307e6d7c274dd7b3a0922b29e27d8a0bb62591c2d96aeef9d7e9823fdcd1f204

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gamelaunchhelper.exe
Size

97KB
MD5

bcbac3a0f7a38dd4646efc2d5f72d279
SHA1

528f37e3f2594931eac9d79318c00b637806de08
SHA256

307e6d7c274dd7b3a0922b29e27d8a0bb62591c2d96aeef9d7e9823fdcd1f204
SHA512

ba026d1107850ff9a25d1697591c2e8cd373c6ec2218a94a43b8d545790602dd338bd3140e10e9f95c0f0ce1644cd4e04b2d26313f3382d0af349a19b8295366
SSDEEP

1536:AXstYNsccJgwYURbOAlQ6wZTtF/PqYUR7SDFLV5JwtuYhVzj:AXstWLWq6YLUR7eNXJwtuYb3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000232ed-498.dat	upx

Downloads MZ/PE file

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	taskmgr.exe
Token: SeSystemProfilePrivilege	3532	taskmgr.exe
Token: SeCreateGlobalPrivilege	3532	taskmgr.exe
Token: 33	3532	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3532	taskmgr.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe
3532	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 2772 wrote to memory of 4988	2772	firefox.exe	102
PID 4988 wrote to memory of 3876	4988	firefox.exe	103
PID 4988 wrote to memory of 3876	4988	firefox.exe	103
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 4468	4988	firefox.exe	104
PID 4988 wrote to memory of 224	4988	firefox.exe	105
PID 4988 wrote to memory of 224	4988	firefox.exe	105
PID 4988 wrote to memory of 224	4988	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gamelaunchhelper.exe
"C:\Users\Admin\AppData\Local\Temp\gamelaunchhelper.exe"
1⤵
PID:2384

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.0.294735223\258245229" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0e93b6a-5e55-4558-a6d5-6c4056e37844} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 1960 20913fea158 gpu
    3⤵
    PID:3876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.1.1585166683\497522746" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4654c79f-df37-42f2-90b9-15437fd05fe0} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 2364 20913b30858 socket
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.2.1721777555\549198283" -childID 1 -isForBrowser -prefsHandle 3360 -prefMapHandle 3356 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4920995d-850c-49f4-a783-eeda2e6bba8c} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 3008 209180a3658 tab
    3⤵
    PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.3.1937481357\2127688134" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03b53baf-dabe-4ec1-9080-1141e6829d89} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 3588 20907760a58 tab
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.4.1762545312\1657006157" -childID 3 -isForBrowser -prefsHandle 4320 -prefMapHandle 4316 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7523725-c387-4a7f-9c81-f177c5800da8} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 4332 209193dc358 tab
    3⤵
    PID:3256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.5.1419034611\1865296288" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5108 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6a7cce-601f-42c8-b371-3c157587691d} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5092 2091859ae58 tab
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.7.1927028424\531078633" -childID 6 -isForBrowser -prefsHandle 5408 -prefMapHandle 5412 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd969f3d-4c6d-45cb-868e-97d67373eed8} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5400 2091a3ba158 tab
    3⤵
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.6.723503122\2043847497" -childID 5 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7f8d909-9518-4212-97c9-ba13f754dd68} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5208 2091a1eb858 tab
    3⤵
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.8.430302266\1535641517" -childID 7 -isForBrowser -prefsHandle 5756 -prefMapHandle 5260 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b357fb36-25eb-4ba6-9513-6c8b0f82c415} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 1640 2091b92a958 tab
    3⤵
    PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.9.105005860\1379553356" -childID 8 -isForBrowser -prefsHandle 5176 -prefMapHandle 5188 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7edae02-5c5c-4d69-8f79-c14ed9725d92} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 4192 2091ae4eb58 tab
    3⤵
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.10.623760983\195321085" -childID 9 -isForBrowser -prefsHandle 5596 -prefMapHandle 5612 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed6d873a-e1b0-4324-b0fd-47a16db845cd} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 5420 2091c0e0258 tab
    3⤵
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.12.1764045954\2020972472" -childID 11 -isForBrowser -prefsHandle 9544 -prefMapHandle 9540 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82a22ff8-c82d-4b68-967f-af39b032190d} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 9552 2091d44ad58 tab
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.11.947381739\1518228467" -childID 10 -isForBrowser -prefsHandle 9688 -prefMapHandle 9692 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f936333-b86e-4f16-a2b3-b2f8d2fff20b} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 9680 2091d449258 tab
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4988.13.285495158\940775454" -childID 12 -isForBrowser -prefsHandle 9096 -prefMapHandle 9100 -prefsLen 26765 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {870bcdcd-1c08-48b3-a28b-c3f0de91c7af} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" 9088 2091ae15458 tab
    3⤵
    PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e0543415cdc2e8cb8acd1297b37194ec

SHA1
a21d5d445e73ff03c5763c2e74d43e754b7d598a

SHA256
10e002b2b6d3cbbd97cee895553caa6c3dd164ab5d2fd5ab49c51643aea70fa3

SHA512
3042be1a6253f9ae2ed216cf5f902be1c4a72d79c2130a8122283384b8e4b985e7100c316eeab074780f97c578d29d4eb0ec16b048a2d6dea0891e7c4f498d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\c2f45c46-6214-4a88-a717-549f441fe29f

Filesize
746B

MD5
0d62f4b944d930f5b8d0f050295859ba

SHA1
f7099f1015d210d0bacd16958cab4ffa1af418c9

SHA256
c0a9317394b0bc510da8f9fa09d3ab321da4e65b0b4e5ec12fb77dd12bd7198f

SHA512
739b81077ecb5553fd4d7874bc9a59d34488477f448111c7670a23e944276ef062de0dae349f1c5e9fd4e998f99a04f0651756f8cf0b72165886e067ee05fdf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\d576beea-401b-4689-8678-5edcc50e87ee

Filesize
10KB

MD5
405abdaba1e7dfe59e11794e341adc78

SHA1
8c68687ef62cd98b614d99b6f94a3b9bd496f840

SHA256
ab99c5fa2e68d9c5cce767af986ca7cfeb96d2ea4bd8938b699d423173bb19e3

SHA512
4229d6aa4a62887a0215c33ba9ba7c5b9863e0a44a01c133fefe6831876c2e22afd8a37ed8101563d8fecc2702871de9ed540abd3182e9063b1b008bb241ce43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs-1.js

Filesize
6KB

MD5
15b2b5e1801f12b3b284620d51cd8a4a

SHA1
4fe5f829ad8234f8c4497cc9cdc48ec62707c4fb

SHA256
1f786146b4150b6377fef681a544711685078575964dac376ea55f67c49b81c4

SHA512
962e3d12ddada9ccb183b6979f957f73c66dff7b742f76387db8d3f4e77a2caf1cae6f093e3e5064e6432e21e2399e4dce868101f54c4a9f72c704a41e10d7c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\prefs.js

Filesize
6KB

MD5
02007e69ddc8953eee01bf76789553af

SHA1
b3caa20e870e1e2a394b6c2ae40b05bf3df223c4

SHA256
c5d604dcffc236a316c757328d156c4deeee35e7a7046b19cfcfa82bde83bd0e

SHA512
2ebe956fd041becaf71b1edafe60acff62b43ea9299a227f8f43300e8bc83f4e0971ef3fa2784312a5f27d1212120149864b2d3480b9512e5c400f21fc34f5ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
987B

MD5
aca131a7652236851dbe8cba3e3a80c6

SHA1
92560651a184d37b8ec91f4458bce9bab8a18f8a

SHA256
d21f3ea1b6352782d7e79bf521e67860ae0fe52e0da690e443e4121965bb54fa

SHA512
49a5794c0f68686398374e7a8e5768f815d715facf60c333c5bde64efe795c74dabf159b93d86234ff0815378b50f4e1812ab473350a5d1b85e9100e53444303

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
483c7343e64f17ce7821a26cc18fc641

SHA1
1f88d352352e5ac0101dc3ef3a4c5e45340e5b3c

SHA256
6a65368e61bed52390d58ef098aa51ff74d69532cf39a77ad11212eeed1f0531

SHA512
b294713d3140a3c9c7b93a6357ad9e3de6e7cd3e686e6c04141c0d4144515a3ae926bbd282b2f8004efce45e368175a78b979f0b335bc88f7e2a48db86a9eb3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
05352059283921dc4c40767af47349a6

SHA1
6e87120d838e04ec216b5a1a2f99794f30f1eed5

SHA256
064f0db8c7a90a1f60a88f8da03da169233417244e838b1b36c26199d8d9025d

SHA512
c96ba9cc86c86dfd8f8600ca641348df777ff91e1fa75f4c611c9f391148000f69eee1cc11491e503ebe67d6b1ecfaa7de76049e7250499f4f0b441fddb613ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
6c36970f1ba1e70d76efe18f118a0571

SHA1
9588df7ea461e1d885962d03bc56421d151d67fd

SHA256
6ba2c26098aad61a5b47ccdb9f927830334df7a147b14551846c5707850e4f72

SHA512
8724282100fbe8ec759f22c690fcd74094b12201dc9a16f66e8db5cc24c639ba69674bb7e371ea5c135d509b6de01057c1d9567d8f97295de5a43322deb85b6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
b4e248b8f969358a7bfa32c68bda5789

SHA1
201120599bc3a747d419adc989473b524b7bc56c

SHA256
53bba6be73ce1c9b4ae9b1810a5225aaa7dfa9abd0ac1eb3e9b9bff37b266443

SHA512
bd21e656c602c09e140eb153225054a947e3b446927d8bbe0720e2e6cfeff0b237e0a5deea5d575ee170479e0b8472799f19c553cf3955982123e32cca006c35

Download Submit
C:\Users\Admin\Downloads\OperaGXSetup.SQSBH-kw.exe.part

Filesize
3.2MB

MD5
4a153479306a555cb9beb9470d27bd5a

SHA1
4155ed95567f82794139082c69a5ba11adb23df5

SHA256
6be57c14f7eddb30fe38329c3b1ad89f5936ba7ebc7ad9a5f5a5529a0929622b

SHA512
142540c8579aa59f60b1db078ba20e509d3d131ab714a52f06d2b1daf96a2dda6cd7c234b3e7facb3aa012998a9b751a09599204a9ef20222de0f6a9dadb5ee1

Download Submit
memory/3532-6-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-8-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-7-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-2-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-0-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-9-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-1-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-12-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-10-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download
memory/3532-11-0x000002C43C470000-0x000002C43C471000-memory.dmp

Filesize
4KB

Download