hxxps://download2268[.]mediafire[.]com/lkhjj973wesgOMxCS7V_UzV4e85TQ5pExXgPlnwN5iU0QTs4vO5xEsLyCoxj3fAXI3n2Z07x8t9l-fOCadf0V0LWZVTnTzS1NEp2x9NrTo3tVHvV1oIFmD4UxGTRvswhHIkv9Lpx3V3tbebxv3dcSYliqUQI_PyXCBni23fOVg/px18sdciutyhopr/Fortnite+Hack[.]rar

Analysis

max time kernel
230s
max time network
233s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15/05/2023, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download2268.mediafire.com/lkhjj973wesgOMxCS7V_UzV4e85TQ5pExXgPlnwN5iU0QTs4vO5xEsLyCoxj3fAXI3n2Z07x8t9l-fOCadf0V0LWZVTnTzS1NEp2x9NrTo3tVHvV1oIFmD4UxGTRvswhHIkv9Lpx3V3tbebxv3dcSYliqUQI_PyXCBni23fOVg/px18sdciutyhopr/Fortnite+Hack.rar

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 448d7bd89445d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "390975602"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "985567379"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{76D3A800-8798-40C5-A821-BF83403F6398}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390927017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31033148"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "985567379"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033148"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65D64288-F32F-11ED-9346-DEEC1CAEA8D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "390943611"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133286357911832124"	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.rar	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\rar_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\rar_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\rar_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\rar_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\rar_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\.rar\ = "rar_auto_file"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3372	chrome.exe
3372	chrome.exe
660	chrome.exe
660	chrome.exe
660	chrome.exe
660	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4724	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeShutdownPrivilege	3372	chrome.exe
Token: SeCreatePagefilePrivilege	3372	chrome.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
3372	chrome.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe
4724	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1684	1476	iexplore.exe	66
PID 1476 wrote to memory of 1684	1476	iexplore.exe	66
PID 1476 wrote to memory of 1684	1476	iexplore.exe	66
PID 4724 wrote to memory of 3004	4724	OpenWith.exe	68
PID 4724 wrote to memory of 3004	4724	OpenWith.exe	68
PID 4724 wrote to memory of 3004	4724	OpenWith.exe	68
PID 3004 wrote to memory of 4972	3004	AcroRd32.exe	71
PID 3004 wrote to memory of 4972	3004	AcroRd32.exe	71
PID 3004 wrote to memory of 4972	3004	AcroRd32.exe	71
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 376	4972	RdrCEF.exe	72
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73
PID 4972 wrote to memory of 3572	4972	RdrCEF.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://download2268.mediafire.com/lkhjj973wesgOMxCS7V_UzV4e85TQ5pExXgPlnwN5iU0QTs4vO5xEsLyCoxj3fAXI3n2Z07x8t9l-fOCadf0V0LWZVTnTzS1NEp2x9NrTo3tVHvV1oIFmD4UxGTRvswhHIkv9Lpx3V3tbebxv3dcSYliqUQI_PyXCBni23fOVg/px18sdciutyhopr/Fortnite+Hack.rar
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\Fortnite Hack.rar"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C455FFD14AF1B425AE3184EC118D1F60 --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:376
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=75F0E40BDC90BEB03B9FF6AB14946F77 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=75F0E40BDC90BEB03B9FF6AB14946F77 --renderer-client-id=2 --mojo-platform-channel-handle=1612 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8CC7CE3A9E63600D3452CA71CF55937 --mojo-platform-channel-handle=2224 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5E1C3E17C3672336ECFBA0E78D071CA7 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E03A3C8480F1B56794BF813357BB1F83 --mojo-platform-channel-handle=2208 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb9a269758,0x7ffb9a269768,0x7ffb9a269778
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2036 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4492 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4800 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1748,i,3359587414874424758,13278001737777368057,131072 /prefetch:8
  2⤵
  PID:3044

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.0.599187380\380443249" -parentBuildID 20221007134813 -prefsHandle 1656 -prefMapHandle 1652 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b1ef31c-6d47-4e31-8d58-9b0d476731e5} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 1732 216364f6558 gpu
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.1.1543322260\1591901242" -parentBuildID 20221007134813 -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7333950-5e9d-454d-a30a-17a7cb79afff} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2088 216363ef358 socket
    3⤵
    PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.2.1104944837\1249539887" -childID 1 -isForBrowser -prefsHandle 2632 -prefMapHandle 2824 -prefsLen 21117 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f44baa0-301e-41ee-bd05-e9c94b03827f} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2796 2163a54f258 tab
    3⤵
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.3.1600736540\1884876790" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3496 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30fbad93-2798-4bff-8303-5e68f769efd3} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3508 2162af61f58 tab
    3⤵
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.4.1802838564\505473972" -childID 3 -isForBrowser -prefsHandle 3936 -prefMapHandle 3932 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f732530-3620-4fab-9b34-007c3622d0dc} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3952 2163b827e58 tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.5.179491628\1350954628" -childID 4 -isForBrowser -prefsHandle 4596 -prefMapHandle 2668 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2781850d-0e39-44c7-b5cb-b642c6076c98} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4512 2162af61958 tab
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.7.837599559\1458583185" -childID 6 -isForBrowser -prefsHandle 4960 -prefMapHandle 4956 -prefsLen 26781 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed9da223-5f15-45f9-9087-f4f853a3dfb3} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4968 2163cd53258 tab
    3⤵
    PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.6.1730448306\1019780542" -childID 5 -isForBrowser -prefsHandle 4596 -prefMapHandle 2668 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ee06a01-1b14-4c02-bf77-10a96defc7c6} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4736 2163bb16158 tab
    3⤵
    PID:1796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.8.1595549701\618223111" -childID 7 -isForBrowser -prefsHandle 5336 -prefMapHandle 2644 -prefsLen 26798 -prefMapSize 232675 -jsInitHandle 1344 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe3565e5-6d15-462b-aa13-9e0ac3b76530} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3316 2163cb61058 tab
    3⤵
    PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
c8acc7ebd0274710ad136e9ebbf77b30

SHA1
d99222d014b6694013aca886e37094c480120566

SHA256
5faffea9fd8c3fd5cccb9acb4fc3dcda1b50e9f69e382acb3e07c893918a53d5

SHA512
8f030769ed0daa410468084783ec029e4a26697b8c684c18d270c459b84ca9b2359511540e37db2b35561893d72c314d273af066b623cbb3b49e7cd28ce2ecee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
ab4b510ea817e1f3b0972f7dbc8d27a3

SHA1
92e18e4d4b174820fe702a8433d57c883ab9cdfd

SHA256
b466489d720f5a511cc832dd4add16a817c78bd06643b5ecab67704c58873be8

SHA512
f9e84cc8e171b1796110a68e68d65e8b0eb8a5a2c43ef084ce261439a87ea13aa595febb889eb81f3ce8ef401093955f867216dd5611575f4d70034d9004de75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
5a8ecfb2661ff9e15e20f4efc7baa704

SHA1
2dda545f20156c55351e70c38234c2a2f5d559f9

SHA256
74417d0527faf935f9199a51acf01f09f7151db5ef3bb3856ee8483febf407a2

SHA512
22ce9cb31df4c2c1309e0c8f7fee386b61bfe209ae1cf3fd4ffb711bd6dedbbe5edfb7c5285162b629a30aacccf92229801d2fe748145f12322fd4076e56bbbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dfd2f259-da00-4668-9372-af12350f99fc.tmp

Filesize
539B

MD5
a019248e64b581251e9c79c7f87cf2ec

SHA1
098a9b1d87d7cab5e7f1f1f6cafef5bea8965133

SHA256
a51206a42aa3e745978f3178859687db7c554db48caa2a0efc9abb05063ab061

SHA512
f17287842221fa3a2e78710bf34218f03a44bd3fef6a840a4b872b2b4c0b48894981009bb4ec6644ed7f50981c604dc075e5c1374dc6f3a23314a400430aca1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2a82929d65a2e077ab644df0a8d7dc8f

SHA1
9f96ec445da7a603608f6bf80a8916cd98c4274b

SHA256
327485d1a2a6bd08c314d18e6b29527192dad12326107a042d24fc9eb9c08064

SHA512
89a7aa74e2477e6a642ac44b7985cece47ff3e3d69af343b1bdef9fb2c98a4cd3a31e73945b2a683129510749d27f9180da7a360b5047848fb7bb48af60b555b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
151KB

MD5
8ca01464e4847a1ac3dff59b667c33e4

SHA1
e133f6e8f19b3b604d6201b95706e8b463f3d938

SHA256
598e9160f92ce17384a4f23d8f2dedc90449370ca931f53a0ce8d4e324f55caf

SHA512
9b21bf97f02de9aa53130bb5c1da12a1d3f57208a65fae7d7c4f19d3ec728eb23455f517b05f13d75291ebfa6685ca1aca6e733d96d766bfc9ddc1fc20b1fa1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA02.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\Fortnite Hack.rar.kb03gf4.partial

Filesize
125.0MB

MD5
362e617e9395c514f21fd51319e21d62

SHA1
59cf88e4fa7918ba310ded78c7b7fa1680f59a48

SHA256
04a251cf3e9524aefc5e52053b35f45bf5d70a5568cc02526566dd563b994fe6

SHA512
53bbf4c2df08b97c1409696f32011aba52df82cdb2e4bfea7cf79281ebb52d7cbf824d6730cd984e3a06610665afdf172a2543757bd2bfe28b2776d8dba956f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV9H23MJ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\I6W9OUJB.cookie

Filesize
613B

MD5
a6538248cb5625b44182b68cac83aee1

SHA1
c986007b7ed1d57e377572a1390adf757d729530

SHA256
8287d6798601ba34de5e40475e4197979d1440784d00114b0546faa1c9e28116

SHA512
0902e83ce15ce1200108ad7406c9724860c5f226351c1604dbaeb76846595ca1c63e0683d20301299e5dfcfb1e58418cfdc619fb41f227ab1fa0cd73818ebba3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\p4wuoroe.default-release\activity-stream.discovery_stream.json.tmp

Filesize
152KB

MD5
b507ed1fd9712dc86e52d58e21f7cbb0

SHA1
fcc1616cee6d6b4b0149c60d0a8085582569f299

SHA256
10ddb1dd8dbbc7a68769b5a5ae61a976a08de3506b6f0f280f403834c8086d85

SHA512
8694cab11b82fbc8822934a1fed12ff445a957039d3cea386fe1672b4a2951d35878ea30de3d5b727737d00b8f7aa78d2a2fcfb3cec15b7092d6de20810aab82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\prefs.js

Filesize
6KB

MD5
fc03769491e92557713bff75b3dcae44

SHA1
a4f4687575dba8a950a014c93d8f9f086a2b68d6

SHA256
3e943e423e8dd73d3afd2444234e9c1ca4eebd430da878f5bcc15e2141da7375

SHA512
8e2266f0af8f7833397b36b31482a43a4bd798693e069f8aeb823d12b767bcdac3aed772ce10b8907fca777436e4efc39ecb5172e81d2672f1165a2427b709b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6dbb6eb2fcce6fe929f231da5bc1ccb0

SHA1
fb7b9efc4729cd7778c1582b9e8978f1cf6cbc89

SHA256
482f9a427b2563c3fb26257227f794c3ac753c05b9e88d53c3fc76b866ceaeff

SHA512
2bff9cf16354925582cf7b8895ac726f0be46fed11731eb1640156c720d0aeaf31d2c8a238d8381fc14c0d9492429ff94fb004056dbc56aa29b61d2306148f30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a4c6f2ac1f7d235606f6bc1624f39f46

SHA1
ef25cd406864a234c449a9d0473d62d621ba2730

SHA256
cc22dde68f5113cced214677e0aade7e30807f7ff811f7e711ec98dd2fdf96df

SHA512
6e61008f366c558e6d285d5381ab4b96cbdc8551bd748757652021328d9a6b2a218f5965fe78b388f23b07560b1f2f03d5dbba0b9ce18d798cf42d76d4152d3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
2868ade33b3fc157edc3d0e6b6b88d96

SHA1
2fbc5d21e4b5b51b85aa242c5f1094b78b42f06f

SHA256
463716a72dce3b7c34a12818ca051fc044627890946b4437b6998bcc24a20534

SHA512
0756622f5ab9deb31b5cb909c570b236b58fd594d9ff52b92a670761f1b447a1f15f9032a50dce0bbd9b176a761fe7a5f2095938c1642bfe04b93ba83147ee0d

Download Submit