86F2051A561502A.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ida1ms0x\ida1ms0x.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B33.tmp" "c:\Users\Admin\AppData\Local\Temp\ida1ms0x\CSC1ADD759334D34B20AA90950F7697378.TMP"3⤵
-
-
-
C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"C:\Users\Admin\Desktop\YouAreAnIdiot-UnFlash.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2044 -prefsLen 31276 -prefMapHandle 2052 -prefMapSize 270978 -ipcHandle 2124 -initialChannelId {6b168809-6748-478f-b9f6-5eb3fc6658a4} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2376 -prefsLen 31276 -prefMapHandle 2380 -prefMapSize 270978 -ipcHandle 2396 -initialChannelId {c0d5d6da-78bc-4d0a-aaba-719c602af8a9} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 31835 -prefMapHandle 3752 -prefMapSize 270978 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {a81d68eb-3c99-4d17-947c-ec053b02e1ee} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 31835 -prefMapHandle 3940 -prefMapSize 270978 -ipcHandle 3948 -initialChannelId {803f4628-42c7-4115-91cf-61254211ce7c} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4644 -prefsLen 39334 -prefMapHandle 4648 -prefMapSize 270978 -jsInitHandle 4652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4616 -initialChannelId {cb292fda-f2a6-462c-8857-f7114034090b} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3116 -prefsLen 39490 -prefMapHandle 4980 -prefMapSize 270978 -ipcHandle 5000 -initialChannelId {dd9c1862-bbdc-4bee-bc99-a55b8825594b} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 36402 -prefMapHandle 5360 -prefMapSize 270978 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4920 -initialChannelId {5b012d8f-6d95-46ff-bbfb-91a0d61736f7} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 36402 -prefMapHandle 5484 -prefMapSize 270978 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {b53acb7c-9a10-4f30-9e42-65ecaa62b10d} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 36402 -prefMapHandle 5788 -prefMapSize 270978 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {be71296f-4f02-4aca-9069-3dbd09b114e4} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6348 -prefsLen 36442 -prefMapHandle 6352 -prefMapSize 270978 -jsInitHandle 6356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5956 -initialChannelId {4cc711a1-9531-47d1-9302-d4a7dc50d569} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 4772 -prefsLen 39582 -prefMapHandle 4776 -prefMapSize 270978 -ipcHandle 6468 -initialChannelId {91aa4340-90d9-4d7e-9644-91adacb3ef4a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6652 -prefsLen 36442 -prefMapHandle 6656 -prefMapSize 270978 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6568 -initialChannelId {4cdd41e4-ba8c-4eb1-85ec-8f7d713e69fb} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6880 -prefsLen 36442 -prefMapHandle 6884 -prefMapSize 270978 -jsInitHandle 6888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6828 -initialChannelId {b7065132-7e68-465d-a20c-9849cb88f3ff} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6128 -prefsLen 39582 -prefMapHandle 5600 -prefMapSize 270978 -ipcHandle 7172 -initialChannelId {1cccfc68-d789-4ff3-a67e-93070739e771} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7352 -prefsLen 36442 -prefMapHandle 7376 -prefMapSize 270978 -jsInitHandle 7380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7388 -initialChannelId {e27b5342-feee-4c4c-a411-e00aae3b5880} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 36442 -prefMapHandle 5080 -prefMapSize 270978 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3008 -initialChannelId {bd45d138-c66b-4807-975e-cb38cd3d9b79} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7604 -prefsLen 36442 -prefMapHandle 7612 -prefMapSize 270978 -jsInitHandle 7608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6520 -initialChannelId {46dbc1f2-8b14-4973-bd03-904e79ef10a8} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6912 -prefsLen 36442 -prefMapHandle 6996 -prefMapSize 270978 -jsInitHandle 6980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2996 -initialChannelId {e73910ab-3f56-4a13-a617-690f738d677f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6452 -prefsLen 36442 -prefMapHandle 7164 -prefMapSize 270978 -jsInitHandle 6780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {e7dca11a-2212-478c-9ce5-b44fcc1f505f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8428 -prefsLen 36442 -prefMapHandle 8432 -prefMapSize 270978 -jsInitHandle 8436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2852 -initialChannelId {823c2950-7276-4d6c-a8e4-645083c1e6f5} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8448 -prefsLen 36442 -prefMapHandle 8444 -prefMapSize 270978 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {85632f96-5be3-40b6-882a-4a56f354bc34} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6428 -prefsLen 36442 -prefMapHandle 6808 -prefMapSize 270978 -jsInitHandle 7884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6420 -initialChannelId {4c72d509-b68c-421a-8578-7dae1967953a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 36442 -prefMapHandle 7004 -prefMapSize 270978 -jsInitHandle 7132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6468 -initialChannelId {a6e2403b-74a6-4e00-af40-928b0bb4ac95} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8912 -prefsLen 36442 -prefMapHandle 8892 -prefMapSize 270978 -jsInitHandle 8872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8904 -initialChannelId {c3c5f611-93f9-40b5-9677-797ebc5b646a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7096 -prefsLen 36442 -prefMapHandle 6892 -prefMapSize 270978 -jsInitHandle 6936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6924 -initialChannelId {509e4750-f279-4db7-b201-4860c1c9aa75} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8872 -prefsLen 36442 -prefMapHandle 9040 -prefMapSize 270978 -jsInitHandle 9052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6920 -initialChannelId {f916c17c-ca20-4972-87c5-738e0035da13} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9024 -prefsLen 36442 -prefMapHandle 9028 -prefMapSize 270978 -jsInitHandle 9012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8892 -initialChannelId {f5894a59-fe0e-43f8-a563-fe0886ba9f98} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9128 -prefsLen 36442 -prefMapHandle 9024 -prefMapSize 270978 -jsInitHandle 9028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7132 -initialChannelId {df456773-df91-427f-a526-08e013f1222d} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9176 -prefsLen 36442 -prefMapHandle 9164 -prefMapSize 270978 -jsInitHandle 9028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8400 -initialChannelId {7eaf1b4c-6ec1-4edf-81e2-4518e5c1bc44} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8872 -prefsLen 36442 -prefMapHandle 9616 -prefMapSize 270978 -jsInitHandle 3168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8344 -initialChannelId {4b692c2b-a08c-4a7d-901a-018b7f8549c3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8472 -prefsLen 36442 -prefMapHandle 8380 -prefMapSize 270978 -jsInitHandle 6468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6392 -initialChannelId {9ed87d37-6e62-44dc-92ac-4e4a30b8af55} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7760 -prefsLen 36442 -prefMapHandle 7552 -prefMapSize 270978 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {e13ede11-6fd9-44d8-b7bd-95a5383c75a2} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6532 -prefsLen 36442 -prefMapHandle 6496 -prefMapSize 270978 -jsInitHandle 8556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {4e1989e2-e4e7-472b-92ba-f9ad54249e52} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8804 -prefsLen 36442 -prefMapHandle 9108 -prefMapSize 270978 -jsInitHandle 9112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9584 -initialChannelId {6c00cdd2-0375-43c0-a3aa-55032c89a446} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6980 -prefsLen 36442 -prefMapHandle 6856 -prefMapSize 270978 -jsInitHandle 8468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9808 -initialChannelId {c5e58e49-501a-4496-84c2-6a2f292b6acb} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2556 -prefsLen 36498 -prefMapHandle 4464 -prefMapSize 270978 -jsInitHandle 7520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9468 -initialChannelId {2fe7f168-2038-46ed-8017-c693bc5942d2} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9856 -prefsLen 36498 -prefMapHandle 5888 -prefMapSize 270978 -jsInitHandle 6716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9468 -initialChannelId {fe0a234a-4756-4db7-a51b-89da09a613cc} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6444 -prefsLen 36498 -prefMapHandle 7588 -prefMapSize 270978 -jsInitHandle 8600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8900 -initialChannelId {3a27322f-687e-44a9-b6e0-e493d5c377e8} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8840 -prefsLen 36498 -prefMapHandle 6864 -prefMapSize 270978 -jsInitHandle 7004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7048 -initialChannelId {e363ca60-cd38-4ed5-bd9d-30241a01576c} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9832 -prefsLen 36498 -prefMapHandle 9844 -prefMapSize 270978 -jsInitHandle 9748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9708 -initialChannelId {c8d116f6-1b15-42ec-bb7f-c7bccc82c1fb} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8888 -prefsLen 36498 -prefMapHandle 8820 -prefMapSize 270978 -jsInitHandle 7132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6932 -initialChannelId {16283edd-cb70-4372-aa80-eea959cd39d8} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6512 -prefsLen 36498 -prefMapHandle 8380 -prefMapSize 270978 -jsInitHandle 1728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9712 -initialChannelId {5ebfc485-4192-49f4-84dc-318eb2890cfc} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10004 -prefsLen 36498 -prefMapHandle 10008 -prefMapSize 270978 -jsInitHandle 10012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9272 -initialChannelId {43daf88b-1fe7-48ef-a5bf-e653d041e441} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10132 -prefsLen 36498 -prefMapHandle 10128 -prefMapSize 270978 -jsInitHandle 10124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9304 -initialChannelId {e1400bb5-4432-4702-9513-a66655095c2c} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9120 -prefsLen 36498 -prefMapHandle 6952 -prefMapSize 270978 -jsInitHandle 7144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10012 -initialChannelId {679d714f-50d0-4830-8744-0e923f932d4a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10332 -prefsLen 36498 -prefMapHandle 10328 -prefMapSize 270978 -jsInitHandle 10316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10376 -initialChannelId {59099e8e-de0c-412e-8bd5-c6a5499a8c6e} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10612 -prefsLen 36498 -prefMapHandle 10288 -prefMapSize 270978 -jsInitHandle 2828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6860 -initialChannelId {2c596cff-502a-48c0-a553-dfa5be0a402a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 36498 -prefMapHandle 5688 -prefMapSize 270978 -jsInitHandle 9388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9836 -initialChannelId {02d30a6b-9a77-4a26-b4c8-41404d1f076a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10860 -prefsLen 36498 -prefMapHandle 10864 -prefMapSize 270978 -jsInitHandle 10868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10816 -initialChannelId {5a19d359-b8ed-43c2-932f-db54d180b695} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9320 -prefsLen 36498 -prefMapHandle 10756 -prefMapSize 270978 -jsInitHandle 10740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {71d52c37-e6ef-4a6e-b094-b4b9aff9cc0a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6932 -prefsLen 36498 -prefMapHandle 5664 -prefMapSize 270978 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9396 -initialChannelId {d2d8c9f6-2c6a-43bb-b1bb-29341d00cac1} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10012 -prefsLen 36498 -prefMapHandle 9032 -prefMapSize 270978 -jsInitHandle 9056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6988 -initialChannelId {42a52cf3-a57f-461f-a584-273c0b7410a2} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab3⤵
-
-
C:\Users\Admin\Downloads\setup.exe"C:\Users\Admin\Downloads\setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"4⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\BetterBLOX', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11164 -prefsLen 36498 -prefMapHandle 11340 -prefMapSize 270978 -jsInitHandle 11324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10896 -initialChannelId {795ef22d-f4f8-4b7a-a794-decd8b6f07ef} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10776 -prefsLen 36498 -prefMapHandle 10852 -prefMapSize 270978 -jsInitHandle 10760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10948 -initialChannelId {5662068d-8187-4b4f-ae59-dcbee98be622} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9264 -prefsLen 36498 -prefMapHandle 8620 -prefMapSize 270978 -jsInitHandle 6728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8336 -initialChannelId {54906e1c-16d6-4931-ab9b-8452e6f03540} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6932 -prefsLen 36498 -prefMapHandle 11668 -prefMapSize 270978 -jsInitHandle 11664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8632 -initialChannelId {26647f33-6b95-4566-bf37-b5d985b67c88} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9868 -prefsLen 36498 -prefMapHandle 9864 -prefMapSize 270978 -jsInitHandle 9880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9892 -initialChannelId {0a5fefb3-b3c8-46d5-b0ba-dab194be63e4} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 36498 -prefMapHandle 10464 -prefMapSize 270978 -jsInitHandle 9904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10728 -initialChannelId {81485c7f-0f39-4779-9f39-7462cee92ea3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10444 -prefsLen 36498 -prefMapHandle 5612 -prefMapSize 270978 -jsInitHandle 6440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11332 -initialChannelId {a1b81999-3663-41f1-82c4-b4d6e3dbf1e2} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11708 -prefsLen 36498 -prefMapHandle 11660 -prefMapSize 270978 -jsInitHandle 11676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11684 -initialChannelId {fe5c877e-de70-440d-a538-7beb5929ea79} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10812 -prefsLen 36498 -prefMapHandle 11748 -prefMapSize 270978 -jsInitHandle 8620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10520 -initialChannelId {62a4ab04-75bd-4808-a4c7-9a78b3632bce} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 36498 -prefMapHandle 9984 -prefMapSize 270978 -jsInitHandle 11868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11696 -initialChannelId {563066f2-8657-4b03-ba3d-aa9daa7afcc3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8876 -prefsLen 36498 -prefMapHandle 4760 -prefMapSize 270978 -jsInitHandle 6516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10492 -initialChannelId {24c2f8f4-e472-482c-b1b6-89c2c9604a08} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6508 -prefsLen 36498 -prefMapHandle 11332 -prefMapSize 270978 -jsInitHandle 8116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10592 -initialChannelId {46784270-6bee-4ec8-88a1-0527c44d985f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10656 -prefsLen 36498 -prefMapHandle 9392 -prefMapSize 270978 -jsInitHandle 11924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11956 -initialChannelId {b4ed75f9-7654-47ec-96fa-c78937d70d72} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 65 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12016 -prefsLen 36498 -prefMapHandle 12076 -prefMapSize 270978 -jsInitHandle 12124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8488 -initialChannelId {13cf5003-b135-4d81-8712-23b335fc0918} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 66 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12284 -prefsLen 36498 -prefMapHandle 11956 -prefMapSize 270978 -jsInitHandle 6844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10356 -initialChannelId {e6037763-0490-41a8-bfbd-5ecf11847123} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 67 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9612 -prefsLen 36498 -prefMapHandle 9876 -prefMapSize 270978 -jsInitHandle 8812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6412 -initialChannelId {d12ef8f4-2ce7-44c2-babb-26699706ebe4} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 68 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9068 -prefsLen 36498 -prefMapHandle 7080 -prefMapSize 270978 -jsInitHandle 11832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9632 -initialChannelId {68482628-4783-46ba-8ce8-769c7ea1fad3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 69 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10320 -prefsLen 36498 -prefMapHandle 8060 -prefMapSize 270978 -jsInitHandle 10520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11780 -initialChannelId {6a4fca7d-9b7a-4ab0-be71-4ba285617b2c} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 70 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8540 -prefsLen 36498 -prefMapHandle 12068 -prefMapSize 270978 -jsInitHandle 10504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10336 -initialChannelId {4577895f-452d-452d-9a46-470d2cd56ecf} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 71 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10892 -prefsLen 36498 -prefMapHandle 9628 -prefMapSize 270978 -jsInitHandle 10844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11984 -initialChannelId {0f984d55-1ce2-49c3-9e43-50639e330829} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 72 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2120 -prefsLen 39638 -prefMapHandle 8596 -prefMapSize 270978 -ipcHandle 12172 -initialChannelId {76a0c5a5-e207-4831-bbec-855a59203dd0} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 73 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2240 -prefsLen 36498 -prefMapHandle 2252 -prefMapSize 270978 -jsInitHandle 2264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11104 -initialChannelId {2998c269-8ee6-43a0-96e4-d7e7d8c9255b} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 74 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11000 -prefsLen 36498 -prefMapHandle 11672 -prefMapSize 270978 -jsInitHandle 10732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11972 -initialChannelId {1fdd3af9-01de-4df2-9aa8-718d87284e4f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 75 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11788 -prefsLen 36498 -prefMapHandle 10480 -prefMapSize 270978 -jsInitHandle 11708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11824 -initialChannelId {19e39742-ce6d-4aee-b5da-be81670c9092} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 76 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8908 -prefsLen 36498 -prefMapHandle 9192 -prefMapSize 270978 -jsInitHandle 11256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9964 -initialChannelId {50f73f3d-06de-4319-b93e-54c69e7ede25} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 77 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12232 -prefsLen 36498 -prefMapHandle 8608 -prefMapSize 270978 -jsInitHandle 9256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12260 -initialChannelId {534f247c-2287-42a9-844f-0889097df7ed} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 78 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2276 -prefsLen 36498 -prefMapHandle 11652 -prefMapSize 270978 -jsInitHandle 8792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10876 -initialChannelId {4a40f494-2225-4ab2-a8a7-fbca9e7d795e} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 79 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11420 -prefsLen 36498 -prefMapHandle 10928 -prefMapSize 270978 -jsInitHandle 9724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11064 -initialChannelId {9fa1c88f-b7c8-4f74-aa94-7e1da2a02b93} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 80 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9980 -prefsLen 36498 -prefMapHandle 8060 -prefMapSize 270978 -jsInitHandle 9868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11932 -initialChannelId {d80a9558-9fca-4840-9c6b-644085f28c9a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 81 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6932 -prefsLen 36498 -prefMapHandle 11160 -prefMapSize 270978 -jsInitHandle 5080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9868 -initialChannelId {bdd92592-5743-4ff7-ba9a-afdeb8333fee} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 82 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11560 -prefsLen 36498 -prefMapHandle 12168 -prefMapSize 270978 -jsInitHandle 9236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {61af8330-4ff9-4915-bf7f-0b4fe00d34a8} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 83 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11872 -prefsLen 36498 -prefMapHandle 11972 -prefMapSize 270978 -jsInitHandle 11540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11984 -initialChannelId {c48fa99a-01e2-4d15-b8e5-11d29a38dff9} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 84 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12028 -prefsLen 36498 -prefMapHandle 9124 -prefMapSize 270978 -jsInitHandle 12088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11368 -initialChannelId {7ac7345a-0de1-43f5-a62c-1278ba6a1145} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 85 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\25ab7317-2b4e-49bc-a89e-df6fafec9284.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1645ad99-109a-4151-81e7-a0bfec046ffe.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7164 -prefsLen 36498 -prefMapHandle 10400 -prefMapSize 270978 -jsInitHandle 7408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9876 -initialChannelId {c5848f7e-eea5-4104-a7f3-1acc306d522d} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 86 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12100 -prefsLen 36498 -prefMapHandle 11824 -prefMapSize 270978 -jsInitHandle 11728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10444 -initialChannelId {e774c97b-e5d8-4d20-b4db-a0470182d1f6} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 87 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 36498 -prefMapHandle 10444 -prefMapSize 270978 -jsInitHandle 10824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11032 -initialChannelId {d0552f0b-b2a0-4e2a-a84e-4454443c38ff} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 88 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12408 -prefsLen 36498 -prefMapHandle 12416 -prefMapSize 270978 -jsInitHandle 12424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12372 -initialChannelId {326469af-07e0-4215-a654-8ba89725b203} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 90 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7057d3d-fe7e-4152-b0fd-ab11a6b9f929.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9cb4f67-8813-4e91-b245-5de707f3c029.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ba36f381-98a3-408d-899b-0f9f91e13893.dmp"3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10136 -prefsLen 36498 -prefMapHandle 11608 -prefMapSize 270978 -jsInitHandle 7816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9440 -initialChannelId {7c639be3-68eb-4453-8ca5-38e25766989f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 91 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11288 -prefsLen 36498 -prefMapHandle 10872 -prefMapSize 270978 -jsInitHandle 10780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7424 -initialChannelId {ee55662e-6c42-423b-bd49-539733869ee6} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 92 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10160 -prefsLen 36498 -prefMapHandle 11792 -prefMapSize 270978 -jsInitHandle 8496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9440 -initialChannelId {5d92b2a2-d7c5-4c51-bc8e-af0188e8b9f6} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 93 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10548 -prefsLen 36498 -prefMapHandle 7524 -prefMapSize 270978 -jsInitHandle 11892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7728 -initialChannelId {6ce32574-ad8b-4cdc-8848-d95f98a0edaa} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 94 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12100 -prefsLen 36498 -prefMapHandle 11824 -prefMapSize 270978 -jsInitHandle 12352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10676 -initialChannelId {31c319b4-f5ab-40e5-9a1c-06671035f8e5} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 95 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10208 -prefsLen 36498 -prefMapHandle 10160 -prefMapSize 270978 -jsInitHandle 8380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7420 -initialChannelId {77c7fa09-7023-4982-ba68-2e92f46010f1} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 96 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6820 -prefsLen 36498 -prefMapHandle 2264 -prefMapSize 270978 -jsInitHandle 7484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9780 -initialChannelId {c4634386-9204-40f1-8594-37f422ee41e3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 97 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7452 -prefsLen 36498 -prefMapHandle 7440 -prefMapSize 270978 -jsInitHandle 10136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9908 -initialChannelId {cc7a1f11-e7f1-448b-962f-7b2342a8a0f7} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12672 -prefsLen 36498 -prefMapHandle 6804 -prefMapSize 270978 -jsInitHandle 11396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11404 -initialChannelId {3ea64e3d-fa85-4160-8c69-4f9db9089d93} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 99 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11820 -prefsLen 36498 -prefMapHandle 12200 -prefMapSize 270978 -jsInitHandle 9584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11692 -initialChannelId {8e6c6b83-2f5d-4218-807e-2296112e8dc3} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 100 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12628 -prefsLen 36498 -prefMapHandle 12584 -prefMapSize 270978 -jsInitHandle 12568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12664 -initialChannelId {b548dc6e-be58-4199-992f-5204e293ce0a} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 101 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9784 -prefsLen 36498 -prefMapHandle 12200 -prefMapSize 270978 -jsInitHandle 12628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12556 -initialChannelId {5af71ec9-8ab9-4ba6-9488-a70f242b1bcd} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 102 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7484 -prefsLen 36498 -prefMapHandle 8060 -prefMapSize 270978 -jsInitHandle 11136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12584 -initialChannelId {ebc874f6-71c8-4e8d-ae4f-509632dc84c1} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 103 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11500 -prefsLen 36498 -prefMapHandle 8232 -prefMapSize 270978 -jsInitHandle 8552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {abf353c5-2602-4df8-8fea-f09279f6c30d} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 104 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6384 -prefsLen 36498 -prefMapHandle 5896 -prefMapSize 270978 -jsInitHandle 9832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12580 -initialChannelId {c41f989d-81d6-47a1-ae3c-2b2a0d91a09d} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 105 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6064 -prefsLen 36498 -prefMapHandle 9592 -prefMapSize 270978 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7384 -initialChannelId {19cd46a9-a4d5-4ce1-a1a4-e7104425c00e} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 106 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7080 -prefsLen 36498 -prefMapHandle 11312 -prefMapSize 270978 -jsInitHandle 11484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10924 -initialChannelId {c0432aa2-9d69-4a88-9d7e-ced1e82dc377} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 107 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12060 -prefsLen 36498 -prefMapHandle 8348 -prefMapSize 270978 -jsInitHandle 11560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10388 -initialChannelId {99846e69-e01e-4fcc-8f05-b4496cb04013} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 108 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12536 -prefsLen 36498 -prefMapHandle 10060 -prefMapSize 270978 -jsInitHandle 12512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9736 -initialChannelId {0bf0fbf6-6a9a-47ae-b40f-597b1d2d1526} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 109 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8352 -prefsLen 36498 -prefMapHandle 10044 -prefMapSize 270978 -jsInitHandle 6468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {f2cf0621-ee3c-41c8-83cd-37750e12fe78} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 110 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9832 -prefsLen 36498 -prefMapHandle 5672 -prefMapSize 270978 -jsInitHandle 9252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9196 -initialChannelId {3270e851-6cc1-40be-b3ef-5b842421583f} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 111 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12456 -prefsLen 36498 -prefMapHandle 10384 -prefMapSize 270978 -jsInitHandle 7524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12252 -initialChannelId {f92174f8-cccc-422c-9c10-a236939baaab} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 112 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 36498 -prefMapHandle 9144 -prefMapSize 270978 -jsInitHandle 8232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11360 -initialChannelId {2550815a-c485-4738-95a2-4d0f9607df8e} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 113 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12560 -prefsLen 36498 -prefMapHandle 12168 -prefMapSize 270978 -jsInitHandle 10944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10512 -initialChannelId {37c84074-79e0-4d8e-a3cf-16ded4cd0983} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 114 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10872 -prefsLen 36540 -prefMapHandle 10296 -prefMapSize 270978 -jsInitHandle 11600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6848 -initialChannelId {278a3da7-f10f-4664-a019-5beb06408327} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 115 tab3⤵
-
-
-
C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 15442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2256 -ip 22561⤵
-
C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 15282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5284 -ip 52841⤵
-
C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"C:\Users\Admin\Downloads\Idiot\YouAreAnIdiot.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 15362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3912 -ip 39121⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\freerobux\free robux\README.txt1⤵
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"C:\Users\Admin\Downloads\freerobux\free robux\troglodyte1.1.exe"1⤵
-
C:\Users\Admin\Downloads\rbxfpsunlocker-x64\rbxfpsunlocker.exe"C:\Users\Admin\Downloads\rbxfpsunlocker-x64\rbxfpsunlocker.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
- Queries registry keys for unique system GUIDs
-
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exeC:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\betterblox /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\betterblox\Crashpad --annotation=_productName=BetterBLOX --annotation=_version=3.5.0 --annotation=bbx_app_ver=3.5.0 --annotation=bbx_bundle=overwolf --annotation=bbx_channel=stable --annotation=bbx_os_uptime_s=241267 --annotation=bbx_roblox_running=unknown --annotation=bbx_started_hidden=0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.11.15 --initial-client-data=0x550,0x554,0x558,0x514,0x55c,0x7ff6379d3430,0x7ff6379d3440,0x7ff6379d34502⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exeC:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe --type=cs --cs-app=betterblox --uid=olpgmgocjaekokjfaphlohnflkpfnkfdhhlliipd --phase=45 --muid=04bced9b-948b-d5b2-a102-05c896049264 --muidv2=ad5caf8c-8669-414e-9e1a-4d776f56fac2 --version=42.11.15 --first-run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --standard-schemes=owepm,rbxasset,bbx-media --secure-schemes=rbxasset,bbx-media --bypasscsp-schemes=owepm --cors-schemes=rbxasset --fetch-schemes=rbxasset --streaming-schemes=owepm,rbxasset,bbx-media --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"2⤵
- Uses WMI to collect hardware manufacturer information
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --standard-schemes=owepm,rbxasset,bbx-media --secure-schemes=rbxasset,bbx-media --bypasscsp-schemes=owepm --cors-schemes=rbxasset --fetch-schemes=rbxasset --streaming-schemes=owepm,rbxasset,bbx-media --app-user-model-id=com.overwolf.betterblox --app-path="C:\Users\Admin\AppData\Local\Programs\BetterBLOX\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3396 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --standard-schemes=owepm,rbxasset,bbx-media --secure-schemes=rbxasset,bbx-media --bypasscsp-schemes=owepm --cors-schemes=rbxasset --fetch-schemes=rbxasset --streaming-schemes=owepm,rbxasset,bbx-media --app-user-model-id=com.overwolf.betterblox --app-path="C:\Users\Admin\AppData\Local\Programs\BetterBLOX\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=5172 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --standard-schemes=owepm,rbxasset,bbx-media --secure-schemes=rbxasset,bbx-media --bypasscsp-schemes=owepm --cors-schemes=rbxasset --fetch-schemes=rbxasset --streaming-schemes=owepm,rbxasset,bbx-media --app-user-model-id=com.overwolf.betterblox --app-path="C:\Users\Admin\AppData\Local\Programs\BetterBLOX\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=5320 --package-folder="C:\Users\Admin\AppData\Roaming\ow-electron" --app-root="C:\Users\Admin\AppData\Local\Programs\BetterBLOX\resources\app.asar" --app-name=betterblox --muid=ad5caf8c-8669-414e-9e1a-4d776f56fac2 --phase=45 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\OverwolfElectron"4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\betterblox" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,5090344545850728899,16544125385945661668,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebAuthenticationUseNativeWinApi --variations-seed-version --pseudonymization-salt-handle=1964,i,10885937692253759566,1432678264843674934,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "dxdiag /t "C:\Users\Admin\AppData\Local\Temp\dxdiag_output.txt""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\dxdiag.exedxdiag /t "C:\Users\Admin\AppData\Local\Temp\dxdiag_output.txt"3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcASwBlAHkAYgBvAGEAcgBkACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAGwAcwA9ACcATQBvAHUAcwBlACcAOwAKACAAIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBGAGkAbAB0AGUAcgAgACIAUABOAFAAQwBsAGEAcwBzAD0AJwAkAGMAbABzACcAIgAgAHwACgAgACAAIAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBOAGEAbQBlACkACQAkACgAJABfAC4ARABlAHYAaQBjAGUASQBEACkAIgAgAH0A3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exeWHERE smartctl3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"2⤵
- Queries system WMI classes for hardware identifiers
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SoundDevice | select DeviceID,StatusInfo,Name,Manufacturer | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"2⤵
- Uses WMI to collect hardware manufacturer information
- Queries system WMI classes for hardware identifiers
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"2⤵
- Queries system WMI classes for hardware identifiers
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_SystemEnclosure | select Model,Manufacturer,ChassisTypes,Version,SerialNumber,PartNumber,SKU,SMBIOSAssetTag | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Battery | select BatteryStatus, DesignCapacity, DesignVoltage, EstimatedChargeRemaining, DeviceID | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-WmiObject -Class BatteryStaticData -Namespace ROOT/WMI).DesignedCapacity"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance -Class BatteryFullChargedCapacity -Namespace ROOT/WMI).FullChargedCapacity"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet3⤵
-
-
-
C:\Windows\System32\dxdiag.exeC:\Windows\System32\dxdiag.exe /x C:\Users\Admin\AppData\Local\Temp\dxdiag-rM61Gz\dxdiag.xml2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance MS_Systeminformation -Namespace \"root/wmi\" | select systemsku | fl "2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAHYAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuACcACgAiACQAKAAkAGMAdgAuAFAAcgBvAGQAdQBjAHQATgBhAG0AZQApAHwAJAAoACQAYwB2AC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACkAfAAkACgAJABjAHYALgBDAHUAcgByAGUAbgB0AEIAdQBpAGwAZAApAHwAJAAoACQAYwB2AC4AVQBCAFIAKQAiAA=="2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABjAHYAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuACcACgAiACQAKAAkAGMAdgAuAFAAcgBvAGQAdQBjAHQATgBhAG0AZQApAHwAJAAoACQAYwB2AC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACkAfAAkACgAJABjAHYALgBDAHUAcgByAGUAbgB0AEIAdQBpAGwAZAApAHwAJAAoACQAYwB2AC4AVQBCAFIAKQAiAA==3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_bios | select Version, SerialNumber, SMBIOSBIOSVersion"2⤵
- Queries system WMI classes for hardware identifiers
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\Downloads\rbxfpsunlocker-x64\rbxfpsunlocker.exe"C:\Users\Admin\Downloads\rbxfpsunlocker-x64\rbxfpsunlocker.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe"C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe" --hidden1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exeC:\Users\Admin\AppData\Local\Programs\BetterBLOX\BetterBLOX.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\betterblox /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\betterblox\Crashpad --annotation=_productName=BetterBLOX --annotation=_version=3.5.0 --annotation=bbx_app_ver=3.5.0 --annotation=bbx_bundle=overwolf --annotation=bbx_channel=stable --annotation=bbx_os_uptime_s=241278 --annotation=bbx_roblox_running=unknown --annotation=bbx_started_hidden=1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.11.15 --initial-client-data=0x528,0x52c,0x530,0x524,0x534,0x7ff6379d3430,0x7ff6379d3440,0x7ff6379d34502⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
PCW.debugreport.xml
StartupProfileData-NonInteractive
activity-stream.contile.json
activity-stream.discovery_stream.json
activity-stream.discovery_stream.json
activity-stream.weather_feed.json
10367
10402
10418
11099
11116
11568
11571
1172
1183
12091
123
12310
12409
1256
1317
13291
13326
13602
13610
13661
13951
14132
14271
1445
14755
14788
14808
15060
15125
15497
15823
15862
15905
16443
1647
16965
17314
17604
18270
18335
18976
19065
19083
19333
19596
19634
19717
20088
20249
20790
21014
21201
21409
21443
21481
21648
21683
22321
22710
23148
23241
23495
23733
23857
2388
24170
24179
24451
24457
24545
2459
24694
24956
24976
25161
26252
26782
26788
26809
27149
27205
27347
27430
27507
27698
28058
28608
28795
28803
29334
29380
29390
29821
29826
29830
29884
29974
30027
30702
30726
31599
31880
32171
32397
32649
3316
3334
3646
3794
390
4101
423
4272
4370
4827
4910
5460
5541
5588
6262
6309
6513
6648
6893
7106
7384
7631
7839
7849
8099
8171
8371
8522
8674
8998
9240
9274
9451
9743
992
00392F3A8DEFAD3C7A0DA6F033E52F1853101B8F
010BC770C6686E04C28F73B3174E60F45389DFD8
0304BB37F0E2064A947BAF98841C2FFC1C380C90
03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
05E32179E24BCAAB4B3B71F74C54C2CCA987799D
06780FFEB8E454FCD776992F355C171787823933
06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
08CFCF21BDF4B1177AA739334CA52C230595F88D
08FB0ACD5FBC380E76364E030AC56C2342C734F2
098C23E862A58EA080491822948A1D0BE6A2CC19
0A7B7A0839932D42D0A2FC59386E3D997FE09BEE
0B34AE03A567B15DA7445699AA019A5388BA9011
0C7F30EC5742AB8F4D26600A13E9317C4C9FDD71
1321DAA9286F220F60B7992C84867F047830F8AF
13802ABE6A56AB1C79FB7F485B228BFE70285681
15DD338685C74B1A37FF648302FA6E2F7CC9E5BA
180A8283F17DC9DD59DDEF1093D879B129D3F341
19AA57B401A94E00662CD1E7507D93C9D6AB4A19
1D03195584D463116BE1E3F85D505AB16A0D140E
2245FA3028C8941CD8697922462DFFD04BF424F9
24326FA56DF2D74BC5C9E01C0A8BCF39802F1E5F
25B6D56019B39DDC55F6515ABA7D0C19BAE12485
280A8948CDC9CB86FC4A25BCD4C0801663D4F5F8
29393C6EE83D8CE2F90E9EDD5851E0E3045D737D
29F83FD07B57103CCBD3D42C923DFF149458A404
29F97D62EDFF7C97E9889F27A185C4DEAF40E89A
2C2C95F769AFD0C7382A35F67544E7AE61962E76
2DDE8E24D89B58803948053DD4E6179C02179895
2F336731187CC98F8E4AC625BD90088CB4793955
30CDBD9A36C0328862650365EC13B45ED3D68160
3107DB2E6E9CB1CFE4523735B2652FA522C229EE
313AAF88B47C509ADCE0D9602E3381C16B934B22
325FF324FF79A0A2FC6DBCD0105DE57267DB74EF
33B84343234C4D5D830E21D05D0DCA2288314A03
33B8AC04514C624FB45C7DD53B68D8A5995DB3E2
34A9CB72609D711EFCEB4F9EA58FBC692A9A3A5B
376168E2E945718CBA80BCBD59F2D4DA9E2BAC1C
382B5B3827B4DDFA378A655D1BD82EE2B5E279A6
386D22EAB36C3C5C3713F931E60D7F8CA78D773F
3A0093B24661E79CD70590CDF7F9AD987A638AA5
3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
402919AA3F2851D6CE0A56D180489C7516E556A0
41B323023C647940EC6E2528B33D9D54FFE95E85
4299756B16C238125012F5459732926CCDE61CE0
46FEA1ABC10F566DB34264F8CA08FD97A3354514
477F74588505AA9ABA3AA20A53245C49C727AC5D
49463AF8B63B8184EE65BF30416686D1275752EE
4B7A2A9BE09C298722AA3B23F0BAEA2A2532A85A
4E5AE40FDF3F1FCCC0DB35B5C3C0F495FF9F0B12
4E728E416C7CA83D447AD22BC5D12F6A796DE94C
4EDB87F706E2E4D5A79AF05E3AAB42F1D4FABAE8
503F29651D3E1EA7F46F9E30B4529C01752D8C35
522CDC0A361C5D7258F7B4B2443130C17FB552DE
540068546F9CCEF9DF0906124AC669CEC98433D9
57E7EA32D526F612EFD2E77A642B3B967A3AD46B
5A279FE535CAFD05130DB798439E253945509F13
61E0A57B9686756C41CFA8E3B29CC6BF18C9526C
6556C9597C4B1D1592A5DAFD070C5B1824A8100A
659946510252A91E0D18DD79D836858E2383B54C
65C80D86A94A51AC59548CC4FDF45FB4BBC00992
6636F79D29CC24C729EF8129D71C442CB830B955
691702370B05702161FBA80015196A7BDEAE3265
6A6D94CEE0CFC6C77ACF644D71A331A9D44ACE87
6BEBBE5B981F7DA226FAC43C1C4F248C6485F7E0
6C42FE8C083060A0DDD05485724A9A47537DC78D
6D89348819C8881868053197CA0754F36784BF5F
6D89348819C8881868053197CA0754F36784BF5F
6DDE4064A0CAA77B34E264D1BBAC90B57D472922
709817863A564CFBD6BA5E18CAA61A8D91E53FB6
7614F3EE0489BA9A067E920B42DB39D7DADEBA4F
76FC25AF92118657EC0098CD72DBE58730CFB9AE
7795EE21D2E7DACD87D4C51FD063FFB50C223042
77985CC01F37D9E0D1EB1C672F677803438CFBE7
77D0DEC9B65F7F98DF5FEBD2DFD84EF75E435405
7F8860F97751DB0F2BBBAB61A7B6428FE64D43CB
81970E0057D883F597CF3E9382B431CE965376A4
8229717B1481CAE4F5B4DC5D00336162641EE431
854F085670F1B151E6EB90F7543CB26AB6373911
88F3DC5384E5315BAA3C36423390B22693ACEAE7
8A905A98BE62A01AF271BDBF9C03664F1EFB7771
8B8E18961CF1630D84F28F3580CFB0ECCA6CC843
8C8299A3AB8C5BB7F3539D5EDF45B52DC4C31985
907AD815152EE0B81E382298839D00E7C4901571
91DD59A679DB08144ACDA014E4B023E2685A4AD7
93DBAF6FA726C751037771A69999514F4DF7B173
958FEBA07D2192CD797CB4916671E4B6AA196F2F
9680DF759D24DEDC83FEF5A44266C46A2E3A7AF6
990C356BA5A594E517ACBD2ED9F65D54DD7F8CF1
994CBB6594E91B803102C16A367B52C78203A1CB
9AFE4E5B9D3F0583C4E2EC17D66040DB5E104808
9CFADB6CDC2D158A4B732C3DA4686423B2762BD0
9E9CA1C85CF5DAEDF1FBC9304CFFFBF1B0AF7BF4
9F42F27C6B86264C0AEC469CF52DB44112DFB120
A009B44A1B9BCC076D111F06397947E57CA5F58C
A221A30404BB53822849C419EE0EBC4882370DB6
A5D94B7A5A010338F69F420CC9042CE820F902A5
A60ED8D2C579B70903E24C32D139703AA81BE1A1
A7ED6FBDF3C61C3912665DEF4AF7B07F93653DB6
A7EF0B741E968B9FEB9860EF0C97090E679AD90D
AA4225AB6BD35BCA089DD20620FBF971F757213B
ADF7E080B6A58DA07A67BFCE58E2EF8955F23F46
AE732D9DA8C61DD68B11CE9E52E372B5CA7BF5DB
AEFD1F5B2011E902F0C1EDD35776D7760CB661A1
AF9C726BCA450C72F1550A37C1F19B0F1CD0CBF1
B011D0DE0AC44ED6C4C815AC0DC1663375DCFB26
B09B1A8988BF3B22F5CA6A25D572FF4BA958DFCE
B0AC684207FDCAA7D1C2821521B325CBCF37027F
B14CE39356D54681FC195EBFC0CDA89971C32A4F
B3E90CA984EB4639E3E0DF050AE3F3BC1B2012E6
B40B6055F4D6B915F39B88B794F3CDCCB383E719
B7EE9E993025178829BB258D9FC8D7CFF6000075
BBF6E3C6C8C0628AACBA9F54F931B45E389A74F9
BC8571DCDF492288FBA695424FD88FE6916F5CB9
BCB24B4BB52206F3AB4874A9F5EA28BA22CB4D62
BE9F01B3801472C249D4F82CD59E57F6FC8DCEF8
C06BFDB74494CE9AFF7F8FA76D554D1F6F6520CA
C4CF765F237CB9509C4013E0C69DAB00FA408BB0
C65D0935DF3D3E941A1335B771BC4B0C07E25712
C6EAAADC293843BE0580C5FCEF6B3F1FDAD52D95
C720B78A50388942DC70DB5761923C73498C6830
C9BEAB1BF65EA2562812BC5610B56E1A7786A0A4
C9DC5718FF3DB29DD4489BBBE60AF0F8B85EF7B5
CA4145472CF176AC84347B93B40E034A75940F19
CAF966F1BCB8F82CE62E9A0EC7B88902D37BC806
CD14E830CE9E9AF90C4191F097C5D210ECB185A3
CEF68508EB9B66B0E81E2EEF96312CAEC849D4FD
D0F48A0632B6C451791F4257697E861961F06A6F
D1477EF95B41474E435917E1A4D5B8DD6993A449
D1FBFE074FD4DA32863A4AB226F765959787C244
D2C66E0703AB71425558C082AA09107F435B5803
D3FDBB7A01D60E481B41994CBE59A8276EF7FE6E
D754CD72FA20A7572A4D6DC5BE013EB253C9BCB1
D78A6121DC99D63F0F4FF8EA62E6D85132E80155
D80B17D686807C4B2318CD4C3B5C48475FFBF0AB
D95931DF3F2102FE9B2A6CE083296205FF37A45A
DA228A2468415E6F74879A4FC2B38E2B265561C7
DE6410D7D10A034A4B6C7DF000528E7D2955C71E
DF18BFA9757E6E55E3A12E33866DA8D07B26722E
DF9C2F64DE858672749721C1F688EB8DC4D3B4F6
DFB6466F9D6CF5014C747826A18CC3CEEEC296EE
DFC380F1C43BDC2680F8D3E4C8E0BC77AB585817
E32BAC0EC2E77E260F1D2C037B5729DAB8F07B7B
E4AF71A40BA012D68FD2B2A433EB2A26C571C8EF
E7CA552E50BD3AF9C0B644FE5D140E5F766BD2E1
EA87465A6B977981215042B94E7AB9FECDDEE708
EE2ED099C4A70BCCD4BD8CB76DF938FFD2267FBE
F219D520482B943154DF970F4E442E48A0BB4D9C
F884B417DE2A596726379F94AE3819DBCE9F9B00
FA6DE89C70912DAD8ED259FE1BD56C0A4D0FA33F
FC2AF6DD75FB0FD6AEC04B596CAF05E131ADDE64
FE9F2F291F9188AE9072CE1488008E0C3E4AF545
FF3E1F9A0E16FE7E62520664280BCF6AFC3E4620
FFB82181B0F431E57249FBCF787AA31F89794B43
1B6yWoanOTazOP+Ra8ssbvdkNGAPrviDdAjMDyolNpM=.ico
scriptCache-child-current.bin
scriptCache-current.bin
startupCache.8.little
urlCache-current.bin
webext.sc.lz4
webext.sc.lz4
db9d844605dcd939c3ddea96ae81f0d5.png
PCW4305.xml
RES472C.tmp
RES47A9.tmp
RES4B33.tmp
__PSScriptPolicyTest_lctqokby.whw.ps1
en2re0ux.dll
ida1ms0x.dll
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
integrity.dll
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
owutility.dll
resources.pak
app-update.yml
app.asar
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsis7z.dll
tmpaddon
tmpaddon
tmpaddon
yk1usirr.dll
bl.json
default.dic
3WRNMFQIQRNJPEYFVHNQ.temp
6824f4a902c78fbd.customDestinations-ms
D647OQ8E598CSK1OU33T.temp
STGKZ6SJFR7MQ7QXFOCV.temp
ZFZGJ788YL1T4DV7IS9Q.temp
1645ad99-109a-4151-81e7-a0bfec046ffe.dmp
25ab7317-2b4e-49bc-a89e-df6fafec9284.dmp
a9cb4f67-8813-4e91-b245-5de707f3c029.dmp
ba36f381-98a3-408d-899b-0f9f91e13893.dmp
c7057d3d-fe7e-4152-b0fd-ab11a6b9f929.dmp
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
SiteSecurityServiceState.bin
SiteSecurityServiceState.bin
addonStartup.json.lz4
bounce-tracking-protection.sqlite
cert9.db
compatibility.ini
cookies.sqlite
store.json.mozlz4
store.json.mozlz4
store.json.mozlz4
store.json.mozlz4
store.json.mozlz4
store.json.mozlz4
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
events
events
events
events
events
pageload
pageload
0124ac8c-5ab3-4757-a184-25ec064c2ccd
0239070f-2de2-4155-9a6b-a3756df5fffc
03cec833-adea-4e1a-a44f-261e4d821564
1b52dfcc-0a25-405a-8d4e-c09ac1a9c8ca
2b49f61b-3653-4f1b-9408-29e5c35dbd9c
2dc66265-3ff6-4cdc-baa0-dfcfdc33f192
357d55f2-8db3-4dae-a9dc-1cf8d02a34b8
36356fa1-e6e6-403f-9c15-3ffb72300842
44ea3564-7c1c-4b9b-81a9-c6c9f9b1299e
49a9ab10-1bad-4061-853b-7e75b32cf135
5b92cc97-67e9-47f0-a344-a7bd90e7920b
5d23dcd0-f9fa-4044-acd9-e9f1094991dd
608a6f9e-9a80-404c-8c9a-dd37564b8f03
6488f6b7-0135-4506-83a1-03553fe4e69f
6b165532-6d92-492b-af2a-dc904824268a
82c2910d-aaa7-4997-89c3-2a75d03e2139
89e8d6bf-8e3a-4995-aba1-4488cbd1ba8c
9320eb78-90b6-452d-83f1-3076de73cba9
b3a0a7d1-4497-4fbe-bd4b-cd224e9e593b
ba1d48b7-4f99-49f8-83b0-9ad8e25f2069
cf14620d-03a9-4cf9-b641-31baf9c64f55
d5e44575-64f3-43e7-9861-c1e235308e20
e194a47c-899c-47d2-8985-c5513d8d8d9d
f59a14a1-4a40-4001-932f-07ecaeeb8d59
downloads.json
downloads.json
extension-preferences.json
extensions.json
extensions.json
favicons.sqlite
favicons.sqlite
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
permissions.sqlite
places.sqlite
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
serviceworker-1.txt
serviceworker-1.txt
serviceworker.txt
serviceworker.txt
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json.tmp
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
sessionstore.jsonlz4
storage.sqlite
{f998d376-bb6d-4849-b104-bfb9fc337752}.final
{e9ef32c9-5b8f-468a-9021-c4f94866bb0f}.final
{928a40ab-f9d3-476d-b9a4-7bcc01f4aea0}.final
{457ac5db-907b-4763-9df0-c3a67ef836ab}.final
{51c300b8-8532-49cd-a336-d400bb4153ac}.final
{2bd957b8-492b-462d-a853-ef7b39ce6901}.final
{86263395-329a-48a9-b802-124b05f5993a}.final
{8647120b-d829-4a1e-83ba-e5dfc698914a}.final
1089050436yCt7G%cCf7C%oan6fci0g.sqlite
3211250388sbwdpsunsohintoatciif.sqlite-wal
.padding
{bcd15176-f5a9-4b65-a3dc-7238b7f94c03}.final
2171031483YattIedMb.sqlite
3138190461LCo7g%sCD7a%t0afb5aas.sqlite
usage
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
targeting.snapshot.json
xulstore.json
xulstore.json
xulstore.json
xulstore.json
config.json
config.json
config.json
f_000002
CURRENT
7d2a439d-7997-42f2-bef7-74d4e2929ef6.tmp
082eaa76-d617-4ac5-a6d8-b899006b3425.tmp
data_0
data_1
data_2
data_3
snapshot-new.baf
index
MANIFEST-000001
397753c4-6ecc-4352-92c9-86ff86877d6d.tmp
6a1433de-703e-4aa7-a47a-c1843167ba73.tmp
owpm.log
utility.log
emifmpeaagaaglhaimndbhcpkjfmjhfnjjpoibdo.owepk
owe-client-x64.dll
owe-client-x86.dll
fbakpbpolagjcgkhmnjmaeieneioknidnfjiejnf.owepk
jopghajpapbfooofklncedoalpgiaglgjaokpkon.owepk
ow-electron-utility-plugin.node
YouAreAnIdiot-UnFlash.FPCqsBOF.exe.part
YouAreAnIdiot-UnFlash.exe:Zone.Identifier
CSC2AC235DBCEB4283BBCFB0E678CCABC7.TMP
en2re0ux.0.cs
en2re0ux.cmdline
CSC1ADD759334D34B20AA90950F7697378.TMP
ida1ms0x.0.cs
ida1ms0x.cmdline
CSCEE5979063B0A47BDA86F2051A561502A.TMP
yk1usirr.0.cs
yk1usirr.cmdline
memory/548-1505-0x0000024B102D0000-0x0000024B102E4000-memory.dmp
memory/828-8610-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8612-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8607-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8608-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8609-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8614-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8619-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8603-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8611-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8604-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8618-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8617-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8616-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8605-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8613-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8606-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/828-8615-0x0000025338E90000-0x0000025338E92000-memory.dmp
memory/2028-1426-0x000002DF55070000-0x000002DF550A4000-memory.dmp
memory/2256-2979-0x00000000054E0000-0x000000000557C000-memory.dmp
memory/2256-2988-0x0000000005BB0000-0x0000000006156000-memory.dmp
memory/2256-2989-0x00000000056A0000-0x0000000005732000-memory.dmp
memory/2256-2990-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/2256-2991-0x0000000005740000-0x0000000005796000-memory.dmp
memory/2256-2992-0x00000000058E0000-0x00000000058EA000-memory.dmp
memory/2256-2978-0x0000000000AE0000-0x0000000000B52000-memory.dmp
memory/2288-1422-0x00000230E81C0000-0x00000230E81D4000-memory.dmp
memory/2288-1421-0x00000230E8190000-0x00000230E81C4000-memory.dmp
memory/3952-1302-0x0000027FEFB10000-0x0000027FEFB20000-memory.dmp
memory/3952-1303-0x0000027FEFB20000-0x0000027FEFB34000-memory.dmp
memory/3952-1297-0x0000027FD5490000-0x0000027FD571A000-memory.dmp
memory/3952-1298-0x0000027FEFCD0000-0x0000027FEFCE0000-memory.dmp
memory/3952-1299-0x0000027FD72F0000-0x0000027FD72F8000-memory.dmp
memory/3952-1300-0x0000027FD7300000-0x0000027FD7334000-memory.dmp
memory/3952-1301-0x0000027FEFB30000-0x0000027FEFB4A000-memory.dmp
memory/4668-5034-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5036-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5035-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5033-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5037-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5027-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5038-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5028-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5029-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4668-5039-0x000001D5DED90000-0x000001D5DED91000-memory.dmp
memory/4884-1457-0x0000023B42360000-0x0000023B42368000-memory.dmp
memory/4884-1470-0x0000023B42370000-0x0000023B42378000-memory.dmp
memory/4884-1483-0x0000023B423D0000-0x0000023B423D8000-memory.dmp
memory/4884-1444-0x0000023B420E0000-0x0000023B42102000-memory.dmp
memory/5036-1430-0x000001A65F1B0000-0x000001A65F1C4000-memory.dmp
memory/5416-6292-0x000000006F9F0000-0x000000006FD47000-memory.dmp
memory/5416-6284-0x000000006F6B0000-0x000000006F6FC000-memory.dmp
memory/5500-1507-0x000002606CE90000-0x000002606CEA4000-memory.dmp
memory/5504-1428-0x000001E90EE90000-0x000001E90EEC4000-memory.dmp
memory/6404-8238-0x00007FFB7AC30000-0x00007FFB7AC31000-memory.dmp
memory/6404-8237-0x00007FFB79B10000-0x00007FFB79B11000-memory.dmp
memory/6408-5995-0x00000000079A0000-0x000000000801A000-memory.dmp
memory/6408-5984-0x0000000007270000-0x0000000007313000-memory.dmp
memory/6408-5937-0x0000000004F50000-0x0000000004F72000-memory.dmp
memory/6408-6025-0x000000006F810000-0x000000006FB67000-memory.dmp
memory/6408-5936-0x0000000005200000-0x00000000058CA000-memory.dmp
memory/6408-6016-0x0000000007500000-0x000000000752A000-memory.dmp
memory/6408-6022-0x0000000007530000-0x0000000007554000-memory.dmp
memory/6408-5938-0x00000000058D0000-0x0000000005936000-memory.dmp
memory/6408-6008-0x0000000007380000-0x000000000738A000-memory.dmp
memory/6408-5939-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/6408-5996-0x0000000007320000-0x000000000733A000-memory.dmp
memory/6408-5947-0x0000000005BA0000-0x0000000005EF7000-memory.dmp
memory/6408-5982-0x0000000006F70000-0x0000000006F8E000-memory.dmp
memory/6408-5972-0x0000000006F90000-0x0000000006FC2000-memory.dmp
memory/6408-5973-0x000000006F6B0000-0x000000006F6FC000-memory.dmp
memory/6408-5934-0x0000000002600000-0x0000000002636000-memory.dmp
memory/6408-5950-0x0000000005FC0000-0x000000000600C000-memory.dmp
memory/6408-5949-0x0000000005F80000-0x0000000005F9E000-memory.dmp
memory/6568-6187-0x000000006F6B0000-0x000000006F6FC000-memory.dmp
memory/6568-6245-0x0000000007D80000-0x0000000007D91000-memory.dmp
memory/6568-6235-0x0000000007FD0000-0x0000000008066000-memory.dmp
memory/6568-6069-0x00000000061E0000-0x0000000006537000-memory.dmp
memory/7144-8756-0x000001EDD6D30000-0x000001EDD6D5A000-memory.dmp
memory/7144-8757-0x000001EDD6D30000-0x000001EDD6D54000-memory.dmp