hxxp://8nie9qiq3y64104e4f2a529[.]cvdocuments[.]ru

Analysis

max time kernel
210s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://8nie9qiq3y64104e4f2a529.cvdocuments.ru

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d0000000002000000000010660000000100002000000061dfbdf84e6b5b14490af05443958405a03a721a3c8cc30f28283c2b6337a7f9000000000e80000000020000200000003033e2230d0418d776c1c140b1827b39c09130da82679ad7b7e1da68f7f697ae20000000d1f9172e49d309a852797208966059379c6ad7e1156173a4af9b74e3dac387a940000000bd3ce347b99dae0ef2ff729ad2bc256955b7ebd174da9f9392afcff30a0b94c13ce86b9ebcc2b4df05c0f1321c0e1227a4ffadb0b52c16f4b683a085d8040bbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{77366517-CCED-11ED-B7D7-FE76446D24E5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31023354"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1288666242"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023354"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023354"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386720555"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1277728616"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1277728616"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e3f34dfa60d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d0000000002000000000010660000000100002000000066a9cc3911115baffd5d0334989eb69d1a93b70e2d6654b254e532a239279fe1000000000e8000000002000020000000f09e9e1bfa702857cebd500119fd79061ad5f13c7011898bb9e608c0643aa1eb20000000daa5fd3fda31fbe40cea8e9c0180d9969807de0b2a55653703367067cb65b7b2400000003c96381f81f695531569d047f7e906ee0ebeaf8be26e160c39b9e72c141c91ae187c9b920c6b8f14768876812606ef9fc84e4e5eab8b50c1c4c619a1f3b6319a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b10b4efa60d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe
Token: SeDebugPrivilege	3740	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exefirefox.exe

pid process

4540 iexplore.exe
3740 firefox.exe
3740 firefox.exe
3740 firefox.exe
3740 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3740 firefox.exe
3740 firefox.exe
3740 firefox.exe

pid	process
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
4540	iexplore.exe
4540	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe
3740	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4540 wrote to memory of 1988	4540	iexplore.exe	IEXPLORE.EXE
PID 4540 wrote to memory of 1988	4540	iexplore.exe	IEXPLORE.EXE
PID 4540 wrote to memory of 1988	4540	iexplore.exe	IEXPLORE.EXE
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 3740	4224	firefox.exe	firefox.exe
PID 3740 wrote to memory of 3576	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 3576	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe
PID 3740 wrote to memory of 2200	3740	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://8nie9qiq3y64104e4f2a529.cvdocuments.ru
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4540 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.0.748240077\489598941" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69778916-f7d0-49f5-9c58-5b519b9e5d87} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 1912 221609a6158 gpu
3⤵
PID:3576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.1.906067678\1070596141" -parentBuildID 20221007134813 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59540400-59ab-4247-a2ed-77605b413542} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 2300 22152a72858 socket
3⤵
PID:2200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.2.351072819\2050171526" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3140 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f513a402-8bec-4845-be39-81021e3cad82} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 3048 2215f88f458 tab
3⤵
PID:3632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.3.646658816\1349513804" -childID 2 -isForBrowser -prefsHandle 1460 -prefMapHandle 3528 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52151bbf-1ef3-4a26-86a7-f9af0dc744ca} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 2328 22152a71c58 tab
3⤵
PID:1788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.4.1608343434\866321907" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38667696-6347-4ec4-8cb7-12ba7c5bdfa7} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 3784 22152a2de58 tab
3⤵
PID:3760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.6.2097836658\709992518" -childID 5 -isForBrowser -prefsHandle 5116 -prefMapHandle 5000 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22bc75d2-95b6-49be-bb14-b71c8aac7cf6} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5104 22165bd9858 tab
3⤵
PID:5036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.7.1758958468\825375530" -childID 6 -isForBrowser -prefsHandle 5384 -prefMapHandle 5380 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {916b9668-e5ed-4783-9ea2-868773f51b46} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 5300 22165be2758 tab
3⤵
PID:5096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.5.1016337138\1063664483" -childID 4 -isForBrowser -prefsHandle 4968 -prefMapHandle 4960 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0279e01-499e-41a8-b450-1d2d23c041a1} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 4980 22165852358 tab
3⤵
PID:3868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.8.1738052653\1742058075" -childID 7 -isForBrowser -prefsHandle 5672 -prefMapHandle 5804 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23b68cd3-d5dc-415f-a185-ee563e4c52e2} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 4836 22165bfd558 tab
3⤵
PID:1516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3740.9.1817375679\911725483" -childID 8 -isForBrowser -prefsHandle 5824 -prefMapHandle 5928 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {532b0dc6-3e46-4f60-a7ad-44f267500234} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" 6028 22166cde958 tab
3⤵
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
bb4cd9db319e8007cd72aa17af4b76a0

SHA1
8951973b028c09c71a792feff54e3096454a8c42

SHA256
aca8049efb96040e2124d06db9c9b2f3c5ce4166c831dabaa421e14cb5da1295

SHA512
6187a2b310a672f9080b9865115f44ea827a4f013f791105efc1f7641f11f9759877d61f5c50140fcf892b95318f1276eace9f78161dbcaf6e011f31e34f0729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
abdaa9b94ec1e9ae81bc46052e0c9564

SHA1
ccf84311dc4867ddd39165e6843df23d427efcc0

SHA256
95237812743947a934c7470bf2f5dce2c13108b59b056ea6213849f29a067d51

SHA512
61fe370f8496e2459bc9e6de1827a96c3aecf6ff28401bdf0fca7107bc038fd5b5f2cc6281bbdd5014e9e9e9da2ed274fb4acd7e8fead34d811e41d3675da853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp
Filesize
163KB

MD5
6e41befb568147e0e163503ee3c0d3fc

SHA1
3456355fa75781041b289cbebddd3bad9b61a4d2

SHA256
1e5c62fd0c97a20a7d4825dbe031d62d86c53c49cfa1aba9d9941f89f49efc39

SHA512
3e6ebfb35251b0cd6eaf13a0351267aa56f70cdfdf4e4e5668392b590310b52a7d991748b7ab959c284a05ca6cbcd8410882c6a1ed2dd6169fc7d0fc16c7a6db

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052
Filesize
14KB

MD5
52593e4fb9a45cf5a6ef8340fd89255c

SHA1
5b9c95225083f92b3d9e736489d908eff7d06c66

SHA256
c35610573548840c7e455e321248869dbc1176a98fc66f4b9074ca43f5dd84c3

SHA512
8aed660b5bb192a2177ed455c506b5877868e064edb204182c38301109aeb3d0350337b6b99be0f82e4b7eaf06b2793f171c72f1b6bdf28b5e282a95d3433893

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
7ca727ce262f52e2989afc0ccec80df1

SHA1
ed99e692955296b28231ba5bee316530d3cadf1f

SHA256
e3891e281736ac22067e33bddb233e556f6d3aa7b5d83599e7b391c567723693

SHA512
d97da500e2e06c053e62588a56e0eb5b1293e9b7ba53016780f43615eff0e56e3a7014ce00a2f4c7d259a527d40e30b93c2a888e61b0b738a0a2d4a89538a738

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
137a62f04201efaf69626fc8eea50f14

SHA1
6bb7b4f3167e5f525d09b2656ea9c163c19e8ca9

SHA256
43b94b8a70e4b428d86bd876c0522f8554f2a82f221a2c171a248995aceea7b0

SHA512
57703cc7e31ba750b67d2b65edee988b003a0b124accf3e9b3410748534fcae020b7bf876c1acc62324a6deab60cf4cd7b1f278de09e467802e25705ab8c485e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
4e5157bc76b96e5f46e8b3f3b800c93d

SHA1
0a5015aa685035c1b3fc77e2b5309996860219a0

SHA256
41ecca0aff4fa2c4a7b9da77c662f0509393175f788ccd8d8d8a7bd6c09a941c

SHA512
eb3e0f76ea8bae445d4175c47af2fc912312f663b90246c2658f7b444125ec33859dbc35db074f85465fa0061c1409585df3a3d66db203d2916d9b38da858597

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
f33ce7d8184aed7ebf2ce0bf0f61df77

SHA1
55dd711801a70536d29ee0a2625c58aac587cf84

SHA256
386ce40d95648a1bdce4f0bdf6408e1e7e9100d5fe7fef7dd5b816d849cb7139

SHA512
771d28300946176f644e4fc141df905e8d73b480733bf68ce115ae5f4c9024d3b63cfca17cefe745a35b4853e9366483c8366d9a610680f7a08789d7f3d61461

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
5b4cac45f44446da1b6807c74d8843a8

SHA1
c2a44995bf62e39b5dee70fb5e0e525d82d9157b

SHA256
ba1577252d0e9ef75345a3a64285c5094dec7160fc8687a2563fbe618bbff623

SHA512
a1fc579561d72ba64192b9e264592a74d4d002735f7f7824f6b70df50f158c57d1fa2a1af103edb99256c8fac1adf67de5a320a8a935e0664b7a8839b2331a93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
8KB

MD5
fd6ea36f469fdc34ce9d165509eb291e

SHA1
0729db9575ecf632d9124e274907ddc63f51fb0b

SHA256
6eb31331187a0ea5efda31cc09031353bd42e93aac6f4be34adbf8fe54055eef

SHA512
c1f8e869e86258ba3394dd45b5d953d4bbfd3b094e783b90f55d441b66ffec931adc883c743d24ba45d42d71868c6c950224279d3abff2fc9e998ab48a66ff43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js
Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
c3f34077e9cb1ce3089f427ddbdfeabe

SHA1
21421649808ebba916e62af811d993558c97a95d

SHA256
38c39d1491c14e1610c500a2685d7f7f217702fd0e644c3faf7a1770def19971

SHA512
fa35d880f0ae84fe7d66ac1a7f9c765dd76d2e07111601284b282a50730c41cc598f152355c53a73cfd2951d48b488a58a5f2f56eeda9b595335d175aec30933

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
810c16c8a5b946c1db48a3b573cfba5e

SHA1
de310273b28be134b57f5e1502a4c01b1f77e4bc

SHA256
b96e82168b272b4f500a15226be88d84ba392e854d0163d27f92668ef303bebc

SHA512
a128b684df4e6e68d1899a3438ae323b3b427b846b3416cd84687470c70ff7b2e5781b84d563698262a98ccb620a60fa70c1fe6994051779799e72d8d38847a4

Download Submit